Enabling Splunk Observability Cloud Capabilities Using the Admin Config Service (ACS) API

Applicability

Splunk Cloud Administrators, Identity & Access Engineers

Description

When linking a Splunk Cloud Platform stack to a Splunk Observability Cloud organization (via the Splunk App for Observability Cloud setup page), the integration status may report as Active with configuration type Unified Identity, but the required Observability capabilities and default o11y_* roles (such as o11y_access and o11y_admin) fail to populate on the Splunk Cloud stack.

In environments where corporate policy prohibits installing the acs binary/CLI, administrators must execute capability enablement directly against the Admin Config Service (ACS) REST API.

Investigation

1. Splunk Cloud Stack Name: The deployment prefix (for https://mycompany.splunkcloud.com, the stack name is mycompany).
2. Administrative Access: An account with the sc_admin role on the target Splunk Cloud stack.
3. Authentication Token: A valid Splunk Cloud JSON Web Token (JWT) or API token generated under Settings > Tokens.
4. Network Access: Outbound HTTPS access on port 443 to https://admin.splunk.com.

Resolution

Step 1: Set Up Environment Variables

Define your stack parameters and credentials in your terminal session:

export SPLUNK_STACK="<your-stack-name>"
export ACS_TOKEN="<your-jwt-or-bearer-token>"
export ACS_BASE_URL="https://admin.splunk.com/${SPLUNK_STACK}/adminconfig/v2"

Step 2: Inspect Active Stack Capabilities

Verify the current state of enabled features and capabilities to confirm missing Observability entitlements:

curl -s -X GET "${ACS_BASE_URL}/capabilities" \
  -H "Authorization: Bearer ${ACS_TOKEN}" \
  -H "Content-Type: application/json" | jq .

Step 3: Enable Observability Capabilities via the ACS REST API

Send a POST request to register and activate the Observability Cloud capabilities on your stack:

curl -X POST "${ACS_BASE_URL}/capabilities" \
  -H "Authorization: Bearer ${ACS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "o11y_access",
    "action": "enable"
  }'

Related Links

Unified Identity: Splunk Cloud Platform and Splunk Observability Cloud