o11y IM - Retrieve Token Id/Name by Secret Value via API

Applicability

Splunk Observability Infastructure Monitoring (IM), Splunk Observability Log Observer Connect, Splunk Observability Application Performance Monitoring (APM)

Description

Use this article in order to retrieve a token's name using the token's secret value via an API query.

Investigation

1. First, identify the Organization Access token secret value that will be used to query. Additionally, you can use the token's name to retrieve an access token's secret if you are an Administrator in Splunk Observability.

2. Use your Splunk User API Access Token to submit a query to the Observability API as shown in the next step. If you don't know your User API Access Token, you can find it by navigating to your Observability instance. Next navigate to Settings, then click on your Username shown in the top left corner. Then select "Show User API Access Token" from the top right side of the screen

Resolution

3. Now, using the token retrieved in the step 1, submit the following API Query:

curl -X GET "https://api.{REALM}.signalfx.com/v2/token" \
    -H "Content-Type: application/json" \
    -H "X-SF-TOKEN: <insert_user_api_access_token_value>"#Or for HTTP method instead of curlGET https://api.{REALM}.signalfx.com/v2/token HTTP/1.1
Content-Type: application/json
X-SF-TOKEN: <insert_user_api_access_token_value>

a.You will then compile a list of tokens (note that it will be limited to 10,000 results, please contact support for help if you need over 10,000 token results), and you can use your secret value to cross reference the results and find the token Id or name of the token. 

 

3b. Additionally, if you know the name of your token and would like to find the secret value for it, use this command:

 

curl -X GET "https://api.{REALM}.signalfx.com/v2/token/<token_name>" \
    -H "Content-Type: application/json" \
    -H "X-SF-TOKEN: <insert_user_api_access_token_value>"#Or for HTTP method instead of curlGET https://api.{REALM}.signalfx.com/v2/token/<token_name> HTTP/1.1
Content-Type: application/json
X-SF-TOKEN: <insert_user_api_access_token_value>

This will retrieve the secret value of a token based off of it's name. For additional help or query options, please see:

https://dev.splunk.com/observability/reference/api/org_tokens/latest#endpoint-retrieve-tokens-using-query

Related Links

https://dev.splunk.com/observability/reference/api/org_tokens/latest#endpoint-retrieve-tokens-using-query

https://docs.splunk.com/observability/admin/authentication-tokens/org-tokens.html

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release