Sources and destinations

Everything that can send data to a project, and where copies can go. The catalog is served at GET /v1/projects/{prj}/sources and shown on the Sources page. A receiver is "enabled" when the project has a credential whose scope matches the entry (create one under Settings, Credentials).

Send the key as Authorization: Bearer wti_YOUR_KEY to https://ingest.example.com unless the protocol dictates its own header (Splunk HEC Authorization: Splunk <key>, Datadog DD-API-KEY).

The Pub/Sub push URL carries a route-limited push token, not the ingestion key: it authenticates only this route, so a URL kept in load-balancer or push-subscription logs cannot be replayed as a key. prefix is the 8 characters after wti_; derive the token from the key (an ingest:logs key):

KEY=wti_...
printf %s wt-pubsub-push-v1 | openssl dgst -sha256 -mac HMAC \
  -macopt hexkey:"$(printf %s "$KEY" | openssl dgst -sha256 -r | cut -c1-64)" -r | cut -c1-64

The old POST /gcp/pubsub?key=wti_... form still works during migration and answers with Deprecation: true; set WT_PUBSUB_QUERY_KEY=off on the gateway to refuse it.

Delivery is at-least-once. Receivers listed here that are not yet served by the gateway return 404 until their gateway task ships.

Destinations

S3 and OTLP HTTP export destinations are managed under /v1/projects/{prj}/export-destinations (logs and traces, optional filter expression). Secrets are write-only.