Does Panther automatically backfill logs after an API key issue is resolved?

Last updated: February 6, 2026

QUESTION

When a log source experiences an invalid API key issue, will Panther automatically backfill the missing data once the API key is restored?

ANSWER

The behavior that is described in this article refers only to log pullers.

Yes, Panther automatically handles backfilling of logs when API key issues are resolved. When a log source resumes after an API key is fixed, it will automatically pick up from where it left off and ingest any missing data.

This automatic backfill behavior applies to most Panther log source pullers, including Okta. You may notice a spike in ingestion rates immediately after resolving the API key issue - this is expected behavior as the system catches up with the missing data.

Note: For very large data gaps (exceeding one month), this automatic backfill behavior may not apply. In such cases, please contact Panther support for assistance.