---
title: "Create intel source"
method: POST
path: "/api/intel/sources"
tags: ["Intel"]
---

# Create intel source

`POST /api/intel/sources`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/intel/sources`
- Auth: HTTP bearer

Creates a custom RSS, MISP, or TAXII intel source

## Request body

- union
  - object
    - `kind` 'rss', required
    - `name` string, required
    - `feedUrl` string, uri, required
    - `enabled` boolean
  - object
    - `kind` 'api', required
    - `apiType` 'misp' | 'taxii', required
    - `name` string, required
    - `serverUrl` string, uri, required
    - `apiKey` string
    - `enabled` boolean

## Response `200`

Successful response

- object
  - `id` string, required
  - `name` string, required
  - `displayName` string, required
  - `description` string, nullable, required
  - `kind` 'rss' | 'api', required
  - `apiType` string, nullable, required
  - `isBuiltIn` boolean, required
  - `feedUrl` string, nullable, required
  - `serverUrl` string, nullable, required
  - `organizationId` string, nullable, required
  - `createdBy` string, nullable, required
  - `hasApiKey` boolean, required
  - `enabled` boolean, required
  - `sourceEnabled` boolean, required
  - `subscriptionEnabled` boolean, required
  - `scheduleCron` string, nullable, required
  - `maxEntries` number, required
  - `lastFetchedAt` string, nullable, required
  - `lastStatus` string, nullable, required
  - `lastError` string, nullable, required
  - `itemCountLast24h` number, required
  - `syncJob` object, nullable
    - `jobId` string, required
    - `status` 'pending' | 'retrying' | 'waiting' | 'in_progress' | 'succeeded' | 'failed' | 'canceled' | 'expired' | 'skipped', required
    - `queuedAt` string, required
    - `startedAt` string, nullable, required
    - `finishedAt` string, nullable, required
    - `updatedAt` string, required
    - `attemptCount` number, required
    - `error` string, nullable, required
  - `createdAt` string, required
  - `updatedAt` string, required

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)