---
title: "List the organisation's watched sources and the source quota."
method: GET
path: "/surveillance/sources"
tags: ["surveillance"]
---

# List the organisation's watched sources and the source quota.

`GET /surveillance/sources`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/surveillance/sources`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

## Response `200`

OK

- SourcesResponse
  - `quota` QuotaDto, required
    - `byKind` QuotaByKind, required
      - `DOMAIN` QuotaLine, required
        - `limit` integer, nullable: `None` = no per-kind limit (only the total applies).
        - `used` integer, required
      - `LOCKFILE` QuotaLine, required
        - `limit` integer, nullable: `None` = no per-kind limit (only the total applies).
        - `used` integer, required
      - `MANUAL` QuotaLine, required
        - `limit` integer, nullable: `None` = no per-kind limit (only the total applies).
        - `used` integer, required
    - `defaultStackComponents` QuotaLine, required
      - `limit` integer, nullable: `None` = no per-kind limit (only the total applies).
      - `used` integer, required
    - `limit` integer, required
    - `plan` string, required: The served plan (`billing::effective_plan_name`).
    - `used` integer, required
  - `sources` WatchSourceDto[], required
    - `componentCount` integer, required
    - `createdAt` string, date-time, required
    - `description` string, nullable
    - `domain` string, nullable
    - `id` string, required
    - `isDefault` boolean, required
    - `kind` 'Domain' | 'Lockfile' | 'Manual', required: `WatchSource.kind` — the unit of sale.
    - `lastReadAt` string, date-time, nullable
    - `lastReadError` string, nullable
    - `lastReadStatus` 'Ok' | 'Partial' | 'Unreachable' | 'Refused' | 'ParseError': `WatchSource.lastReadStatus`.
    - `legacyPerimeterId` string, nullable
    - `lockfileFormat` 'PackageLock' | 'ComposerLock' | 'Requirements' | 'GemfileLock' | 'CargoLock' | 'CycloneDx': `WatchSource.lockfileFormat`.
    - `monitoredCount` integer, required
    - `name` string, required
    - `nextReadAt` string, date-time, nullable
    - `openFindingCount` integer, required
    - `status` 'Active' | 'Paused', required: `WatchSource.status`.

## Other responses

- `400`: Invalid request
- `401`: Unauthorized

## Changes

- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/surveillance/sources/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)