---
title: "Publish Reports"
method: POST
path: "/v1/sources/{id}/reports"
tags: ["Intelligence Sources"]
---

# Publish Reports

`POST /v1/sources/{id}/reports`

Submit threat intelligence reports with observables, TTPs, and threat actor associations to a custom source.

## Path parameters

- `id` string, uuid, required — Identity of the source

## Request body

- object[]
  - `externalId` string — Report identifier from the external intelligence source
  - `observables` string[], required — IPs, domains, hashes and URLs related to the report
  - `tlp` 'clear' | 'green' | 'amber' | 'amber+strict' | 'red' — TLP
  - `ttp` string[] — TTPs
  - `malware` string[] — Malware
  - `threatActor` string[] — Threat Actors
  - `timestamp` string, date-time — Date and time of the reported event

## Response `202`

Reports were published for processing

## Other responses

- `400` — Invalid input format
- `404` — Intelligence source not found
- `422` — Invalid malware, threat actor or TTP

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)