---
title: "Publish Reports"
method: POST
path: "/v1/sources/{id}/reports"
tags: ["Intelligence Sources"]
---

# Publish Reports

`POST /v1/sources/{id}/reports`

## Request

- Base URL: `https://api.recordedfuture.com/autonomous-threat-operations`
- URL: `https://api.recordedfuture.com/autonomous-threat-operations/v1/sources/{id}/reports`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Submit threat intelligence reports with observables, TTPs, and threat actor associations to a custom source.

## Path parameters

- `id` string, uuid, required: Identity of the source

## Request body

- object[]
  - `externalId` string: Report identifier from the external intelligence source
  - `observables` string[], required: IPs, domains, hashes and URLs related to the report
  - `tlp` 'clear' | 'green' | 'amber' | 'amber+strict' | 'red': TLP
  - `ttp` string[]: TTPs
  - `malware` string[]: Malware
  - `threatActor` string[]: Threat Actors
  - `timestamp` string, date-time: Date and time of the reported event

## Response `202`

Reports were published for processing

## Other responses

- `400`: Invalid input format
- `404`: Intelligence source not found
- `422`: Invalid malware, threat actor or TTP

---

[API](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/autonomous-threat-operations-api/revisions/a984b61a0cf8?raw)