---
title: "Create custom sink declaration"
method: POST
path: "/api/v2/customSinks/create"
tags: ["Custom Sinks"]
---

# Create custom sink declaration

`POST /api/v2/customSinks/create`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/customSinks/create`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Declare a custom security sink that the scanner should recognize. The description is validated by an LLM guard before persisting. Only `name` and `description` are required. Applies org-wide by default; pass `repositoryIds` to restrict to specific repos.

## Request body

- CreateCustomSinkInput
  - `organizationId` string
  - `name` string, required: Name for the custom sink declaration
  - `description` string, required: Natural language description the scanner uses to identify this sink in code. Should describe the security-sensitive operation, its package/class, and why it should be treated as a sink (e.g. SQL execution, command execution, file writes).
  - `globPattern` string: Glob pattern for files this sink applies to
  - `repositoryIds` string[]: Optional. Repository IDs to restrict this sink to. When omitted (and no scope is given), applies to ALL repositories in the organization.
  - `scope` 'allRepositories' | 'repositories' | 'tags': Optional explicit scope. Use tags with tagIds to apply the sink only to repositories carrying those tags.
  - `tagIds` string[]: Optional. Tag IDs to associate with this sink; with scope tags they define where it applies.

## Response `200`

Sink declaration created successfully

- CustomSink
  - `id` string, required
  - `name` string, required
  - `description` string, required
  - `globPattern` string, required
  - `enabled` boolean, required
  - `repositoryIds` string[], required
  - `scope` 'allRepositories' | 'repositories' | 'tags', required: Where the declaration applies: every repository, the listed repositories, or repositories carrying its tags.
  - `tags` RuleTag[], required
    - `id` string, required
    - `name` string, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)