---
title: "Create custom source declaration"
method: POST
path: "/api/v2/customSources/create"
tags: ["Custom Sources"]
---

# Create custom source declaration

`POST /api/v2/customSources/create`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/customSources/create`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Declare a custom security source that the scanner should recognize. The description is validated by an LLM guard before persisting. Only `name` and `description` are required. Applies org-wide by default; pass `repositoryIds` to restrict to specific repos.

## Request body

- CreateCustomSourceInput
  - `organizationId` string
  - `name` string, required: Name for the custom source declaration
  - `description` string, required: Natural language description the scanner uses to identify this source in code. Should describe the data entry point, its package/class, and why it receives untrusted data.
  - `globPattern` string: Glob pattern for files this source applies to
  - `repositoryIds` string[]: Optional. Repository IDs to restrict this source to. When omitted (and no scope is given), applies to ALL repositories in the organization.
  - `scope` 'allRepositories' | 'repositories' | 'tags': Optional explicit scope. Use tags with tagIds to apply the source only to repositories carrying those tags.
  - `tagIds` string[]: Optional. Tag IDs to associate with this source; with scope tags they define where it applies.

## Response `200`

Source declaration created successfully

- CustomSource
  - `id` string, required
  - `name` string, required
  - `description` string, required
  - `globPattern` string, required
  - `enabled` boolean, required
  - `repositoryIds` string[], required
  - `scope` 'allRepositories' | 'repositories' | 'tags', required: Where the declaration applies: every repository, the listed repositories, or repositories carrying its tags.
  - `tags` RuleTag[], required
    - `id` string, required
    - `name` string, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)