What this endpoint does

Creates a new custom intelligence source, which serves as an organizational container for publishing related threat intelligence reports through the Autonomous Threat Operations API. Each source receives a unique identifier that is required when publishing reports via the Publish Reports endpoint. Sources help organize reports by origin, team, or intelligence category, making it easy to manage and attribute collections of published threat intelligence within your Recorded Future environment. Use the List Sources endpoint to view existing sources, or the Get Source endpoint to retrieve details for a specific source by ID.

Response data

Returns the newly created source object, including its unique UUID identifier, the assigned name and optional description, and creation/update timestamps. The source id is the key value needed for subsequent operations — pass it when publishing reports to associate them with this source, or use it with the Get Source and Update Source endpoints to manage the source's metadata over time.