Ingest event for indicator evaluation

POST

/api/v2/events/ingest

curl --request POST \
  --url https://localhost:10001/api/v2/events/ingest \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "correlationId": "example", "eventSubtype": "example", "eventType": "indicator", "indicatorId": "example", "metadata": {}, "payload": {}, "projectId": "example", "provider": "example", "service": "example", "source": "example", "timestamp": "2026-01-15T09:30:00Z" }'

Accepts an indicator event and queues it for asynchronous indicator evaluation

Authorizations

• BearerAuth

Request Body

Event to ingest

Media type application/json

object

correlationId

Accepted but unused

string

eventSubtype

Accepted but unused

string

eventType

required

Only “indicator” is accepted

string

Allowed values: indicator

indicatorId

required

Routing key; required

string

metadata

Accepted but unused

object

payload

required

Read by the extraction rules

object

projectId

required

Routing key; required

string

provider

Accepted but unused

string

service

Accepted but unused

string

source

required

Originating system, e.g. aws

string

timestamp

required

Event time, RFC 3339

string format: date-time

Example

2026-01-15T09:30:00Z

Responses

202

Event accepted for processing

Media type application/json

The outcome of ingesting an event: what it routed to, and what it created

object

declarationsCreated

Array<integer>

errors

Array<string>

evaluationsCreated

integer

eventId

string

status

“processed” | “no_route”

string

Example ^generated

{
  "declarationsCreated": [
    1
  ],
  "errors": [
    "example"
  ],
  "evaluationsCreated": 1,
  "eventId": "example",
  "status": "example"
}

400

Bad request - Invalid event payload

Media type application/json

Error body for the policy conversion, policy export, and event ingestion endpoints, carrying a machine-readable code

object

code

string

details

string

message

string

Example

{
  "code": "INVALID_REQUEST",
  "details": "unexpected end of JSON input",
  "message": "Invalid request body"
}

401

Unauthorized - Authentication required

Media type application/json

Error body for the policy conversion, policy export, and event ingestion endpoints, carrying a machine-readable code

object

code

string

details

string

message

string

Example

{
  "code": "INVALID_REQUEST",
  "details": "unexpected end of JSON input",
  "message": "Invalid request body"
}

403

Forbidden - No access or insufficient permission

Media type application/json

Error body for the policy conversion, policy export, and event ingestion endpoints, carrying a machine-readable code

object

code

string

details

string

message

string

Example

{
  "code": "INVALID_REQUEST",
  "details": "unexpected end of JSON input",
  "message": "Invalid request body"
}

500

Internal server error

Media type application/json

Error body for the policy conversion, policy export, and event ingestion endpoints, carrying a machine-readable code

object

code

string

details

string

message

string

Example

{
  "code": "INVALID_REQUEST",
  "details": "unexpected end of JSON input",
  "message": "Invalid request body"
}