Skip to main content
POST
Create threat detection config

Overview

Create a new threat detection config so a source starts scanning for your organization. Sources that are disabled by default have no config row, so they cannot be enabled through Update Detection Config until you create one here. A single source can have several configs, each with its own query, schedule, or brand. Use title and description to tell them apart.

When to use

  • Turn on a source that is disabled by default for your organization.
  • Add another config to a source you already run (for example, a second query or a brand-scoped variant).
  • Provision a source-specific config payload programmatically.
For an existing config, use Update Detection Config instead.

How it works

  • source must be a key returned by List Detection Sources. Global-only sources and sources with no implementation are rejected.
  • cron is only accepted for scheduled (pull-based) sources. Omit it to use the source’s default schedule.
  • config is validated against the source’s configSchema from List Detection Sources. An empty object {} is allowed; schema defaults are applied at scan time.
  • brandId, when passed, must belong to your organization. Omit for an organization-wide config.
  • The config and an initial history row are written in one transaction so default-sync jobs don’t disable it.

Authorizations

X-API-KEY
string
header
required

Your API key. This is required by most endpoints to access our API programatically. Reach out to us at support@chainpatrol.io to get an API key for your use.

Body

application/json

Create a threat detection config

Creates the config row that makes a detection source run for your organization. Sources that are disabled by default have no config row, so they cannot be enabled through /detection/configs/update until one exists.

A source can have several configs, each scanning with its own query, schedule or brand. Use title to tell them apart.

source
enum<string>
required

Detection source key, from GET /detection/sources. The source must support the organization scope; global-only sources cannot be configured per organization.

Available options:
meta_ads_search,
telegram_channels_search,
telegram_user_search,
telegram_channels_search_vetric,
telegram_user_search_vetric,
facebook_page_search_vetric,
instagram_account_search_vetric,
twitter_search_vetric,
linkedin_people_search_vetric,
linkedin_company_search_vetric,
meta_ads_search_vetric,
tik_tok_video_search,
tik_tok_user_search,
tik_tok_user_search_vetric,
tik_tok_video_search_vetric,
blocklist,
apple_app_store,
google_ads_search,
mozilla_addon_search,
reddit_subreddit_search,
asset_check,
twitter_post_search,
medium_tag_rss,
twitter_search,
yahoo_search,
duck_duck_go_search,
bing_search,
guestbook,
certstream,
external,
google_search,
dns_twist,
twitter,
twitter_username_monitor,
urlscan,
urlscan_hostname_search,
youtube_search,
google_play_search,
dexscreener_search,
blocked_ip_scan,
blocked_bilibili_suggested,
grok_post_search,
grok_user_search,
google_lens_image_search,
yandex_search,
linkedin_employee_detection,
linkedin_post_search,
linkedin_company_search,
bing_ads_search,
tik_tok_ads_search,
dnsdb,
daily_motion_search,
watchlist
slug
string

Organization slug. Defaults to the organization your API key is scoped to, so you only need this when authenticating with a key that spans organizations.

Minimum string length: 1
status
enum<string>
default:ENABLED

Status to create the config with. Defaults to ENABLED.

Available options:
ENABLED,
DEPRECATED_EVALUATE,
DISABLED
title
string

Optional label for this config

description
string | null

Optional human-readable description of what the config does

cron
string | null

Optional custom CRON schedule. Only accepted for sources that run on a schedule; the source's default schedule is used when omitted.

config
object

Source-specific configuration, validated against that source's configSchema from GET /detection/sources. When omitted the source's schema defaults are applied.

brandId
integer | null

Optional brand to scope this config to. The brand must belong to the same organization. Omit for an organization-wide config.

Required range: x > 0

Response

Successful response

Created detection config

config
object
required