> ## Documentation Index
> Fetch the complete documentation index at: https://chainpatrol.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Detection Config

> Create a config that makes a detection source run for an organization. Sources that are disabled by default have no config, so they cannot be enabled through /detection/configs/update until one is created. A source can have several configs, each with its own query, schedule or brand.

## Overview

Create a new threat detection config so a source starts scanning for your
organization. Sources that are disabled by default have no config row, so they
cannot be enabled through [Update Detection Config](/docs/external-api/detection-configs-update)
until you create one here.

A single source can have several configs, each with its own query, schedule, or
brand. Use `title` and `description` to tell them apart.

## When to use

* Turn on a source that is disabled by default for your organization.
* Add another config to a source you already run (for example, a second query
  or a brand-scoped variant).
* Provision a source-specific `config` payload programmatically.

For an existing config, use [Update Detection Config](/docs/external-api/detection-configs-update)
instead.

## How it works

* `source` must be a key returned by [List Detection Sources](/docs/external-api/detection-sources-list).
  Global-only sources and sources with no implementation are rejected.
* `cron` is only accepted for scheduled (pull-based) sources. Omit it to use
  the source's default schedule.
* `config` is validated against the source's `configSchema` from
  [List Detection Sources](/docs/external-api/detection-sources-list). An empty
  object `{}` is allowed; schema defaults are applied at scan time.
* `brandId`, when passed, must belong to your organization. Omit for an
  organization-wide config.
* The config and an initial history row are written in one transaction so
  default-sync jobs don't disable it.


## OpenAPI

````yaml POST /detection/configs/create
openapi: 3.0.3
info:
  title: ChainPatrol External API - OpenAPI 3.0
  description: ChainPatrol External API documentation
  version: 2.0.0
servers:
  - url: https://app.chainpatrol.io/api/v2
security: []
tags:
  - name: asset
  - name: report
externalDocs:
  url: https://chainpatrol.com/docs
paths:
  /detection/configs/create:
    post:
      tags:
        - detection
      summary: Create threat detection config
      description: >-
        Create a config that makes a detection source run for an organization.
        Sources that are disabled by default have no config, so they cannot be
        enabled through /detection/configs/update until one is created. A source
        can have several configs, each with its own query, schedule or brand.
      operationId: detectionConfigsCreate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                slug:
                  type: string
                  minLength: 1
                  description: >-
                    Organization slug. Defaults to the organization your API key
                    is scoped to, so you only need this when authenticating with
                    a key that spans organizations.
                source:
                  type: string
                  enum:
                    - meta_ads_search
                    - telegram_channels_search
                    - telegram_user_search
                    - telegram_channels_search_vetric
                    - telegram_user_search_vetric
                    - facebook_page_search_vetric
                    - instagram_account_search_vetric
                    - twitter_search_vetric
                    - linkedin_people_search_vetric
                    - linkedin_company_search_vetric
                    - meta_ads_search_vetric
                    - tik_tok_video_search
                    - tik_tok_user_search
                    - tik_tok_user_search_vetric
                    - tik_tok_video_search_vetric
                    - blocklist
                    - apple_app_store
                    - google_ads_search
                    - mozilla_addon_search
                    - reddit_subreddit_search
                    - asset_check
                    - twitter_post_search
                    - medium_tag_rss
                    - twitter_search
                    - yahoo_search
                    - duck_duck_go_search
                    - bing_search
                    - guestbook
                    - certstream
                    - external
                    - google_search
                    - dns_twist
                    - twitter
                    - twitter_username_monitor
                    - urlscan
                    - urlscan_hostname_search
                    - youtube_search
                    - google_play_search
                    - dexscreener_search
                    - blocked_ip_scan
                    - blocked_bilibili_suggested
                    - grok_post_search
                    - grok_user_search
                    - google_lens_image_search
                    - yandex_search
                    - linkedin_employee_detection
                    - linkedin_post_search
                    - linkedin_company_search
                    - bing_ads_search
                    - tik_tok_ads_search
                    - dnsdb
                    - daily_motion_search
                    - watchlist
                  description: >-
                    Detection source key, from `GET /detection/sources`. The
                    source must support the `organization` scope; global-only
                    sources cannot be configured per organization.
                status:
                  type: string
                  enum:
                    - ENABLED
                    - DEPRECATED_EVALUATE
                    - DISABLED
                  default: ENABLED
                  description: Status to create the config with. Defaults to `ENABLED`.
                title:
                  type: string
                  description: Optional label for this config
                description:
                  type: string
                  nullable: true
                  description: Optional human-readable description of what the config does
                cron:
                  type: string
                  nullable: true
                  description: >-
                    Optional custom CRON schedule. Only accepted for sources
                    that run on a schedule; the source's default schedule is
                    used when omitted.
                config:
                  type: object
                  additionalProperties: {}
                  description: >-
                    Source-specific configuration, validated against that
                    source's `configSchema` from `GET /detection/sources`. When
                    omitted the source's schema defaults are applied.
                brandId:
                  type: integer
                  nullable: true
                  minimum: 0
                  exclusiveMinimum: true
                  description: >-
                    Optional brand to scope this config to. The brand must
                    belong to the same organization. Omit for an
                    organization-wide config.
              required:
                - source
              description: >-
                Create a threat detection config


                Creates the config row that makes a detection source run for
                your organization. Sources that are disabled by default have no
                config row, so they cannot be enabled through
                `/detection/configs/update` until one exists.


                A source can have several configs, each scanning with its own
                query, schedule or brand. Use `title` to tell them apart.
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  config:
                    type: object
                    properties:
                      id:
                        type: number
                      source:
                        type: string
                      status:
                        type: string
                        enum:
                          - ENABLED
                          - DEPRECATED_EVALUATE
                          - DISABLED
                      title:
                        type: string
                      description:
                        type: string
                        nullable: true
                      cron:
                        type: string
                        nullable: true
                      config:
                        type: object
                        additionalProperties: {}
                      updatedAt:
                        type: string
                      brandId:
                        type: number
                        nullable: true
                    required:
                      - id
                      - source
                      - status
                      - title
                      - description
                      - cron
                      - config
                      - updatedAt
                      - brandId
                required:
                  - config
                description: Created detection config
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error.BAD_REQUEST'
        '401':
          description: Authorization not provided
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error.UNAUTHORIZED'
        '403':
          description: Insufficient access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error.FORBIDDEN'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/error.INTERNAL_SERVER_ERROR'
      security:
        - ApiKey: []
components:
  schemas:
    error.BAD_REQUEST:
      type: object
      properties:
        message:
          type: string
          description: The error message
          example: Invalid input data
        code:
          type: string
          description: The error code
          example: BAD_REQUEST
        issues:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
            required:
              - message
          description: An array of issues that were responsible for the error
          example: []
      required:
        - message
        - code
      title: Invalid input data error (400)
      description: The error information
      example:
        code: BAD_REQUEST
        message: Invalid input data
        issues: []
    error.UNAUTHORIZED:
      type: object
      properties:
        message:
          type: string
          description: The error message
          example: Authorization not provided
        code:
          type: string
          description: The error code
          example: UNAUTHORIZED
        issues:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
            required:
              - message
          description: An array of issues that were responsible for the error
          example: []
      required:
        - message
        - code
      title: Authorization not provided error (401)
      description: The error information
      example:
        code: UNAUTHORIZED
        message: Authorization not provided
        issues: []
    error.FORBIDDEN:
      type: object
      properties:
        message:
          type: string
          description: The error message
          example: Insufficient access
        code:
          type: string
          description: The error code
          example: FORBIDDEN
        issues:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
            required:
              - message
          description: An array of issues that were responsible for the error
          example: []
      required:
        - message
        - code
      title: Insufficient access error (403)
      description: The error information
      example:
        code: FORBIDDEN
        message: Insufficient access
        issues: []
    error.INTERNAL_SERVER_ERROR:
      type: object
      properties:
        message:
          type: string
          description: The error message
          example: Internal server error
        code:
          type: string
          description: The error code
          example: INTERNAL_SERVER_ERROR
        issues:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
            required:
              - message
          description: An array of issues that were responsible for the error
          example: []
      required:
        - message
        - code
      title: Internal server error error (500)
      description: The error information
      example:
        code: INTERNAL_SERVER_ERROR
        message: Internal server error
        issues: []
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: X-API-KEY
      description: >-
        Your API key. This is required by most endpoints to access our API
        programatically. Reach out to us at
        [support@chainpatrol.io](mailto:support@chainpatrol.io?subject=Re:%20API%20Key%20for%20SDK&body=Company:%20%0AName:%20%0APurpose:%20)
        to get an API key for your use.

````