Sources

A source is a stream of records that the rules engine can read. There are two kinds:

Input modes

Every custom source has an input_mode that decides how data gets in.

Official sources show input_mode: "NONE".

Schema

schema_fields describes the entries a source accepts. It is an array of fields:

Validation rules for each entry:

• It must be a JSON object, at most 64 KB once serialized.
• Every declared field is required and must be non-null and of the declared type. There is no coercion: "12" is not a number.
• datetime accepts RFC 3339 (2026-09-24T14:00:00Z), 2026-09-24 14:00:00, 2026-09-24T14:00:00 or 2026-09-24.
• Extra fields are accepted and stored, so producers can add fields without breaking ingestion.
• An empty schema ([]) accepts any object.

Create a source

POST /v1/sources/ with a name (1 to 100 characters) and a slug. The slug is lowercased, must be 1 to 50 characters of a-z, 0-9, - or _, is unique in your workspace, and cannot be changed later.

curl -X POST "https://monitoring.seqlense.com/api/v1/sources/" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CRM customers",
    "slug": "crm-customers",
    "description": "Customer records pushed from our CRM",
    "input_mode": "API_PUSH",
    "schema_fields": [
      { "name": "customer_id", "type": "string", "label": "Customer ID" },
      { "name": "balance", "type": "number", "label": "Balance" },
      { "name": "updated_at", "type": "datetime", "label": "Updated at" }
    ]
  }'

{ "id": "7c9e6679-7425-40de-944b-e07fc1f90ae7" }

A slug that already exists returns 400 with Source creation failed (slug may already exist).

Push entries (API_PUSH)

POST /v1/sources/ingest with the source_id and an entries array of 1 to 1000 objects. Valid entries are stored, invalid ones are skipped and listed in errors with their index.

curl -X POST "https://monitoring.seqlense.com/api/v1/sources/ingest" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "entries": [
      { "customer_id": "C-1042", "balance": 1520.5, "updated_at": "2026-09-24T14:00:00Z" },
      { "customer_id": "C-1043", "updated_at": "2026-09-24T14:00:00Z" }
    ]
  }'

{ "inserted": 1, "rejected": 1, "errors": ["#1: missing field 'balance'"] }

If every entry fails, the call returns 400 with All N entries failed validation. First error: .... The call also returns 400 when the source is not one of your custom sources (Source not found or not accessible), is disabled (Source is disabled), or is not in API_PUSH mode.

Upload a file (FILE_UPLOAD)

POST /v1/sources/upload works like ingest, for sources in FILE_UPLOAD mode. The endpoint takes JSON, not a multipart file: parse your CSV or JSON file client-side and send its rows as data, 1 to 5000 objects per call (same 2 MB body limit).

curl -X POST "https://monitoring.seqlense.com/api/v1/sources/upload" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source_id": "9a1b2c3d-4e5f-4a6b-8c7d-0e1f2a3b4c5d",
    "data": [
      { "customer_id": "C-2001", "balance": 10, "updated_at": "2026-09-20" },
      { "customer_id": "C-2002", "balance": 250.75, "updated_at": "2026-09-21" }
    ]
  }'

{ "inserted": 2, "rejected": 0, "errors": [] }

Pull from your API (API_PULL)

With input_mode: "API_PULL", Seqlense calls your endpoint on a schedule. These fields are only used in this mode (in the other modes they are ignored and cleared):

pull_url must point to a public host. These are rejected with pull_url must point to a public host (private/loopback addresses are not allowed):

• localhost and loopback addresses (127.0.0.0/8, ::1)
• private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• link-local 169.254.0.0/16 and fe80::/10, unique-local fc00::/7
• 0.0.0.0/8, and multicast or reserved addresses (224.0.0.0 and above)

curl -X POST "https://monitoring.seqlense.com/api/v1/sources/" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Partner risk feed",
    "slug": "partner-risk",
    "input_mode": "API_PULL",
    "pull_url": "https://api.partner.example/v2/risk",
    "pull_method": "GET",
    "pull_headers": { "Authorization": "Bearer partner-token" },
    "pull_interval_minutes": 30,
    "response_mapping": {
      "items_path": "data.items",
      "fields": { "address": "wallet.address", "score": "risk.score" }
    },
    "schema_fields": [
      { "name": "address", "type": "string", "label": "Address" },
      { "name": "score", "type": "number", "label": "Score" }
    ]
  }'

List and read

GET /v1/sources/ returns all sources visible to your workspace (official and custom, no pagination). GET /v1/sources/detail?id=... adds the pull settings, entry_count and updated_at. An unknown id, or a custom source of another organization, returns 404.

curl -H "Authorization: Bearer YOUR_API_KEY" \
    "https://monitoring.seqlense.com/api/v1/sources/detail?id=7c9e6679-7425-40de-944b-e07fc1f90ae7"

Entries

GET /v1/sources/entries?source_id=...&page=1 returns the stored entries, newest first, 50 per page (fixed). It works for official sources too.

{
  "source_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "source_name": "CRM customers",
  "entries": [
    {
      "id": "0b8f3c52-8d7e-4a55-9f0e-5a3c1d2e4f60",
      "data": { "customer_id": "C-1042", "balance": 1520.5, "updated_at": "2026-09-24T14:00:00Z" },
      "ingested_at": "2026-09-24 14:00:03.512"
    }
  ],
  "total": 1,
  "page": 1,
  "pages": 1
}

Update

PUT /v1/sources/ is a full replace: send the id, the name and the complete configuration. Any field you leave out goes back to its default (description empty, icon database, input_mode API_PUSH, schema_fields [], is_active true, pull settings cleared). Set is_active to false to disable a source: ingest and upload are then refused.

curl -X PUT "https://monitoring.seqlense.com/api/v1/sources/" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "name": "CRM customers",
    "input_mode": "API_PUSH",
    "is_active": false,
    "schema_fields": [
      { "name": "customer_id", "type": "string", "label": "Customer ID" }
    ]
  }'

{ "ok": true }

Delete

DELETE /v1/sources/?id=... deletes a custom source and all of its entries. This is permanent. Official sources cannot be deleted.

Next steps

See the API Reference for every field, limit and error message of the Sources endpoints.