> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an alert source

> Create an alert source and get its token.

```http theme={null}
POST /api/v1/alerts/sources
```

Creates an [alert source](https://docs.molesignal.com/en-US/alerting/sources.md). It requires `alerts.sources.manage`. The `token` in the response appears only this once; use it to call [Send alerts](https://docs.molesignal.com/en-US/api/alerting/send-alerts.md). With federation on, the source syncs to the other clusters.

| Field | Type | Description |
| - | - | - |
| `kind` | string | Required on creation: `api`, `alertmanager`, `grafana`, `datadog`, `pagerduty`, `aliyun_cms`, `tencent_monitor`, `aws_cloudwatch`, `zabbix` or `email`. |
| `name` | string | Required, up to 128 characters. |
| `enabled` | boolean | Default `true`. |
| `escalation_policy_id` | string \| null | An escalation policy ID of the organization, or `default`. Without it, or with `null`, nothing escalates and notify policies alone notify. |
| `severity` | string | Used when an alert carries no severity: `critical`, `error`, `warning` (the default) or `info`. |
| `labels` | object | Up to 32 extra labels. A key is letters, digits and `_ . - : /`, cannot start with `alert.`, and cannot be `external.kind`. |
| `email` | object | How an email source reads a mail: `allowed_senders` (addresses, `@domain` or `*`), `resolve_pattern`, `dedup_pattern` and `ignore_pattern`; see [Email](https://docs.molesignal.com/en-US/alerting/sources.md#email). Left out on an update, it stays as it is. |
| `home_cluster` | string | The federation cluster incidents open on: this cluster or an enabled remote cluster. A new source without it uses this cluster; without federation it has no effect. |

```bash cURL theme={null}
curl -X POST http://localhost:5080/api/v1/alerts/sources \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"kind": "alertmanager", "name": "Production Prometheus", "escalation_policy_id": "default", "labels": {"team": "payments"}}'
```

The response is the source with its `token`. [List alert sources](https://docs.molesignal.com/en-US/api/alerting/list-sources.md) describes the other fields.

```json 200 theme={null}
{
  "id": "3KEJ1mZqf0bY0b8XUgD4tkd2Vwq",
  "name": "Production Prometheus",
  "kind": "alertmanager",
  "enabled": true,
  "escalation_policy_id": "default",
  "severity": "warning",
  "labels": { "team": "payments" },
  "token_prefix": "ms_aB3kZ1xT9pQrU7nM",
  "home_cluster": "",
  "intake_path": "/api/v1/intake/alerts",
  "created_by": "<user-id>",
  "created_at": 1790000000000000,
  "updated_at": 1790000000000000,
  "last_intake_at": null,
  "token": "<token>"
}
```

**Errors**

| Status | Cause |
| - | - |
| `400` | A field is wrong, such as an empty name, an escalation policy that does not exist, or a receiving cluster that is neither this cluster nor an enabled remote cluster. |
| `403` | The token lacks `alerts.sources.manage`. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.