POST
/api/v1/data-discovery/sourcesConnect a data source
Creates a data_sources row. Body: orgId (uuid, required — it drives the admin-role gate), name (1-200), connector_type (one of the 16 connectors), optional projectId, config, vault_entry_id, classifier_mode (dlp_only | dlp_plus_llm | llm_only, default dlp_only), sample_size_per_object (1-1,000,000, default 10000), scan_schedule, enabled (default true). Credentials are NOT sent here or encrypted here: vault_entry_id is an opaque reference to a separately-stored vault entry, and config is persisted verbatim, so it must carry only non-secret connection knobs. Requires the admin role and compliance:create (mirroring the owner/admin-only data_sources_manage RLS policy, which the service-role client bypasses on API-key auth). Returns 201 with the created row. Audit-logged.
Authentication
Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.
Request body required
Example
{
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"name": "string",
"connector_type": "s3",
"config": {},
"vault_entry_id": "string",
"classifier_mode": "dlp_only",
"sample_size_per_object": 1,
"scan_schedule": "string",
"enabled": false
}Schema
{
"application/json": {
"schema": {
"type": "object",
"properties": {
"orgId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"projectId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"name": {
"type": "string",
"minLength": 1,
"maxLength": 200
},
"connector_type": {
"type": "string",
"enum": [
"s3",
"gcs",
"azure_blob",
"snowflake",
"bigquery",
"redshift",
"postgres",
"mysql",
"mongodb",
"sharepoint",
"gdrive",
"confluence",
"jira",
"slack",
"github",
"http"
]
},
"config": {
"type": "object",
"additionalProperties": {}
},
"vault_entry_id": {
"type": "string",
"maxLength": 200
},
"classifier_mode": {
"type": "string",
"enum": [
"dlp_only",
"dlp_plus_llm",
"llm_only"
]
},
"sample_size_per_object": {
"type": "integer",
"minimum": 1,
"maximum": 1000000
},
"scan_schedule": {
"nullable": true,
"type": "string",
"maxLength": 200
},
"enabled": {
"type": "boolean"
}
},
"required": [
"orgId",
"name",
"connector_type"
],
"additionalProperties": false
}
}
}Response
200 example
{
"success": true
}All status codes
200Source added.
201Created.
400(no description)
401(no description)
403Forbidden — insufficient role for this operation.
429(no description)
500Internal Server Error — DB_ERROR.
Code samples
cURL
curl -X POST \
https://evalguard.ai/api/v1/data-discovery/sources \
-H "Authorization: Bearer $EVALGUARD_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "orgId": "00000000-0000-0000-0000-000000000000", "projectId": "00000000-0000-0000-0000-000000000000", "name": "string", "connector_type": "s3", "config": {}, "vault_entry_id": "string", "classifier_mode": "dlp_only", "sample_size_per_object": 1, "scan_schedule": "string", "enabled": false }'TypeScript
// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
const res = await fetch("https://evalguard.ai/api/v1/data-discovery/sources", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"name": "string",
"connector_type": "s3",
"config": {},
"vault_entry_id": "string",
"classifier_mode": "dlp_only",
"sample_size_per_object": 1,
"scan_schedule": "string",
"enabled": false
}),
});
console.log(res.status, await res.json());Python
# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
import os
import requests
headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
headers["Content-Type"] = "application/json"
response = requests.request(
"POST",
"https://evalguard.ai/api/v1/data-discovery/sources",
headers=headers,
json={
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"name": "string",
"connector_type": "s3",
"config": {},
"vault_entry_id": "string",
"classifier_mode": "dlp_only",
"sample_size_per_object": 1,
"scan_schedule": "string",
"enabled": False
},
)
print(response.status_code, response.json())Go
package main
import (
"context"
"fmt"
"net/http"
"os"
"strings"
)
func main() {
body := strings.NewReader(`{"orgId":"00000000-0000-0000-0000-000000000000","projectId":"00000000-0000-0000-0000-000000000000","name":"string","connector_type":"s3","config":{},"vault_entry_id":"string","classifier_mode":"dlp_only","sample_size_per_object":1,"scan_schedule":"string","enabled":false}`)
req, _ := http.NewRequestWithContext(context.Background(), "POST", "https://evalguard.ai/api/v1/data-discovery/sources", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
fmt.Println(resp.Status)
}Errors
400401403429500