> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add Indicators

> Add one or more indicators to an alert.

Each indicator is upserted globally (idempotent on type+value) and linked
to the alert. If ``enrich=true`` (default), an enrichment task is queued.



## OpenAPI

````yaml POST /v1/alerts/{alert_uuid}/indicators
openapi: 3.1.0
info:
  title: Calseta
  description: SOC data platform for security agent consumption
  version: dev
servers: []
security: []
paths:
  /v1/alerts/{alert_uuid}/indicators:
    post:
      tags:
        - alerts
      summary: Add Indicators
      description: >-
        Add one or more indicators to an alert.


        Each indicator is upserted globally (idempotent on type+value) and
        linked

        to the alert. If ``enrich=true`` (default), an enrichment task is
        queued.
      operationId: add_indicators_v1_alerts__alert_uuid__indicators_post
      parameters:
        - name: alert_uuid
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Alert Uuid
        - name: enrich
          in: query
          required: false
          schema:
            type: boolean
            default: true
            title: Enrich
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IndicatorAddRequest'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataResponse_IndicatorAddResponse_'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    IndicatorAddRequest:
      properties:
        indicators:
          items:
            $ref: '#/components/schemas/IndicatorAddItem'
          type: array
          maxItems: 100
          minItems: 1
          title: Indicators
      type: object
      required:
        - indicators
      title: IndicatorAddRequest
      description: Request body for POST /v1/alerts/{uuid}/indicators.
    DataResponse_IndicatorAddResponse_:
      properties:
        data:
          $ref: '#/components/schemas/IndicatorAddResponse'
        meta:
          additionalProperties: true
          type: object
          title: Meta
      type: object
      required:
        - data
      title: DataResponse[IndicatorAddResponse]
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    IndicatorAddItem:
      properties:
        type:
          $ref: '#/components/schemas/IndicatorType'
        value:
          type: string
          maxLength: 2048
          minLength: 1
          title: Value
      type: object
      required:
        - type
        - value
      title: IndicatorAddItem
      description: Single indicator to add to an alert.
    IndicatorAddResponse:
      properties:
        added_count:
          type: integer
          title: Added Count
        indicators:
          items:
            $ref: '#/components/schemas/IndicatorResponse'
          type: array
          title: Indicators
        enrich_requested:
          type: boolean
          title: Enrich Requested
      type: object
      required:
        - added_count
        - indicators
        - enrich_requested
      title: IndicatorAddResponse
      description: Response for POST /v1/alerts/{uuid}/indicators.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    IndicatorType:
      type: string
      enum:
        - ip
        - domain
        - hash_md5
        - hash_sha1
        - hash_sha256
        - url
        - email
        - account
      title: IndicatorType
      description: Supported indicator-of-compromise (IOC) types.
    IndicatorResponse:
      properties:
        uuid:
          type: string
          title: Uuid
        type:
          $ref: '#/components/schemas/IndicatorType'
        value:
          type: string
          title: Value
        malice:
          type: string
          title: Malice
        malice_source:
          anyOf:
            - type: string
            - type: 'null'
          title: Malice Source
        malice_overridden_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Malice Overridden At
        first_seen:
          type: string
          format: date-time
          title: First Seen
        last_seen:
          type: string
          format: date-time
          title: Last Seen
        is_enriched:
          type: boolean
          title: Is Enriched
        enrichment_results:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Enrichment Results
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - uuid
        - type
        - value
        - malice
        - first_seen
        - last_seen
        - is_enriched
        - created_at
        - updated_at
      title: IndicatorResponse
      description: Indicator as returned by GET /v1/alerts/{uuid}/indicators.

````