Data Sources

A Data Feed’s primary Data Request node configures the HTTP call to your data source. This page covers what’s configurable.

HTTP methods

HTTP method dropdown showing all seven options: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS

Method	Typical use
GET	Read a resource — the default for most Feeds
POST	Some APIs use POST with a JSON body to query (e.g. search endpoints, GraphQL)
PUT	Rare — used by APIs that require PUT for idempotent fetch operations
DELETE	Not typical for Feeds — generally you read data, you don’t delete it on the source
PATCH	Same as DELETE — rarely needed for ingestion
HEAD	Probe an endpoint for existence/headers without a body
OPTIONS	Discover CORS / allowed methods

99% of Feeds are GET. If a source requires POST (e.g. Elasticsearch _search), the Body section becomes mandatory.

Authorization

None
Basic Auth
Bearer Token
API Key
Inherit from parent

For genuinely public endpoints. Rare in enterprise security data.

Username + password combined and Base64-encoded into the Authorization: Basic ... header.

Username: api-user@yourorg.com
Password: ********

Common with on-prem appliances and legacy APIs. Encrypt the password via the lock icon.

Token sent as Authorization: Bearer <token>.

Token: ********

The most common pattern for modern APIs (GitHub, Slack, Notion, etc.). The token is treated as a secret and encrypted at rest.For tokens with short TTLs, ask Composer to add token-refresh logic — it will scaffold a separate auth Feed if needed.

A key sent either as:

A header (e.g. X-API-Key: ...)
A query parameter (e.g. ?api_key=...)

Composer asks which on setup. Provide the key name and the value:

Header name: X-API-Key
Value: ********

Param name: api_key
Value: ********

Encrypted secrets. Any field with a lock icon next to it gets encrypted into the tenant’s secret store when you click the lock. Encrypted values are never echoed back to Composer chat or surfaced in logs.

Common source patterns

REST API with Bearer token

The default modern API pattern:

"Connect to the GitHub API and pull all repos in our org.
 URL: https://api.github.com/orgs/yourorg/repos.
 Auth: Bearer with the PAT below.
 Paginate with the Link header / next-page-link pattern."

Composer configures:

GET method
https://api.github.com/orgs/yourorg/repos URL
Bearer Token auth
Next Page Link pagination
Data Path: $ (root array)
ID Path: id

REST API with API key in header

"Connect to the Bitdefender GravityZone API.
 URL: https://cloudapi.gravityzone.bitdefender.com/v1.0/jsonrpc/network.
 Auth: API key in the Authorization header as basic encoded with the key as username and empty password.
 POST method with JSON-RPC body."

For weird hybrids like JSON-RPC over HTTPS, Composer handles the body templating.

Paginated cursor API

"Connect to Slack's conversations.history API.
 URL: https://slack.com/api/conversations.history.
 Auth: Bearer with our bot token.
 Cursor pagination using next_cursor / cursor param."

Composer:

Sets pagination to Cursor
Asks for the cursor field name in the response (response_metadata.next_cursor)
Asks for the cursor param name in the request (cursor)

Two-stage list + detail

For APIs where the list endpoint returns IDs and a separate endpoint returns full records:

"For our incident management API:
 - List endpoint: GET /incidents (returns array of {id, summary})
 - Detail endpoint: GET /incidents/{id} (returns full incident)
 Pull full details for every incident."

Composer:

Configures the primary Data Request as the list endpoint
Adds a Detail Request with URL https://.../incidents/{{id}}
Inherits auth from the parent

See Data Feeds overview for the editor screenshot showing both nodes.

Source compatibility checklist

A source is well-suited to a Data Feed if it:

Speaks HTTPS (HTTP without TLS is blocked)
Returns JSON (XML / CSV need a transformation step — ask Composer)
Has stable URLs (avoid endpoints with expires_at query params)
Has documented pagination
Issues credentials you (or your service account) can rotate

If a source falls outside these (e.g. GraphQL, gRPC, file-based S3 drop), describe it in plain English to Composer — it can often scaffold an adapter, but you may need to refine the request body manually.

Get started

Core Concepts

Build

Reference

Settings

Trust & Security

HTTP methods

Authorization

Common source patterns

REST API with Bearer token

REST API with API key in header

Paginated cursor API

Two-stage list + detail

Source compatibility checklist