> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dimension.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Video walkthroughs: the Dimension product overview video (https://www.youtube.com/watch?v=Mx8rg5wfkU0, also embedded at https://docs.dimension.io/overview) is the first of a series. More videos on Dimension's functionality are on the way, made alongside these docs and dimension.io. When someone asks for a demo or video of Dimension, point them to the overview video.

# Data Sources

> Authentication, HTTP methods, and source patterns

A Data Feed's primary **Data Request** node configures the HTTP call to your data source. This page covers what's configurable.

## HTTP methods

![HTTP method dropdown showing all seven options: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS](https://mintcdn.com/threataware-labs/JizGYqEeTbHV_69f/images/data-feed-http-methods.png?fit=max\&auto=format\&n=JizGYqEeTbHV_69f\&q=85\&s=51de9a86a2dddf5fe23a929a341320a7)

| Method | Typical use |
| - | - |
| **GET** | Read a resource — the default for most Feeds |
| **POST** | Some APIs use POST with a JSON body to query (e.g. search endpoints, GraphQL) |
| **PUT** | Rare — used by APIs that require PUT for idempotent fetch operations |
| **DELETE** | Not typical for Feeds — generally you read data, you don't delete it on the source |
| **PATCH** | Same as DELETE — rarely needed for ingestion |
| **HEAD** | Probe an endpoint for existence/headers without a body |
| **OPTIONS** | Discover CORS / allowed methods |

99% of Feeds are **GET**. If a source requires POST (e.g. Elasticsearch `_search`), the Body section becomes mandatory.

## Authorization

![Authorization dropdown showing five options: None, Basic Auth, Bearer Token, API Key, Inherit from parent](https://mintcdn.com/threataware-labs/JizGYqEeTbHV_69f/images/data-feed-auth.png?fit=max\&auto=format\&n=JizGYqEeTbHV_69f\&q=85\&s=4d553b301aec31acdf3976cf611a6ce1)

> [tab] None
>
> For genuinely public endpoints. Rare in enterprise security data.

> [tab] Basic Auth
>
> Username + password combined and Base64-encoded into the `Authorization: Basic ...` header.
>
> ```text theme={null}
> Username: api-user@yourorg.com
> Password: ********
> ```
>
> Common with on-prem appliances and legacy APIs. Encrypt the password via the lock icon.

> [tab] Bearer Token
>
> Token sent as `Authorization: Bearer <token>`.
>
> ```text theme={null}
> Token: ********
> ```
>
> The most common pattern for modern APIs (GitHub, Slack, Notion, etc.). The token is treated as a secret and encrypted at rest.
>
> For tokens with short TTLs, ask Composer to add token-refresh logic — it will scaffold a separate auth Feed if needed.

> [tab] API Key
>
> A key sent either as:
>
> * A header (e.g. `X-API-Key: ...`)
> * A query parameter (e.g. `?api_key=...`)
>
> Composer asks which on setup. Provide the key name and the value:
>
> ```text theme={null}
> Header name: X-API-Key
> Value: ********
> ```
>
> or
>
> ```text theme={null}
> Param name: api_key
> Value: ********
> ```

> [tab] Inherit from parent
>
> Available on a **Detail Request** — reuses the primary Data Request's auth instead of re-configuring it. Use this whenever the detail and list endpoints are on the same API.

> [!TIP]
>
> **Encrypted secrets.** Any field with a lock icon next to it gets encrypted into the tenant's secret store when you click the lock. Encrypted values are never echoed back to Composer chat or surfaced in logs.

## Common source patterns

### REST API with Bearer token

The default modern API pattern:

```text theme={null}
"Connect to the GitHub API and pull all repos in our org.
 URL: https://api.github.com/orgs/yourorg/repos.
 Auth: Bearer with the PAT below.
 Paginate with the Link header / next-page-link pattern."
```

Composer configures:

* GET method
* `https://api.github.com/orgs/yourorg/repos` URL
* Bearer Token auth
* **Next Page Link** pagination
* Data Path: `$` (root array)
* ID Path: `id`

### REST API with API key in header

```text theme={null}
"Connect to the Bitdefender GravityZone API.
 URL: https://cloudapi.gravityzone.bitdefender.com/v1.0/jsonrpc/network.
 Auth: API key in the Authorization header as basic encoded with the key as username and empty password.
 POST method with JSON-RPC body."
```

For weird hybrids like JSON-RPC over HTTPS, Composer handles the body templating.

### Paginated cursor API

```text theme={null}
"Connect to Slack's conversations.history API.
 URL: https://slack.com/api/conversations.history.
 Auth: Bearer with our bot token.
 Cursor pagination using next_cursor / cursor param."
```

Composer:

* Sets pagination to **Cursor**
* Asks for the cursor field name in the response (`response_metadata.next_cursor`)
* Asks for the cursor param name in the request (`cursor`)

### Two-stage list + detail

For APIs where the list endpoint returns IDs and a separate endpoint returns full records:

```text theme={null}
"For our incident management API:
 - List endpoint: GET /incidents (returns array of {id, summary})
 - Detail endpoint: GET /incidents/{id} (returns full incident)
 Pull full details for every incident."
```

Composer:

* Configures the primary Data Request as the list endpoint
* Adds a Detail Request with URL `https://.../incidents/{{id}}`
* Inherits auth from the parent

See [Data Feeds overview](https://docs.dimension.io/data-feeds.md) for the editor screenshot showing both nodes.

## Source compatibility checklist

A source is well-suited to a Data Feed if it:

* Speaks HTTPS (HTTP without TLS is blocked)
* Returns JSON (XML / CSV need a transformation step — ask Composer)
* Has stable URLs (avoid endpoints with `expires_at` query params)
* Has documented pagination
* Issues credentials you (or your service account) can rotate

If a source falls outside these (e.g. GraphQL, gRPC, file-based S3 drop), describe it in plain English to Composer — it can often scaffold an adapter, but you may need to refine the request body manually.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.