> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom Source

> Send events from any system that can POST JSON, then map its fields to a Pulse Signal by clicking the payload it really sent.

Custom source is the DRE integration for a system that has no card of its own: an in-house uptime checker, a cron job, a script, or a vendor CloudThinker does not list yet. If it can send an HTTP POST with a JSON body, it can raise a Signal.

<Note>
  A Custom source is not the workspace webhook under **Settings → Integrations → Webhooks**. That one starts a conversation. A Custom source enters Pulse, so its events can be suppressed, clustered, and routed into an Incident.
</Note>

## Add a Custom source

Open **DRE → Integrations** and select the **Custom source** card. One card holds every custom source you create.

<Steps>
  <Step title="Name the source">
    Type the name your team will recognize, for example `Acme uptime`. CloudThinker creates the endpoint and shows its URL.
  </Step>

  <Step title="Send one real event">
    Copy the URL into your system and let it fire once. The page waits for the first delivery, then shows the JSON it received.

    Send a representative event, not an empty test body. The fields you can map are the fields this event contained.
  </Step>

  <Step title="Map the fields">
    Every field in the captured JSON is listed with its value. Pick the one that carries the incident title, then the ones for severity, service, resource, and description. Save.
  </Step>
</Steps>

The source is live after you save. The next event arrives in Pulse as a Signal with a real title.

## What the mapping accepts

A mapped field is a dotted path into your JSON. `event.data.title` reads `title` inside `data` inside `event`. A list index is `[0]`, as in `alerts[0].labels.severity`.

There is no `$.` prefix. Paths that begin with `$.` are JSONPath and CloudThinker does not read them.

You do not type these paths. You click them in the captured payload, so a mapping you can save is a mapping that resolves.

| Field       | Required | What it does                                                      |
| ----------- | -------- | ----------------------------------------------------------------- |
| Title       | Yes      | Names the Signal and the Incident.                                |
| Severity    | No       | Feeds routing and the automatic RCA threshold.                    |
| Service     | No       | Helps Pulse correlate related events and scope snoozes.           |
| Resource    | No       | Identifies the affected host, cluster, or component.              |
| Description | No       | Gives operators and agents the symptom in the source's own words. |

Only **Title** is required. Map the rest when your payload carries them.

A path holds at most eight segments. If your payload nests the value deeper than that, send a flatter body.

## Authenticate the endpoint

A Custom source uses bearer authentication. Send the token in the `Authorization` header:

```bash theme={null}
curl -X POST "<your-custom-source-url>" \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  -d '{"event": {"data": {"title": "Checkout latency high", "priority": "critical"}}}'
```

## Verify the complete path

A `200` response proves delivery only. Open Pulse and confirm the Signal, its title, and its severity. If automatic RCA is enabled and the severity clears the threshold, confirm that the Incident enters **AI is handling**.

<Warning>
  An event that arrives before you save a mapping still becomes a Signal. CloudThinker falls back to a `title` key in the payload, and then to `Webhook signal`. Nothing is dropped, but the Signal is harder to read. Map first.
</Warning>

## Change the mapping later

Open the Custom source card, select the source under **Signals**, and edit its webhook. Incident settings, including automatic RCA and its minimum severity, live there too. A new source uses the same defaults as every other DRE webhook.

<Warning>
  The payload shown in the picker is the last event CloudThinker stored. Stored bodies are removed after the retention period, so a source that has not fired recently has nothing to map. Fire it once more, then map.
</Warning>

## Related

<CardGroup cols={2}>
  <Card title="Webhook Signals" icon="webhook" href="/guide/incident/webhook-integrations/overview">
    Map events from a platform CloudThinker already supports.
  </Card>

  <Card title="Connect CloudWatch" icon="aws" href="/guide/incident/webhook-integrations/cloudwatch">
    Send CloudWatch alarm events through EventBridge.
  </Card>

  <Card title="Understand Pulse" icon="pulse" href="/guide/pulse/overview">
    Follow Signals through suppression, correlation, and routing.
  </Card>

  <Card title="Manage integrations" icon="arrows-rotate" href="/guide/incident/integrations">
    Review each platform's connections, Signals, and outcomes.
  </Card>
</CardGroup>