# List sources

`GET https://evohub.io/api/v1/catalog/sources`

Part of the [Catalog API](https://docs.evohub.io/catalog.md) reference · operationId `listSources`.

Where the organization's observations come from: one source per
enrolled agent (`agent`) and per cloud account (`cloud`). Sources
are not created or deleted here: an agent's appears when it first
reports and is retired by revoking the agent; a cloud account's comes
and goes with the account.

Requires the `catalog:source:read` scope.

## Authorization

Any one of:

- `bearerKey`
- `headerKey`

Where:

- `bearerKey`: HTTP Bearer — An EvoHub API key (`evohub_…`) as a bearer token.
- `headerKey`: API key in the header `X-API-Key` — An EvoHub API key (`evohub_…`).

## Query parameters

- `environment_id` (string, example `env_2c4e6a8b0d1f3a5c7e9b1d3f5a7c9e0b`): Only this environment.
- `kind` (string, one of `agent`, `cloud`)
- `status` (string, one of `active`, `disabled`, `revoked`)

## Responses

### 200 — The sources.

Content type: `application/json`

Type: `object`

- `data` (array of Source)
  - `id` (string)
  - `org_id` (string)
  - `kind` (string, one of `agent`, `cloud`)
  - `environment_id` (string | null)
  - `agent_id` (string | null)
  - `name` (string)
  - `status` (string, one of `active`, `disabled`, `revoked`)
  - `last_seen_at` (string (date-time) | null)
  - `agent_version` (string): What the agent last said it runs; empty for a cloud account.
  - `created_by` (string)
  - `created_at` (string (date-time))
  - `updated_at` (string (date-time))

### 400 — The request is not valid: a field or filter value is wrong (`VALIDATION_ERROR`, with a sentence saying what), the body is not the expected JSON or carries an unknown field (`INVALID_BODY`), the cursor is not one this list gave (`INVALID_CURSOR`), a binding names a service that does not exist (`UNKNOWN_COMPONENT`), or a `PATCH` tries to change a slug (`SLUG_IMMUTABLE`).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 401 — No API key was sent, or it is unknown, revoked or expired (`UNAUTHORIZED`).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 403 — The key lacks a scope this endpoint needs (`FORBIDDEN`).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 429 — Too many requests (`RATE_LIMITED`). Wait for `Retry-After` seconds.

Headers:

- `Retry-After` (integer): Seconds to wait before retrying.

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 500 — Something went wrong on EvoHub's side (`INTERNAL_ERROR`). Retry later.

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

## Example request

```bash
curl -X GET 'https://evohub.io/api/v1/catalog/sources' \
  -H 'Authorization: Bearer <TOKEN>'
```