Socket alerts API
The alerts API from Socket — 6 operation(s) for alerts.
Documentation
Documentation
https://docs.socket.dev/docs/getting-started
APIReference
https://docs.socket.dev/reference/authentication
OpenAPI Specification
openapi: 3.0.0
info:
description: Specification of the Socket API endpoints
title: API Endpoints alerts API
version: '0'
servers:
- url: https://api.socket.dev/v0
tags:
- name: alerts
paths:
/orgs/{org_slug}/alerts/resolutions:
get:
tags:
- alerts
summary: List Org Alert Resolutions
operationId: getOrgAlertResolutions
parameters:
- name: org_slug
in: path
required: true
description: The slug of the organization
schema:
type: string
- name: direction
in: query
required: false
description: 'Sort direction by `created_at`. One of: asc, desc.'
schema:
type: string
default: desc
- name: per_page
in: query
required: false
description: Number of results per page (1–100, default 30).
schema:
type: integer
minimum: 1
maximum: 100
default: 30
- name: startAfterCursor
in: query
required: false
description: Opaque cursor returned by the previous response's `endCursor`. Omit on the first request.
schema:
type: string
default: ''
security:
- bearerAuth:
- alert-resolution:list
- basicAuth:
- alert-resolution:list
description: 'List active alert resolutions for an organization. Results are paginated via an opaque cursor and ordered by created_at. Each row includes the anchor fields (alert_type, repo, repo_label, artifact_*) that describe the resolution scope.
This endpoint consumes 1 unit of your quota.
This endpoint requires the following org token scopes:
- alert-resolution:list'
responses:
'200':
content:
application/json:
schema:
type: object
additionalProperties: false
description: ''
properties:
items:
type: array
items:
type: object
additionalProperties: false
description: ''
properties:
uuid:
type: string
description: The UUID of the resolution.
default: ''
reason:
type: string
enum:
- false_positive
- remediated
- tolerable_risk
- other
description: 'The reason the alert was resolved. One of: false_positive, remediated, tolerable_risk, other.'
default: other
reason_text:
type: string
description: Free-form reason text when `reason` is `other`.
default: ''
nullable: true
comment:
type: string
description: Operator-provided comment.
default: ''
nullable: true
alert_type:
type: string
description: Alert type the resolution scopes to (e.g. criticalCVE). Null if the resolution applies to multiple alert types.
default: ''
nullable: true
repo:
type: string
description: Repository full name the resolution scopes to. Null if not scoped to a single repo.
default: ''
nullable: true
repo_label:
type: string
description: Repository label the resolution scopes to. Null if not scoped to a label.
default: ''
nullable: true
artifact_type:
type: string
description: Package ecosystem the resolution scopes to (e.g. npm, pypi). Null if not scoped to a single ecosystem.
default: ''
nullable: true
artifact_namespace:
type: string
description: Package namespace/scope the resolution scopes to. Null if not scoped to a namespace.
default: ''
nullable: true
artifact_name:
type: string
description: Package name the resolution scopes to. Null if not scoped to a single package.
default: ''
nullable: true
artifact_version:
type: string
description: Package version the resolution scopes to. Extracted from the resolution selector at read time; null if the resolution applies to multiple versions or no single version.
default: ''
nullable: true
resolved_by:
type: string
description: User ID that created the resolution. Null for system-created resolutions.
default: ''
nullable: true
created_at:
type: string
description: ISO-8601 creation timestamp.
default: ''
updated_at:
type: string
description: ISO-8601 last-update timestamp.
default: ''
required:
- alert_type
- artifact_name
- artifact_namespace
- artifact_type
- artifact_version
- comment
- created_at
- reason
- reason_text
- repo
- repo_label
- resolved_by
- updated_at
- uuid
description: ''
endCursor:
type: string
description: ''
default: ''
nullable: true
required:
- endCursor
- items
description: Lists alert resolutions for the specified organization.
'400':
$ref: '#/components/responses/SocketBadRequest'
'401':
$ref: '#/components/responses/SocketUnauthorized'
'403':
$ref: '#/components/responses/SocketForbidden'
'404':
$ref: '#/components/responses/SocketNotFoundResponse'
'429':
$ref: '#/components/responses/SocketTooManyRequestsResponse'
x-readme: {}
/orgs/{org_slug}/alerts/resolutions/{uuid}:
get:
tags:
- alerts
summary: Get Org Alert Resolution
operationId: getOrgAlertResolution
parameters:
- name: org_slug
in: path
required: true
description: The slug of the organization
schema:
type: string
- name: uuid
in: path
required: true
description: The UUID of the alert resolution to fetch
schema:
type: string
security:
- bearerAuth:
- alert-resolution:read
- basicAuth:
- alert-resolution:read
description: 'Fetch a single active alert resolution by UUID. Returns the same row shape as the list endpoint.
This endpoint consumes 1 unit of your quota.
This endpoint requires the following org token scopes:
- alert-resolution:read'
responses:
'200':
content:
application/json:
schema:
type: object
additionalProperties: false
description: ''
properties:
uuid:
type: string
description: The UUID of the resolution.
default: ''
reason:
type: string
enum:
- false_positive
- remediated
- tolerable_risk
- other
description: 'The reason the alert was resolved. One of: false_positive, remediated, tolerable_risk, other.'
default: other
reason_text:
type: string
description: Free-form reason text when `reason` is `other`.
default: ''
nullable: true
comment:
type: string
description: Operator-provided comment.
default: ''
nullable: true
alert_type:
type: string
description: Alert type the resolution scopes to (e.g. criticalCVE). Null if the resolution applies to multiple alert types.
default: ''
nullable: true
repo:
type: string
description: Repository full name the resolution scopes to. Null if not scoped to a single repo.
default: ''
nullable: true
repo_label:
type: string
description: Repository label the resolution scopes to. Null if not scoped to a label.
default: ''
nullable: true
artifact_type:
type: string
description: Package ecosystem the resolution scopes to (e.g. npm, pypi). Null if not scoped to a single ecosystem.
default: ''
nullable: true
artifact_namespace:
type: string
description: Package namespace/scope the resolution scopes to. Null if not scoped to a namespace.
default: ''
nullable: true
artifact_name:
type: string
description: Package name the resolution scopes to. Null if not scoped to a single package.
default: ''
nullable: true
artifact_version:
type: string
description: Package version the resolution scopes to. Extracted from the resolution selector at read time; null if the resolution applies to multiple versions or no single version.
default: ''
nullable: true
resolved_by:
type: string
description: User ID that created the resolution. Null for system-created resolutions.
default: ''
nullable: true
created_at:
type: string
description: ISO-8601 creation timestamp.
default: ''
updated_at:
type: string
description: ISO-8601 last-update timestamp.
default: ''
required:
- alert_type
- artifact_name
- artifact_namespace
- artifact_type
- artifact_version
- comment
- created_at
- reason
- reason_text
- repo
- repo_label
- resolved_by
- updated_at
- uuid
description: The requested alert resolution.
'400':
$ref: '#/components/responses/SocketBadRequest'
'401':
$ref: '#/components/responses/SocketUnauthorized'
'403':
$ref: '#/components/responses/SocketForbidden'
'404':
$ref: '#/components/responses/SocketNotFoundResponse'
'429':
$ref: '#/components/responses/SocketTooManyRequestsResponse'
x-readme: {}
delete:
tags:
- alerts
summary: Delete Org Alert Resolution
operationId: deleteOrgAlertResolution
parameters:
- name: org_slug
in: path
required: true
description: The slug of the organization
schema:
type: string
- name: uuid
in: path
required: true
description: The UUID of the alert resolution to delete
schema:
type: string
security:
- bearerAuth:
- alert-resolution:delete
- basicAuth:
- alert-resolution:delete
description: 'Delete an alert resolution by UUID. Once deleted, alerts previously hidden by this resolution will reappear after the next org snapshot.
This endpoint consumes 1 unit of your quota.
This endpoint requires the following org token scopes:
- alert-resolution:delete'
responses:
'200':
content:
application/json:
schema:
type: object
additionalProperties: false
description: ''
properties:
result:
type: string
description: ''
default: ''
required:
- result
description: Deleted Alert Resolution
'400':
$ref: '#/components/responses/SocketBadRequest'
'401':
$ref: '#/components/responses/SocketUnauthorized'
'403':
$ref: '#/components/responses/SocketForbidden'
'404':
$ref: '#/components/responses/SocketNotFoundResponse'
'429':
$ref: '#/components/responses/SocketTooManyRequestsResponse'
x-readme: {}
/orgs/{org_slug}/historical/alerts:
get:
tags:
- alerts
summary: List historical alerts (Beta)
operationId: historicalAlertsList
parameters:
- name: org_slug
in: path
required: true
description: The slug of the organization
schema:
type: string
- name: date
in: query
required: false
description: The UTC date in YYYY-MM-DD format for which to fetch alerts
schema:
type: string
default: CURRENT_DATE
- name: range
in: query
required: false
description: The number of days of data to fetch as an offset from input date (e.g. "-7d" or "7d") or use "latest" to query for latest alerts for each repo
schema:
type: string
default: -7d
- name: per_page
in: query
required: false
description: Specify the maximum number of results to return per page (intermediate pages may have fewer than this limit and callers should always check "endCursor" in response body to know if there are more pages)
schema:
type: integer
minimum: 1
maximum: 10000
default: 10000
- name: startAfterCursor
in: query
required: false
description: The pagination cursor that was returned as the "endCursor" property in previous request
schema:
type: string
default: ''
- name: filters.alertAction
in: query
required: false
description: Comma-separated list of alert actions ("error", "warn", "monitor", or "ignore) that should be included
schema:
type: string
- name: filters.alertAction.notIn
in: query
required: false
description: Comma-separated list of alert actions ("error", "warn", "monitor", or "ignore) that should be excluded
schema:
type: string
- name: filters.alertActionSourceType
in: query
required: false
description: Comma-separated list of alert action source types ("resolution", "alert-policy", "fallback", "injected-alert", "org-policy", "reachability", "repo-label-policy", "socket-yml", or "triage") that should be included
schema:
type: string
- name: filters.alertActionSourceType.notIn
in: query
required: false
description: Comma-separated list of alert action source types ("resolution", "alert-policy", "fallback", "injected-alert", "org-policy", "reachability", "repo-label-policy", "socket-yml", or "triage") that should be excluded
schema:
type: string
- name: filters.alertCategory
in: query
required: false
description: Comma-separated list of alert categories ("supplyChainRisk", "maintenance", "quality", "license", or "vulnerability") that should be included
schema:
type: string
- name: filters.alertCategory.notIn
in: query
required: false
description: Comma-separated list of alert categories ("supplyChainRisk", "maintenance", "quality", "license", or "vulnerability") that should be excluded
schema:
type: string
- name: filters.alertCveId
in: query
required: false
description: CVE ID
schema:
type: string
- name: filters.alertCveId.notIn
in: query
required: false
description: CVE ID
schema:
type: string
- name: filters.alertCveTitle
in: query
required: false
description: CVE title
schema:
type: string
- name: filters.alertCveTitle.notIn
in: query
required: false
description: CVE title
schema:
type: string
- name: filters.alertCweId
in: query
required: false
description: CWE ID
schema:
type: string
- name: filters.alertCweId.notIn
in: query
required: false
description: CWE ID
schema:
type: string
- name: filters.alertCweName
in: query
required: false
description: CWE name
schema:
type: string
- name: filters.alertCweName.notIn
in: query
required: false
description: CWE name
schema:
type: string
- name: filters.alertEPSS
in: query
required: false
description: Alert EPSS ("low", "medium", "high", "critical")
schema:
type: string
- name: filters.alertEPSS.notIn
in: query
required: false
description: Alert EPSS ("low", "medium", "high", "critical")
schema:
type: string
- name: filters.alertFixType
in: query
required: false
description: Comma-separated list of alert fix types ("upgrade", "cve", or "remove") that should be included
schema:
type: string
- name: filters.alertFixType.notIn
in: query
required: false
description: Comma-separated list of alert fix types ("upgrade", "cve", or "remove") that should be excluded
schema:
type: string
- name: filters.alertKEV
in: query
required: false
description: Alert KEV (Known Exploited Vulnerability) filter flag
schema:
type: boolean
default: false
- name: filters.alertKEV.notIn
in: query
required: false
description: Alert KEV (Known Exploited Vulnerability) filter flag
schema:
type: boolean
default: false
- name: filters.alertPriority
in: query
required: false
description: Alert priority ("low", "medium", "high", or "critical")
schema:
type: string
- name: filters.alertPriority.notIn
in: query
required: false
description: Alert priority ("low", "medium", "high", or "critical")
schema:
type: string
- name: filters.alertReachabilityAnalysisType
in: query
required: false
description: Comma-separated list of alert CVE reachability analysis types ("full-scan" or "precomputed") that should be included
schema:
type: string
- name: filters.alertReachabilityAnalysisType.notIn
in: query
required: false
description: Comma-separated list of alert CVE reachability analysis types ("full-scan" or "precomputed") that should be excluded
schema:
type: string
- name: filters.alertReachabilityType
in: query
required: false
description: Comma-separated list of alert CVE reachability types ("direct_dependency", "error", "maybe_reachable", "missing_support", "pending", "reachable", "undeterminable_reachability", "unknown", or "unreachable") that should be included
schema:
type: string
- name: filters.alertReachabilityType.notIn
in: query
required: false
description: Comma-separated list of alert CVE reachability types ("direct_dependency", "error", "maybe_reachable", "missing_support", "pending", "reachable", "undeterminable_reachability", "unknown", or "unreachable") that should be excluded
schema:
type: string
- name: filters.alertSeverity
in: query
required: false
description: Comma-separated list of alert severities ("low", "medium", "high", or "critical") that should be included
schema:
type: string
- name: filters.alertSeverity.notIn
in: query
required: false
description: Comma-separated list of alert severities ("low", "medium", "high", or "critical") that should be excluded
schema:
type: string
- name: filters.alertType
in: query
required: false
description: Comma-separated list of alert types (e.g. "usesEval", "unmaintained", etc.) that should be included
schema:
type: string
- name: filters.alertType.notIn
in: query
required: false
description: Comma-separated list of alert types (e.g. "usesEval", "unmaintained", etc.) that should be excluded
schema:
type: string
- name: filters.artifactName
in: query
required: false
description: Name of artifact
schema:
type: string
- name: filters.artifactName.notIn
in: query
required: false
description: Name of artifact
schema:
type: string
- name: filters.artifactType
in: query
required: false
description: Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be included
schema:
type: string
- name: filters.artifactType.notIn
in: query
required: false
description: Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be excluded
schema:
type: string
- name: filters.branch
in: query
required: false
description: Comma-separated list of branch names that should be included
schema:
type: string
- name: filters.branch.notIn
in: query
required: false
description: Comma-separated list of branch names that should be excluded
schema:
type: string
- name: filters.cvePatchStatus
in: query
required: false
description: Comma-separated list of patch statuses ("patch_unavailable", "patch_available", or "patch_applied") that should be included
schema:
type: string
- name: filters.cvePatchStatus.notIn
in: query
required: false
description: Comma-separated list of patch statuses ("patch_unavailable", "patch_available", or "patch_applied") that should be excluded
schema:
type: string
- name: filters.dependencyDead
in: query
required: false
description: Dead/reachable dependency filter flag
schema:
type: boolean
default: false
- name: filters.dependencyDead.notIn
in: query
required: false
description: Dead/reachable dependency filter flag
schema:
type: boolean
default: false
- name: filters.dependencyDev
in: query
required: false
description: Development/production dependency filter flag
schema:
type: boolean
default: false
- name: filters.dependencyDev.notIn
in: query
required: false
description: Development/production dependency filter flag
schema:
type: boolean
default: false
- name: filters.dependencyDirect
in: query
required: false
description: Direct/transitive dependency filter flag
schema:
type: boolean
default: false
- name: filters.dependencyDirect.notIn
in: query
required: false
description: Direct/transitive dependency filter flag
schema:
type: boolean
default: false
- name: filters.repoFullName
in: query
required: false
description: Comma-separated list of repo full names that should be included
schema:
type: string
- name: filters.repoFullName.notIn
in: query
required: false
description: Comma-separated list of repo full names that should be excluded
schema:
type: string
- name: filters.repoLabels
in: query
required: false
description: Comma-separated list of repo labels that should be included. Use "" to filter for repositories with no labels.
schema:
type: string
- name: filters.repoLabels.notIn
in: query
required: false
description: Comma-separated list of repo labels that should be excluded. Use "" to filter for repositories with no labels.
schema:
type: string
- name: filters.repoSlug
in: query
required: false
description: Comma-separated list of repo slugs that should be included
schema:
type: string
- name: filters.repoSlug.notIn
in: query
required: false
description: Comma-separated list of repo slugs that should be excluded
schema:
type: string
security:
- bearerAuth:
- historical:alerts-list
- basicAuth:
- historical:alerts-list
description: 'List historical alerts.
Pagination: keep requesting pages (passing the previous response''s `endCursor` as `startAfterCursor`) until `endCursor` is `null`. Do not stop when `items` is empty — an empty page can be returned while more results still remain on later pages, so `endCursor` being `null` is the only reliable end-of-results signal.
This endpoint consumes 10 units of your quota.
This endpoint requires the following org token scopes:
- historical:alerts-list'
responses:
'200':
content:
application/json:
schema:
type: object
additionalProperties: false
description: ''
properties:
endCursor:
type: string
description: ''
default: ''
nullable: true
items:
type: array
items:
type: object
additionalProperties: false
description: ''
properties:
repoFullName:
type: string
description: ''
default: ''
repoId:
type: string
description: ''
default: ''
nullable: true
repoSlug:
type: string
description: ''
default: ''
repoLabels:
type: array
items:
type: string
description: ''
default: ''
description: ''
repoLabelIds:
type: array
items:
type: string
description: ''
default: ''
description: ''
branch:
type: string
description: ''
default: ''
defaultBranch:
type: boolean
default: false
description: ''
fullScanId:
type: string
description: ''
default: ''
scannedAt:
type: string
description: ''
default: ''
artifact:
type: object
additionalProperties: false
properties:
id:
type: string
description: ''
default: ''
nullable: true
license:
type: string
description: ''
default: ''
nullable: true
name:
type: string
description: ''
default: ''
namespace:
type: string
description: ''
default: ''
nullable: true
type:
type: string
description: ''
default: ''
version:
type: string
description: ''
default: ''
artifact_id:
type: string
description: ''
default: ''
artifactId:
type: string
description: ''
default: ''
author:
type: string
description: ''
default: ''
capabilities:
$ref: '#/components/schemas/Capabilities'
qualifiers:
$ref: '#/components/schemas/Qualifiers'
scores:
$ref: '#/components/schemas/SocketScore'
size:
type: integer
description: ''
default: 0
subpath:
type: string
description: ''
default: ''
required:
- id
- license
- name
- namespace
- type
- version
# --- truncated at 32 KB (166 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/socket/refs/heads/main/openapi/socket-alerts-api-openapi.yml