SOsocket-dev
threat-campaigns

Get a threat campaign

Returns a single supply chain attack campaign by ID. Same shape as one item from the campaigns list; package PURLs are not inlined — fetch them from the paginated /threat-campaigns/:campaign_id/packages resource instead.

Useful for filling in cached campaign metadata client-side when crawling the campaigns list or packages feed.

Authentication: Organization API token, OAuth2, or NextAuth session. Required token scope: threat-campaigns:list.

This endpoint requires an Enterprise Plan with the Threat Feed add-on.

get/v1/orgs/{org_slug}/threat-campaigns/{campaign_id}/

Request

  • The document declares no server URL.
  • Auth
    HTTP bearer

Path parameters

org_slugstring required

Organization slug

campaign_idstring required

Campaign ID

Response

Default Response

idstring required
namestring required
descriptionstring required
status'ongoing' | 'past' required
ecosystemstring[] nullable required
firstDiscoveredstring nullable required
lastActivitystring nullable required
blogUrlsstring[] required
linkedThreatCountinteger required

Number of threat feed entries linked to this campaign.

linkedPackageArtifactsCountinteger required

Number of distinct package artifacts linked to this campaign.

htmlUrlstring nullable required

URL of the public campaign page on socket.dev, or null if the campaign has no public page.

createdAtstring date-time required
updatedAtstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.