---
title: "List threat campaigns"
method: GET
path: "/v1/orgs/{org_slug}/threat-campaigns/"
tags: ["threat-campaigns"]
---

# List threat campaigns

`GET /v1/orgs/{org_slug}/threat-campaigns/`

## Request

- The document declares no server URL.
- Auth: HTTP bearer

Returns a paginated list of supply chain attack campaigns. Supports filtering
by status, ecosystem, and an incremental sync parameter (`updated_after`).

Package PURLs are not inlined on the campaign object — they are their own
paginated resource. Fetch them per campaign from
`/threat-campaigns/:campaign_id/packages`.

Authentication: Organization API token, OAuth2, or NextAuth session.
Required token scope: `threat-campaigns:list`.

This endpoint requires an Enterprise Plan with the Threat Feed add-on.

## Path parameters

- `org_slug` string, required

## Query parameters

- `status` 'ongoing' | 'past'
- `ecosystem` string
- `updated_after` string
- `per_page` integer
- `cursor` string

## Response `200`

Default Response

- object
  - `items` object[], required
    - `id` string, required
    - `name` string, required
    - `description` string, required
    - `status` 'ongoing' | 'past', required
    - `ecosystem` string[], nullable, required
    - `firstDiscovered` string, nullable, required
    - `lastActivity` string, nullable, required
    - `blogUrls` string[], required
    - `linkedThreatCount` integer, required: Number of threat feed entries linked to this campaign.
    - `linkedPackageArtifactsCount` integer, required: Number of distinct package artifacts linked to this campaign.
    - `htmlUrl` string, nullable, required: URL of the public campaign page on socket.dev, or null if the campaign has no public page.
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `endCursor` string, nullable

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `429`: Default Response

---

[API](https://skmtc.dev/socket-dev/apis/socket-api-v1.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket-api-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket-api-v1/revisions/e88284728ffb?raw)