---
title: "List Org Alert Policy Rules"
method: GET
path: "/orgs/{org_slug}/alert-policies/{policy_id}/rules"
tags: ["alert-policies"]
---

# List Org Alert Policy Rules

`GET /orgs/{org_slug}/alert-policies/{policy_id}/rules`

## Request

- Base URL: `https://api.socket.dev/v0`
- URL: `https://api.socket.dev/v0/orgs/{org_slug}/alert-policies/{policy_id}/rules`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

List the custom rules of an alert policy in evaluation order (ascending rank). Rules are evaluated before the policy baseline; the first matching rule decides the alert action. Requires a token with org-wide repository access; repo-restricted tokens receive 403.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- alert-policy:list

## Path parameters

- `org_slug` string, required
- `policy_id` string, required

## Response `200`

Lists the rules of the specified alert policy.

- object
  - `items` object[], required
    - `id` string, required: The UUID of the rule.
    - `alert_policy_id` string, required: The UUID of the policy the rule belongs to.
    - `rank` string, required: Fractional-index rank; rules are evaluated in ascending rank order.
    - `name` string, required: The rule name.
    - `vigil_selector` object, required: Selector describing which alerts the rule applies to. Fields must all be under finding.*, location.*, or artifact.* (e.g. `{"finding.alertType": "criticalCVE", "artifact.name": "lodash"}`).
    - `action` 'error' | 'warn' | 'monitor' | 'ignore', required: The action applied to matching alerts. One of: error, warn, monitor, ignore.
    - `note` string, nullable, required: Operator-provided note.
    - `created_by` string, nullable, required: User ID that created the rule.
    - `updated_by` string, nullable, required: User ID that last updated the rule.
    - `created_at` string, required: ISO-8601 creation timestamp.
    - `updated_at` string, required: ISO-8601 last-update timestamp.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Insufficient max_quota for API method
- `404`: Resource not found
- `429`: Insufficient quota for API route

## Changes

- **2026-11-03** `5ad8bf36b1e7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/socket-dev/apis/socket/changes/orgs/:org_slug/alert-policies/:policy_id/rules/get.md)

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket/revisions/5ad8bf36b1e7?raw)