SOsocket-dev
alert-policies

Create Org Alert Policy Rule

Changed on

Create a rule on an alert policy. Rules are evaluated in ascending rank order and the first matching rule decides the alert action. Provide at most one of position, rank, before_rule_id, or after_rule_id; the rule is placed first when no position is provided. Requires a token with org-wide repository access; repo-restricted tokens receive 403.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:

  • alert-policy:create
post/orgs/{org_slug}/alert-policies/{policy_id}/rules

Request

  • Base URL
    https://api.socket.dev/v0
  • URL
    https://api.socket.dev/v0/orgs/{org_slug}/alert-policies/{policy_id}/rules
  • Auth
    • HTTP bearer
    • or HTTP basic

Path parameters

org_slugstring required

The slug of the organization

policy_idstring required

The ID of the alert policy: a UUID, or default for the default policy

Query parameters

dry_runboolean

Rehearse the write: authorize and validate the request and return the response body a real write would produce, then discard it. Accepts true, 1, or yes. Other present values return 400 so a typo cannot persist. Nothing is persisted. A dry-run success is HTTP 200 with dry_run: true, not 201.

Request body

namestring required

The rule name (1-128 characters).

vigil_selectorobject required

Selector describing which alerts the rule applies to. Fields must all be under finding., location., or artifact.* (e.g. {"finding.alertType": "criticalCVE", "artifact.name": "lodash"}).

actionstring required

The action applied to matching alerts. One of: error, warn, monitor, ignore.

notestring nullable

Operator-provided note (up to 256 characters).

positionstring

Where to place the rule within the policy: first or last. Mutually exclusive with rank, before_rule_id, and after_rule_id; when no position is provided a created rule is placed first.

rankstring

Explicit rank, as a fractional-indexing base62 order key (e.g. a0, a0V). Prefer position, before_rule_id, or after_rule_id; a rank that is not a valid order key is rejected.

before_rule_idstring nullable

Place the rule immediately before this rule UUID.

after_rule_idstring nullable

Place the rule immediately after this rule UUID.

Response

Dry-run: the write was not persisted.

idstring required

The UUID of the rule.

alert_policy_idstring required

The UUID of the policy the rule belongs to.

rankstring required

Fractional-index rank; rules are evaluated in ascending rank order.

namestring required

The rule name.

vigil_selectorobject required

Selector describing which alerts the rule applies to. Fields must all be under finding., location., or artifact.* (e.g. {"finding.alertType": "criticalCVE", "artifact.name": "lodash"}).

action'error' | 'warn' | 'monitor' | 'ignore' required

The action applied to matching alerts. One of: error, warn, monitor, ignore.

notestring nullable required

Operator-provided note.

created_bystring nullable required

User ID that created the rule.

updated_bystring nullable required

User ID that last updated the rule.

created_atstring required

ISO-8601 creation timestamp.

updated_atstring required

ISO-8601 last-update timestamp.

dry_runboolean

True when ?dry_run=true (or 1 / yes) rehearsed the write; nothing was persisted.

Changes