---
title: "Translate Org Alert Triage"
method: POST
path: "/orgs/{org_slug}/alert-policies/migration/translate"
tags: ["alert-policies"]
---

# Translate Org Alert Triage

`POST /orgs/{org_slug}/alert-policies/migration/translate`

## Request

- Base URL: `https://api.socket.dev/v0`
- URL: `https://api.socket.dev/v0/orgs/{org_slug}/alert-policies/migration/translate`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Translate a legacy alert triage payload — the same body as `POST /v0/orgs/{org_slug}/triage/alerts` — into the resolution or policy-rule requests that replace it. Nothing is created. Policy-rule translations target the default (Main) policy, which covers repositories without a policy label; labeled policies do not inherit those rules, so POST the same body to `/alert-policies/{id}/rules` if the rule should apply there. Entries that cannot be translated are returned in `untranslatable`; the rest are in `translations`. Requires one of: `triage:alerts-update`, `alert-policy:read`, or `alert-resolution:create`.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- No Scopes Required, but authentication is required

## Path parameters

- `org_slug` string, required

## Request body

- object
  - `alertTriage` object[], required
    - `uuid` string, nullable: The UUID of the triage entry. Omit to create a new entry; provide to update an existing one.
    - `packageType` string, nullable: The package ecosystem type (e.g., npm, pypi). Use null or "*" for wildcard.
    - `packageNamespace` string, nullable: The package namespace or scope. Use null or "*" for wildcard.
    - `packageName` string, nullable: The package name. Use null or "*" for wildcard.
    - `packageVersion` string, nullable: The package version. Supports a "*" suffix for wildcard prefix matching. Use null for any version.
    - `alertKey` string, nullable: The specific alert key to target.
    - `alertType` string, nullable: The alert type (e.g., criticalCVE, highCVE).
    - `fixAvailable` 'available' | 'unavailable' | '*': Whether a fix is available, unavailable, or * for any
    - `patchAvailable` 'available' | 'unavailable' | '*': Whether a patch is available, unavailable, or * for any
    - `kevs` 'exist' | 'none' | '*': Whether the alert has a CISA KEV, can be exist, none, or * for any
    - `cveOrGhsaId` string, nullable: CVE or GHSA ID to match against.
    - `reachability` 'reachable' | 'unreachable' | 'other' | '*': The reachability of the alert, can be reachable, unreachable, other, or * for any
    - `cvssScoreCmp` string, nullable: CVSS score comparison operator and value (e.g., >=7.5, >5.0, ==8.0).
    - `note` string: A note or comment for the triage action.
    - `state` 'block' | 'ignore' | 'inherit' | 'monitor' | 'warn': The triage state of the alert

## Response `200`

Translated requests, plus any entries that have no equivalent.

- object
  - `translations` object[], required
    - `index` integer, required: Zero-based position of the source entry in the submitted `alertTriage` array.
    - `target` 'alert_resolution' | 'alert_policy_rule', required: Which API replaces this triage entry.
    - `method` 'POST', required: HTTP method of the new request.
    - `path` string, required: Path of the new request. Policy rules target the default (Main) policy, which covers repositories without a policy label. Labeled policies do not inherit Main — replace `default` with that policy id if the rule should apply there.
    - `body` object, required: Request body to send. Resolutions: `{ reason, comment, vigil_selector }` (`reason` is `other`). Rules: `{ name, action, note, vigil_selector }` (`block` becomes `error`).
  - `untranslatable` object[], required
    - `index` integer, required: Zero-based position of the source entry in the submitted `alertTriage` array.
    - `code` 'inherit_not_translatable' | 'alert_key_not_translatable' | 'matches_all_alerts' | 'filter_not_translatable' | 'note_too_long', required: Why the entry was not translated.
    - `reason` string, required: What to do instead. Safe to show to API clients.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Insufficient max_quota for API method
- `404`: Resource not found
- `429`: Insufficient quota for API route

## Changes

- **2026-11-03** `5ad8bf36b1e7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/socket-dev/apis/socket/changes/orgs/:org_slug/alert-policies/migration/translate/post.md)

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket/revisions/5ad8bf36b1e7?raw)