---
title: "Create Org Alert Policy"
method: POST
path: "/orgs/{org_slug}/alert-policies"
tags: ["alert-policies"]
---

# Create Org Alert Policy

`POST /orgs/{org_slug}/alert-policies`

## Request

- Base URL: `https://api.socket.dev/v0`
- URL: `https://api.socket.dev/v0/orgs/{org_slug}/alert-policies`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Create an alert policy. A repo label with the same name is created to scope the policy; repositories carrying that label are governed by the policy. Requires a token with org-wide repository access; repo-restricted tokens receive 403.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- alert-policy:create

## Path parameters

- `org_slug` string, required

## Query parameters

- `dry_run` boolean

## Request body

- object
  - `name` string, required: The policy name (1-120 characters). Also used as the name of the repo label that scopes the policy.
  - `description` string, nullable: Operator-provided description (up to 256 characters).
  - `repository_ids` string[], nullable: Repositories to scope the policy to.
  - `baseline` string, nullable: Baseline rule bundle the policy starts from. One of: essential, balanced, comprehensive. Null for no baseline.

## Response `200`

Dry-run: the write was not persisted.

- object
  - `id` string, required: The ID of the policy: a UUID, or `default` for the default policy until it is first customized.
  - `name` string, nullable, required: The policy name. Null for the default policy, which applies to all repositories without a policy label.
  - `description` string, nullable, required: Operator-provided description.
  - `apply_method` 'labeled_repos' | 'unlabeled_repos', required: How the policy scopes to repositories: `labeled_repos` applies to repositories carrying the policy repo label; `unlabeled_repos` is the default policy for all unlabeled repositories.
  - `repo_label_id` string, nullable, required: The repo label that scopes this policy. Null for the default policy.
  - `repository_ids` string[], required: Repositories the policy scopes to. Empty for the default policy and for policies with no repository assignments.
  - `baseline` string, nullable, required: Baseline rule bundle the policy starts from. One of: essential, balanced, comprehensive. Null when the policy has no baseline.
  - `created_by` string, nullable, required: User ID that created the policy.
  - `updated_by` string, nullable, required: User ID that last updated the policy.
  - `created_at` string, nullable, required: ISO-8601 creation timestamp. Null for the default policy until it is first customized.
  - `updated_at` string, nullable, required: ISO-8601 last-update timestamp. Null for the default policy until it is first customized.
  - `dry_run` boolean: True when `?dry_run=true` (or `1` / `yes`) rehearsed the write; nothing was persisted.

## Other responses

- `201`: The created alert policy.
- `400`: Bad request
- `401`: Unauthorized
- `403`: Insufficient max_quota for API method
- `404`: Resource not found
- `409`: Resource already exists
- `429`: Insufficient quota for API route

## Changes

- **2026-11-03** `5ad8bf36b1e7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/socket-dev/apis/socket/changes/orgs/:org_slug/alert-policies/post.md)

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket/revisions/5ad8bf36b1e7?raw)