--- title: "List latest alerts (Beta)" method: GET path: "/orgs/{org_slug}/alerts" tags: ["alerts"] --- # List latest alerts (Beta) `GET /orgs/{org_slug}/alerts` List latest alerts. Pagination: keep requesting pages (passing the previous response's `endCursor` as `startAfterCursor`) until `endCursor` is `null`. Do not stop when `items` is empty — an empty page can be returned while more results still remain on later pages, so `endCursor` being `null` is the only reliable end-of-results signal. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - alerts:list ## Path parameters - `org_slug` string, required ## Query parameters - `per_page` integer - `startAfterCursor` string - `filters.alertAction` string - `filters.alertAction.notIn` string - `filters.alertActionSourceType` string - `filters.alertActionSourceType.notIn` string - `filters.alertCategory` string - `filters.alertCategory.notIn` string - `filters.alertClearedAt.eq` string - `filters.alertClearedAt.lt` string - `filters.alertClearedAt.lte` string - `filters.alertClearedAt.gt` string - `filters.alertClearedAt.gte` string - `filters.alertCreatedAt.eq` string - `filters.alertCreatedAt.lt` string - `filters.alertCreatedAt.lte` string - `filters.alertCreatedAt.gt` string - `filters.alertCreatedAt.gte` string - `filters.alertCveId` string - `filters.alertCveId.notIn` string - `filters.alertCveTitle` string - `filters.alertCveTitle.notIn` string - `filters.alertCweId` string - `filters.alertCweId.notIn` string - `filters.alertCweName` string - `filters.alertCweName.notIn` string - `filters.alertEPSS` string - `filters.alertEPSS.notIn` string - `filters.alertFixType` string - `filters.alertFixType.notIn` string - `filters.alertKEV` boolean - `filters.alertKEV.notIn` boolean - `filters.alertPriority` string - `filters.alertPriority.notIn` string - `filters.alertReachabilityAnalysisType` string - `filters.alertReachabilityAnalysisType.notIn` string - `filters.alertReachabilityType` string - `filters.alertReachabilityType.notIn` string - `filters.alertSeverity` string - `filters.alertSeverity.notIn` string - `filters.alertStatus` string - `filters.alertStatus.notIn` string - `filters.alertType` string - `filters.alertType.notIn` string - `filters.alertUpdatedAt.eq` string - `filters.alertUpdatedAt.lt` string - `filters.alertUpdatedAt.lte` string - `filters.alertUpdatedAt.gt` string - `filters.alertUpdatedAt.gte` string - `filters.artifactName` string - `filters.artifactName.notIn` string - `filters.artifactType` string - `filters.artifactType.notIn` string - `filters.branch` string - `filters.branch.notIn` string - `filters.cvePatchStatus` string - `filters.cvePatchStatus.notIn` string - `filters.dependencyDead` boolean - `filters.dependencyDead.notIn` boolean - `filters.dependencyDev` boolean - `filters.dependencyDev.notIn` boolean - `filters.dependencyDirect` boolean - `filters.dependencyDirect.notIn` boolean - `filters.repoFullName` string - `filters.repoFullName.notIn` string - `filters.repoLabels` string - `filters.repoLabels.notIn` string - `filters.repoSlug` string - `filters.repoSlug.notIn` string ## Response `200` The paginated array of alert items for the organization and related metadata. - object - `endCursor` string, nullable, required - `items` object[], required - `key` string, required - `type` string, required - `category` string, required - `description` string, nullable, required - `fix` object, nullable, required - `type` string, required - `description` string, nullable, required - `vulnerability` object, nullable, required - `cveId` string, nullable, required - `cveTitle` string, nullable, required - `cveDescription` string, nullable, required - `cvssScore` number, required - `cvssVectorString` string, nullable, required - `cweIds` string[], nullable, required - `cweNames` string[], nullable, required - `ghsaIds` string[], nullable, required - `epssScore` number, required - `epssPercentile` number, required - `isKev` boolean, required - `firstPatchedVersionIdentifier` string, nullable, required - `url` string, nullable, required - `id` string, required - `version` integer, required - `status` 'open' | 'cleared', required - `createdAt` string, required - `updatedAt` string, required - `clearedAt` string, nullable, required - `dashboardUrl` string, required - `title` string, required - `severity` 'low' | 'medium' | 'high' | 'critical', required - `locations` object[], required - `scanType` string, required - `action` string, required - `actionSourceType` string, required - `reachability` object, required - `type` string, required - `analysisType` string, nullable, required - `licenseViolation` object, nullable, required - `violationData` object[], required - `purl` string, nullable, required - `spdxAtomOrExtraData` string, required - `prioritization` object, required - `overallScore` number, required - `fixableScore` number, required - `reachableScore` number, required - `severityScore` number, required - `repository` object, nullable, required - `fullName` string, nullable, required - `id` string, nullable, required - `slug` string, nullable, required - `workspace` string, nullable, required - `labels` string[], required - `labelIds` string[], required - `branch` object, nullable, required - `name` string, required - `type` string, nullable, required - `patch` object, required - `uuid` string, nullable, required - `status` 'patch_unavailable' | 'patch_available' | 'patch_applied', required - `deprecated` boolean, required - `dependency` object, required - `direct` boolean, required - `dev` boolean, required - `dead` boolean, required - `manifestFiles` SocketManifestReference[], required - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `artifact` object, required - `type` string, required - `namespace` string, nullable, required - `name` string, required - `id` string, required - `version` string, required - `author` string, nullable, required - `license` string, nullable, required - `scores` SocketScore, required - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `artifactId` string, nullable, required - `capabilities` object, nullable, required - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `meta` object, required - `organizationId` string, required - `queryStartTimestamp` number, required - `filters` object, required - `alertAction` string[] — Comma-separated list of alert actions ("error", "warn", "monitor", or "ignore) that should be included - `alertAction.notIn` string[] — Comma-separated list of alert actions ("error", "warn", "monitor", or "ignore) that should be excluded - `alertActionSourceType` string[] — Comma-separated list of alert action source types ("resolution", "alert-policy", "fallback", "injected-alert", "org-policy", "reachability", "repo-label-policy", "socket-yml", or "triage") that should be included - `alertActionSourceType.notIn` string[] — Comma-separated list of alert action source types ("resolution", "alert-policy", "fallback", "injected-alert", "org-policy", "reachability", "repo-label-policy", "socket-yml", or "triage") that should be excluded - `alertCategory` string[] — Comma-separated list of alert categories ("supplyChainRisk", "maintenance", "quality", "license", or "vulnerability") that should be included - `alertCategory.notIn` string[] — Comma-separated list of alert categories ("supplyChainRisk", "maintenance", "quality", "license", or "vulnerability") that should be excluded - `alertClearedAt.eq` string[] — Alert cleared at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertClearedAt.lt` string[] — Alert cleared at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertClearedAt.lte` string[] — Alert cleared at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertClearedAt.gt` string[] — Alert cleared at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertClearedAt.gte` string[] — Alert cleared at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertCreatedAt.eq` string[] — Alert created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertCreatedAt.lt` string[] — Alert created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertCreatedAt.lte` string[] — Alert created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertCreatedAt.gt` string[] — Alert created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertCreatedAt.gte` string[] — Alert created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertCveId` string[] — CVE ID - `alertCveId.notIn` string[] — CVE ID - `alertCveTitle` string[] — CVE title - `alertCveTitle.notIn` string[] — CVE title - `alertCweId` string[] — CWE ID - `alertCweId.notIn` string[] — CWE ID - `alertCweName` string[] — CWE name - `alertCweName.notIn` string[] — CWE name - `alertEPSS` string[] — Alert EPSS ("low", "medium", "high", "critical") - `alertEPSS.notIn` string[] — Alert EPSS ("low", "medium", "high", "critical") - `alertFixType` string[] — Comma-separated list of alert fix types ("upgrade", "cve", or "remove") that should be included - `alertFixType.notIn` string[] — Comma-separated list of alert fix types ("upgrade", "cve", or "remove") that should be excluded - `alertKEV` boolean[] — Alert KEV (Known Exploited Vulnerability) filter flag - `alertPriority` string[] — Alert priority ("low", "medium", "high", or "critical") - `alertPriority.notIn` string[] — Alert priority ("low", "medium", "high", or "critical") - `alertReachabilityAnalysisType` string[] — Comma-separated list of alert CVE reachability analysis types ("full-scan" or "precomputed") that should be included - `alertReachabilityAnalysisType.notIn` string[] — Comma-separated list of alert CVE reachability analysis types ("full-scan" or "precomputed") that should be excluded - `alertReachabilityType` string[] — Comma-separated list of alert CVE reachability types ("direct_dependency", "error", "maybe_reachable", "missing_support", "pending", "reachable", "undeterminable_reachability", "unknown", or "unreachable") that should be included - `alertReachabilityType.notIn` string[] — Comma-separated list of alert CVE reachability types ("direct_dependency", "error", "maybe_reachable", "missing_support", "pending", "reachable", "undeterminable_reachability", "unknown", or "unreachable") that should be excluded - `alertSeverity` string[] — Comma-separated list of alert severities ("low", "medium", "high", or "critical") that should be included - `alertSeverity.notIn` string[] — Comma-separated list of alert severities ("low", "medium", "high", or "critical") that should be excluded - `alertStatus` string[] — A single alert status ("open" or "cleared") - `alertStatus.notIn` string[] — A single alert status ("open" or "cleared") - `alertType` string[] — Comma-separated list of alert types (e.g. "usesEval", "unmaintained", etc.) that should be included - `alertType.notIn` string[] — Comma-separated list of alert types (e.g. "usesEval", "unmaintained", etc.) that should be excluded - `alertUpdatedAt.eq` string[] — Alert updated at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertUpdatedAt.lt` string[] — Alert updated at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertUpdatedAt.lte` string[] — Alert updated at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertUpdatedAt.gt` string[] — Alert updated at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `alertUpdatedAt.gte` string[] — Alert updated at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `artifactName` string[] — Name of artifact - `artifactName.notIn` string[] — Name of artifact - `artifactType` string[] — Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be included - `artifactType.notIn` string[] — Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be excluded - `branch` string[] — Comma-separated list of branch names that should be included - `branch.notIn` string[] — Comma-separated list of branch names that should be excluded - `cvePatchStatus` string[] — Comma-separated list of patch statuses ("patch_unavailable", "patch_available", or "patch_applied") that should be included - `cvePatchStatus.notIn` string[] — Comma-separated list of patch statuses ("patch_unavailable", "patch_available", or "patch_applied") that should be excluded - `dependencyDead` boolean[] — Dead/reachable dependency filter flag - `dependencyDev` boolean[] — Development/production dependency filter flag - `dependencyDirect` boolean[] — Direct/transitive dependency filter flag - `repoFullName` string[] — Comma-separated list of repo full names that should be included - `repoFullName.notIn` string[] — Comma-separated list of repo full names that should be excluded - `repoLabels` string[] — Comma-separated list of repo labels that should be included. Use "" to filter for repositories with no labels. - `repoLabels.notIn` string[] — Comma-separated list of repo labels that should be excluded. Use "" to filter for repositories with no labels. - `repoSlug` string[] — Comma-separated list of repo slugs that should be included - `repoSlug.notIn` string[] — Comma-separated list of repo slugs that should be excluded ## Other responses - `400` — Bad request - `401` — Unauthorized - `403` — Insufficient max_quota for API method - `404` — Resource not found - `429` — Insufficient quota for API route --- [API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)