SOsocket-dev
alerts

Create Org Alert Resolution

Changed on

Create an alert resolution. The vigil_selector describes which alerts the resolution applies to; matching alerts are hidden after the next org snapshot. Returns the same row shape as the list endpoint. Tokens restricted to specific repositories may only create resolutions anchored to a single granted repository via location.repo; org-wide or multi-repository selectors require an org-wide token.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:

  • alert-resolution:create
post/orgs/{org_slug}/alerts/resolutions

Request

  • Base URL
    https://api.socket.dev/v0
  • URL
    https://api.socket.dev/v0/orgs/{org_slug}/alerts/resolutions
  • Auth
    • HTTP bearer
    • or HTTP basic

Path parameters

org_slugstring required

The slug of the organization

Query parameters

dry_runboolean

Rehearse the write: authorize and validate the request and return the response body a real write would produce, then discard it. Accepts true, 1, or yes. Other present values return 400 so a typo cannot persist. Nothing is persisted. A dry-run success is HTTP 200 with dry_run: true, not 201.

Request body

reason'false_positive' | 'remediated' | 'tolerable_risk' | 'other' required

The reason the alert is resolved. One of: false_positive, remediated, tolerable_risk, other.

vigil_selectorobject required

Selector describing which alerts the resolution applies to. Fields must all be under finding., location., or artifact.* (e.g. {"finding.alertType": "criticalCVE", "artifact.name": "lodash"}).

reason_textstring nullable

Free-form reason text, mainly for when reason is other (1-256 characters).

commentstring nullable

Operator-provided comment (1-1024 characters).

Response

Dry-run: the write was not persisted.

uuidstring required

The UUID of the resolution.

reason'false_positive' | 'remediated' | 'tolerable_risk' | 'other' required

The reason the alert was resolved. One of: false_positive, remediated, tolerable_risk, other.

reason_textstring nullable required

Free-form reason text when reason is other.

commentstring nullable required

Operator-provided comment.

vigil_selectorobject required

The full selector describing which alerts the resolution applies to. The anchor fields below are a derived summary — compound selectors (e.g. $or over several repos) cannot be summarized and read back as null anchors, so this is the source of truth.

alert_typestring nullable required

Alert type the resolution scopes to (e.g. criticalCVE). Null if the resolution applies to multiple alert types.

repostring nullable required

Repository full name the resolution scopes to. Null if not scoped to a single repo.

repo_labelstring nullable required

Repository label the resolution scopes to. Null if not scoped to a label.

artifact_typestring nullable required

Package ecosystem the resolution scopes to (e.g. npm, pypi). Null if not scoped to a single ecosystem.

artifact_namespacestring nullable required

Package namespace/scope the resolution scopes to. Null if not scoped to a namespace.

artifact_namestring nullable required

Package name the resolution scopes to. Null if not scoped to a single package.

artifact_versionstring nullable required

Package version the resolution scopes to. Extracted from the resolution selector at read time; null if the resolution applies to multiple versions or no single version.

resolved_bystring nullable required

User ID that created the resolution. Null for system-created resolutions.

created_atstring required

ISO-8601 creation timestamp.

updated_atstring required

ISO-8601 last-update timestamp.

dry_runboolean

True when ?dry_run=true (or 1 / yes) rehearsed the write; nothing was persisted.

Changes