---
title: "Create Org Alert Resolution"
method: POST
path: "/orgs/{org_slug}/alerts/resolutions"
tags: ["alerts"]
---

# Create Org Alert Resolution

`POST /orgs/{org_slug}/alerts/resolutions`

## Request

- Base URL: `https://api.socket.dev/v0`
- URL: `https://api.socket.dev/v0/orgs/{org_slug}/alerts/resolutions`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Create an alert resolution. The `vigil_selector` describes which alerts the resolution applies to; matching alerts are hidden after the next org snapshot. Returns the same row shape as the list endpoint. Tokens restricted to specific repositories may only create resolutions anchored to a single granted repository via `location.repo`; org-wide or multi-repository selectors require an org-wide token.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- alert-resolution:create

## Path parameters

- `org_slug` string, required

## Query parameters

- `dry_run` boolean

## Request body

- object
  - `reason` 'false_positive' | 'remediated' | 'tolerable_risk' | 'other', required: The reason the alert is resolved. One of: false_positive, remediated, tolerable_risk, other.
  - `vigil_selector` object, required: Selector describing which alerts the resolution applies to. Fields must all be under finding.*, location.*, or artifact.* (e.g. `{"finding.alertType": "criticalCVE", "artifact.name": "lodash"}`).
  - `reason_text` string, nullable: Free-form reason text, mainly for when `reason` is `other` (1-256 characters).
  - `comment` string, nullable: Operator-provided comment (1-1024 characters).

## Response `200`

Dry-run: the write was not persisted.

- object
  - `uuid` string, required: The UUID of the resolution.
  - `reason` 'false_positive' | 'remediated' | 'tolerable_risk' | 'other', required: The reason the alert was resolved. One of: false_positive, remediated, tolerable_risk, other.
  - `reason_text` string, nullable, required: Free-form reason text when `reason` is `other`.
  - `comment` string, nullable, required: Operator-provided comment.
  - `vigil_selector` object, required: The full selector describing which alerts the resolution applies to. The anchor fields below are a derived summary — compound selectors (e.g. `$or` over several repos) cannot be summarized and read back as null anchors, so this is the source of truth.
  - `alert_type` string, nullable, required: Alert type the resolution scopes to (e.g. criticalCVE). Null if the resolution applies to multiple alert types.
  - `repo` string, nullable, required: Repository full name the resolution scopes to. Null if not scoped to a single repo.
  - `repo_label` string, nullable, required: Repository label the resolution scopes to. Null if not scoped to a label.
  - `artifact_type` string, nullable, required: Package ecosystem the resolution scopes to (e.g. npm, pypi). Null if not scoped to a single ecosystem.
  - `artifact_namespace` string, nullable, required: Package namespace/scope the resolution scopes to. Null if not scoped to a namespace.
  - `artifact_name` string, nullable, required: Package name the resolution scopes to. Null if not scoped to a single package.
  - `artifact_version` string, nullable, required: Package version the resolution scopes to. Extracted from the resolution selector at read time; null if the resolution applies to multiple versions or no single version.
  - `resolved_by` string, nullable, required: User ID that created the resolution. Null for system-created resolutions.
  - `created_at` string, required: ISO-8601 creation timestamp.
  - `updated_at` string, required: ISO-8601 last-update timestamp.
  - `dry_run` boolean: True when `?dry_run=true` (or `1` / `yes`) rehearsed the write; nothing was persisted.

## Other responses

- `201`: The created alert resolution.
- `400`: Bad request
- `401`: Unauthorized
- `403`: Insufficient max_quota for API method
- `404`: Resource not found
- `409`: Resource already exists
- `429`: Insufficient quota for API route

## Changes

- **2026-11-03** `5ad8bf36b1e7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/socket-dev/apis/socket/changes/orgs/:org_slug/alerts/resolutions/post.md)

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket/revisions/5ad8bf36b1e7?raw)