--- title: "Get diff scan" method: GET path: "/orgs/{org_slug}/diff-scans/{diff_scan_id}" tags: ["diff-scans"] --- # Get diff scan `GET /orgs/{org_slug}/diff-scans/{diff_scan_id}` Get the difference between two full scans from an existing diff scan resource. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - diff-scans:list ## Path parameters - `org_slug` string, required - `diff_scan_id` string, uuid, required ## Query parameters - `omit_license_details` boolean - `omit_unchanged` boolean - `cached` boolean ## Response `200` The difference between the two Full Scans in the diff scan. - object - `diff_scan` object, required - `id` string, required — The ID of the diff scan. - `organization_id` string, required — The ID of the organization that owns the diff scan. - `repository_id` string, required — The ID of the repository the diff scan was run against. - `created_at` string, required — ISO 8601 timestamp of when the diff scan was created. - `updated_at` string, required — ISO 8601 timestamp of when the diff scan was last updated. - `before_full_scan` object, required - `id` string, required - `created_at` string, required - `updated_at` string, required - `organization_id` string, required - `organization_slug` string, required - `repository_id` string, required - `repository_slug` string, required - `branch` string, nullable, required - `commit_message` string, nullable, required - `commit_hash` string, nullable, required - `pull_request` integer, nullable, required - `committers` string[], required - `html_url` string, nullable, required - `api_url` string, nullable, required - `after_full_scan` object, required - `id` string, required - `created_at` string, required - `updated_at` string, required - `organization_id` string, required - `organization_slug` string, required - `repository_id` string, required - `repository_slug` string, required - `branch` string, nullable, required - `commit_message` string, nullable, required - `commit_hash` string, nullable, required - `pull_request` integer, nullable, required - `committers` string[], required - `html_url` string, nullable, required - `api_url` string, nullable, required - `description` string, nullable, required — Human readable description of the diff scan, e.g. the pull request title. - `external_href` string, nullable, required — Link to the external resource the diff scan was created for, e.g. the pull request URL. - `merge` boolean, required — True when the diff scan was created for a merge event rather than an open pull request. - `html_url` string, nullable, required — Link to the diff scan report in the Socket dashboard. - `api_url` string, nullable, required — Link to the diff scan resource in the Socket API. - `incomplete` boolean, required — True when either side of the diff was truncated at the plan's dependency limit. A truncated diff is imbalanced and can report changes for artifacts the change never touched, so treat the artifact lists as unreliable when this is set. - `artifacts` object, required — Artifacts in the diff grouped by how they changed between the before and after scans. - `added` SocketDiffArtifact[], required — Artifacts present in the after scan but not the before scan. - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `diffType` 'added' | 'removed' | 'updated' | 'replaced' | 'unchanged', required — Type of change detected for this artifact in the diff - `id` string - `author` string[] — List of package authors or maintainers - `base` SocketArtifactLink[] — Artifact links from the base/before state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `capabilities` Capabilities - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `head` SocketArtifactLink[] — Artifact links from the head/after state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `qualifiers` unknown - `size` number — Total size of the package artifact in bytes - `license` string - `licenseDetails` object[] - `spdxDisj` string, required — SPDX license expression in disjunctive normal form (e.g., '(MIT OR Apache-2.0)') - `authors` string[], required — List of authors found in the license text - `errorData` string, required — Error details if license parsing failed - `provenance` string, required — Source where this license information was detected (e.g., 'package.json', 'LICENSE file', 'README') - `filepath` string, required — Path to the file containing this license information - `match_strength` number, required — Confidence score from 0.0 to 1.0 indicating how well the detected license matches the source text - `licenseAttrib` object[] - `attribText` string, required — Full text of the license attribution or copyright notice found in the package - `attribData` object[], required - `purl` string, required — Package URL this attribution applies to - `foundInFilepath` string, required — File path where this attribution was found - `spdxExpr` string, required — SPDX license expression parsed from the attribution text - `foundAuthors` string[], required — Authors mentioned in this attribution - `score` SocketScore - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `alerts` SocketAlert[] - `key` string, required — Unique identifier for this alert instance, used for deduplication and tracking across scans - `type` string, required — Alert type identifier referencing the alert type definition - `severity` 'low' | 'middle' | 'high' | 'critical' - `category` 'supplyChainRisk' | 'quality' | 'maintenance' | 'vulnerability' | 'license' | 'other' - `file` string — File path where this alert was detected - `start` integer — Starting position of the alert in the file - `end` integer — Ending position of the alert in the file - `props` object — Additional alert-specific properties and metadata that vary by alert type. For vulnerability alerts this includes the `cveId` and `ghsaId` identifiers, either of which may be an empty string when GitHub has not assigned that identifier to the advisory. - `action` string — Action to take for this alert (e.g., error, warn, ignore) - `actionSource` object - `type` string, required — Type of action source (e.g., policy, override) - `candidates` object[], required - … - `actionPolicyIndex` integer — Index of the policy rule that triggered this action, for traceability to security policies - `fix` object - `type` string, required — Type of fix available (e.g., upgrade, remove, cve) - `description` string, required — Human-readable description of how to fix this issue - `patch` object[] — Patches available to fix this specific alert - … - `patch` SocketPatch - `uuid` string, required — Unique identifier for this patch - `tier` 'free' | 'paid', required — Access tier required for this patch (free or paid) - `deprecated` boolean — Indicates if this patch is deprecated and should not be used - `reachability` object - `head` ReachabilityResult - … - `base` ReachabilityResult - … - `subType` string — Generic alert sub-type - `removed` SocketDiffArtifact[], required — Artifacts present in the before scan but not the after scan. - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `diffType` 'added' | 'removed' | 'updated' | 'replaced' | 'unchanged', required — Type of change detected for this artifact in the diff - `id` string - `author` string[] — List of package authors or maintainers - `base` SocketArtifactLink[] — Artifact links from the base/before state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `capabilities` Capabilities - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `head` SocketArtifactLink[] — Artifact links from the head/after state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `qualifiers` unknown - `size` number — Total size of the package artifact in bytes - `license` string - `licenseDetails` object[] - `spdxDisj` string, required — SPDX license expression in disjunctive normal form (e.g., '(MIT OR Apache-2.0)') - `authors` string[], required — List of authors found in the license text - `errorData` string, required — Error details if license parsing failed - `provenance` string, required — Source where this license information was detected (e.g., 'package.json', 'LICENSE file', 'README') - `filepath` string, required — Path to the file containing this license information - `match_strength` number, required — Confidence score from 0.0 to 1.0 indicating how well the detected license matches the source text - `licenseAttrib` object[] - `attribText` string, required — Full text of the license attribution or copyright notice found in the package - `attribData` object[], required - `purl` string, required — Package URL this attribution applies to - `foundInFilepath` string, required — File path where this attribution was found - `spdxExpr` string, required — SPDX license expression parsed from the attribution text - `foundAuthors` string[], required — Authors mentioned in this attribution - `score` SocketScore - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `alerts` SocketAlert[] - `key` string, required — Unique identifier for this alert instance, used for deduplication and tracking across scans - `type` string, required — Alert type identifier referencing the alert type definition - `severity` 'low' | 'middle' | 'high' | 'critical' - `category` 'supplyChainRisk' | 'quality' | 'maintenance' | 'vulnerability' | 'license' | 'other' - `file` string — File path where this alert was detected - `start` integer — Starting position of the alert in the file - `end` integer — Ending position of the alert in the file - `props` object — Additional alert-specific properties and metadata that vary by alert type. For vulnerability alerts this includes the `cveId` and `ghsaId` identifiers, either of which may be an empty string when GitHub has not assigned that identifier to the advisory. - `action` string — Action to take for this alert (e.g., error, warn, ignore) - `actionSource` object - `type` string, required — Type of action source (e.g., policy, override) - `candidates` object[], required - … - `actionPolicyIndex` integer — Index of the policy rule that triggered this action, for traceability to security policies - `fix` object - `type` string, required — Type of fix available (e.g., upgrade, remove, cve) - `description` string, required — Human-readable description of how to fix this issue - `patch` object[] — Patches available to fix this specific alert - … - `patch` SocketPatch - `uuid` string, required — Unique identifier for this patch - `tier` 'free' | 'paid', required — Access tier required for this patch (free or paid) - `deprecated` boolean — Indicates if this patch is deprecated and should not be used - `reachability` object - `head` ReachabilityResult - … - `base` ReachabilityResult - … - `subType` string — Generic alert sub-type - `unchanged` SocketDiffArtifact[], nullable, required — Artifacts present in both scans with no changes. Null when omitted via the omit_unchanged query parameter. - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `diffType` 'added' | 'removed' | 'updated' | 'replaced' | 'unchanged', required — Type of change detected for this artifact in the diff - `id` string - `author` string[] — List of package authors or maintainers - `base` SocketArtifactLink[] — Artifact links from the base/before state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `capabilities` Capabilities - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `head` SocketArtifactLink[] — Artifact links from the head/after state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `qualifiers` unknown - `size` number — Total size of the package artifact in bytes - `license` string - `licenseDetails` object[] - `spdxDisj` string, required — SPDX license expression in disjunctive normal form (e.g., '(MIT OR Apache-2.0)') - `authors` string[], required — List of authors found in the license text - `errorData` string, required — Error details if license parsing failed - `provenance` string, required — Source where this license information was detected (e.g., 'package.json', 'LICENSE file', 'README') - `filepath` string, required — Path to the file containing this license information - `match_strength` number, required — Confidence score from 0.0 to 1.0 indicating how well the detected license matches the source text - `licenseAttrib` object[] - `attribText` string, required — Full text of the license attribution or copyright notice found in the package - `attribData` object[], required - `purl` string, required — Package URL this attribution applies to - `foundInFilepath` string, required — File path where this attribution was found - `spdxExpr` string, required — SPDX license expression parsed from the attribution text - `foundAuthors` string[], required — Authors mentioned in this attribution - `score` SocketScore - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `alerts` SocketAlert[] - `key` string, required — Unique identifier for this alert instance, used for deduplication and tracking across scans - `type` string, required — Alert type identifier referencing the alert type definition - `severity` 'low' | 'middle' | 'high' | 'critical' - `category` 'supplyChainRisk' | 'quality' | 'maintenance' | 'vulnerability' | 'license' | 'other' - `file` string — File path where this alert was detected - `start` integer — Starting position of the alert in the file - `end` integer — Ending position of the alert in the file - `props` object — Additional alert-specific properties and metadata that vary by alert type. For vulnerability alerts this includes the `cveId` and `ghsaId` identifiers, either of which may be an empty string when GitHub has not assigned that identifier to the advisory. - `action` string — Action to take for this alert (e.g., error, warn, ignore) - `actionSource` object - `type` string, required — Type of action source (e.g., policy, override) - `candidates` object[], required - … - `actionPolicyIndex` integer — Index of the policy rule that triggered this action, for traceability to security policies - `fix` object - `type` string, required — Type of fix available (e.g., upgrade, remove, cve) - `description` string, required — Human-readable description of how to fix this issue - `patch` object[] — Patches available to fix this specific alert - … - `patch` SocketPatch - `uuid` string, required — Unique identifier for this patch - `tier` 'free' | 'paid', required — Access tier required for this patch (free or paid) - `deprecated` boolean — Indicates if this patch is deprecated and should not be used - `reachability` object - `head` ReachabilityResult - … - `base` ReachabilityResult - … - `subType` string — Generic alert sub-type - `replaced` SocketDiffArtifact[], required — Artifacts replaced between the scans, e.g. the same package supplied by a different source. - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `diffType` 'added' | 'removed' | 'updated' | 'replaced' | 'unchanged', required — Type of change detected for this artifact in the diff - `id` string - `author` string[] — List of package authors or maintainers - `base` SocketArtifactLink[] — Artifact links from the base/before state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `capabilities` Capabilities - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `head` SocketArtifactLink[] — Artifact links from the head/after state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `qualifiers` unknown - `size` number — Total size of the package artifact in bytes - `license` string - `licenseDetails` object[] - `spdxDisj` string, required — SPDX license expression in disjunctive normal form (e.g., '(MIT OR Apache-2.0)') - `authors` string[], required — List of authors found in the license text - `errorData` string, required — Error details if license parsing failed - `provenance` string, required — Source where this license information was detected (e.g., 'package.json', 'LICENSE file', 'README') - `filepath` string, required — Path to the file containing this license information - `match_strength` number, required — Confidence score from 0.0 to 1.0 indicating how well the detected license matches the source text - `licenseAttrib` object[] - `attribText` string, required — Full text of the license attribution or copyright notice found in the package - `attribData` object[], required - `purl` string, required — Package URL this attribution applies to - `foundInFilepath` string, required — File path where this attribution was found - `spdxExpr` string, required — SPDX license expression parsed from the attribution text - `foundAuthors` string[], required — Authors mentioned in this attribution - `score` SocketScore - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `alerts` SocketAlert[] - `key` string, required — Unique identifier for this alert instance, used for deduplication and tracking across scans - `type` string, required — Alert type identifier referencing the alert type definition - `severity` 'low' | 'middle' | 'high' | 'critical' - `category` 'supplyChainRisk' | 'quality' | 'maintenance' | 'vulnerability' | 'license' | 'other' - `file` string — File path where this alert was detected - `start` integer — Starting position of the alert in the file - `end` integer — Ending position of the alert in the file - `props` object — Additional alert-specific properties and metadata that vary by alert type. For vulnerability alerts this includes the `cveId` and `ghsaId` identifiers, either of which may be an empty string when GitHub has not assigned that identifier to the advisory. - `action` string — Action to take for this alert (e.g., error, warn, ignore) - `actionSource` object - `type` string, required — Type of action source (e.g., policy, override) - `candidates` object[], required - … - `actionPolicyIndex` integer — Index of the policy rule that triggered this action, for traceability to security policies - `fix` object - `type` string, required — Type of fix available (e.g., upgrade, remove, cve) - `description` string, required — Human-readable description of how to fix this issue - `patch` object[] — Patches available to fix this specific alert - … - `patch` SocketPatch - `uuid` string, required — Unique identifier for this patch - `tier` 'free' | 'paid', required — Access tier required for this patch (free or paid) - `deprecated` boolean — Indicates if this patch is deprecated and should not be used - `reachability` object - `head` ReachabilityResult - … - `base` ReachabilityResult - … - `subType` string — Generic alert sub-type - `updated` SocketDiffArtifact[], required — Artifacts whose version changed between the scans. - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `diffType` 'added' | 'removed' | 'updated' | 'replaced' | 'unchanged', required — Type of change detected for this artifact in the diff - `id` string - `author` string[] — List of package authors or maintainers - `base` SocketArtifactLink[] — Artifact links from the base/before state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `capabilities` Capabilities - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `head` SocketArtifactLink[] — Artifact links from the head/after state - `direct` boolean — Indicates if this is a direct dependency (not transitive) - `dev` boolean — Indicates if this is a development-only dependency not used in production - `dead` boolean — Indicates if this package is deprecated, abandoned, or no longer maintained - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] — IDs of the root-level packages in the dependency tree that depend on this package - `dependencies` SocketId[] — IDs of packages that this package directly depends on - `alertPriorities` object — Computed priority scores for each alert type based on severity, reachability, and fixability factors - `artifact` object - `type` 'alpm' | 'apk' | 'bitbucket' | 'cocoapods' | 'cargo' | 'chrome' | 'clawhub' | 'composer' | 'conan' | 'conda' | 'cran' | 'deb' | 'docker' | 'gem' | 'generic' | 'github' | 'golang' | 'hackage' | 'hex' | 'huggingface' | 'maven' | 'mlflow' | 'npm' | 'nuget' | 'qpkg' | 'oci' | 'pub' | 'pypi' | 'rpm' | 'socket' | 'swid' | 'swift' | 'vscode' | 'unknown', required — Package ecosystem type identifier based on the PURL specification - `namespace` string — Package namespace or scope, such as npm organizations (@angular), Maven groupIds, or Docker image owners - `name` string — Package name within its ecosystem - `version` string — Package version string - `subpath` string — Path within the package to a specific file or directory, used to reference nested components - `release` string — Package-specific release identifier, such as PyPI's artifact ID or the specific build/release version - `id` string, required - `alertKeysToReachabilityTypes` object — Deprecated: mapping of alert keys to arrays of reachability types found across different manifest files or code locations. This field is derived from alertKeysToReachabilitySummaries for backward compatibility; use that property instead. - `alertKeysToReachabilitySummaries` object — Mapping of alert keys to arrays of reachability summaries. Each summary contains a reachability type indicating the result of reachability analysis for the corresponding vulnerability alert. - `qualifiers` unknown - `size` number — Total size of the package artifact in bytes - `license` string - `licenseDetails` object[] - `spdxDisj` string, required — SPDX license expression in disjunctive normal form (e.g., '(MIT OR Apache-2.0)') - `authors` string[], required — List of authors found in the license text - `errorData` string, required — Error details if license parsing failed - `provenance` string, required — Source where this license information was detected (e.g., 'package.json', 'LICENSE file', 'README') - `filepath` string, required — Path to the file containing this license information - `match_strength` number, required — Confidence score from 0.0 to 1.0 indicating how well the detected license matches the source text - `licenseAttrib` object[] - `attribText` string, required — Full text of the license attribution or copyright notice found in the package - `attribData` object[], required - `purl` string, required — Package URL this attribution applies to - `foundInFilepath` string, required — File path where this attribution was found - `spdxExpr` string, required — SPDX license expression parsed from the attribution text - `foundAuthors` string[], required — Authors mentioned in this attribution - `score` SocketScore - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `alerts` SocketAlert[] - `key` string, required — Unique identifier for this alert instance, used for deduplication and tracking across scans - `type` string, required — Alert type identifier referencing the alert type definition - `severity` 'low' | 'middle' | 'high' | 'critical' - `category` 'supplyChainRisk' | 'quality' | 'maintenance' | 'vulnerability' | 'license' | 'other' - `file` string — File path where this alert was detected - `start` integer — Starting position of the alert in the file - `end` integer — Ending position of the alert in the file - `props` object — Additional alert-specific properties and metadata that vary by alert type. For vulnerability alerts this includes the `cveId` and `ghsaId` identifiers, either of which may be an empty string when GitHub has not assigned that identifier to the advisory. - `action` string — Action to take for this alert (e.g., error, warn, ignore) - `actionSource` object - `type` string, required — Type of action source (e.g., policy, override) - `candidates` object[], required - … - `actionPolicyIndex` integer — Index of the policy rule that triggered this action, for traceability to security policies - `fix` object - `type` string, required — Type of fix available (e.g., upgrade, remove, cve) - `description` string, required — Human-readable description of how to fix this issue - `patch` object[] — Patches available to fix this specific alert - … - `patch` SocketPatch - `uuid` string, required — Unique identifier for this patch - `tier` 'free' | 'paid', required — Access tier required for this patch (free or paid) - `deprecated` boolean — Indicates if this patch is deprecated and should not be used - `reachability` object - `head` ReachabilityResult - … - `base` ReachabilityResult - … - `subType` string — Generic alert sub-type ## Other responses - `202` — Scan is being processed. Poll again later to retrieve results. - `400` — Bad request - `401` — Unauthorized - `403` — Insufficient max_quota for API method - `404` — Resource not found - `429` — Insufficient quota for API route --- [API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)