SOsocket-dev
events

List organization events

Changed on

List events for an organization.

Events are records of actions taken across Socket products, such as firewall decisions and CLI/SDK actions.

The maximum date range per request is 365 days. When more results are available, the response body's "endCursor" property contains the cursor to pass as the "startAfterCursor" query parameter to retrieve the next page.

This endpoint consumes 10 units of your quota.

This endpoint requires the following org token scopes:

  • telemetry-events:list
get/orgs/{org_slug}/events

Request

  • Base URL
    https://api.socket.dev/v0
  • URL
    https://api.socket.dev/v0/orgs/{org_slug}/events
  • Auth
    • HTTP bearer
    • or HTTP basic

Path parameters

org_slugstring required

The slug of the organization

Query parameters

per_pageinteger

Specify the maximum number of results to return per page (intermediate pages may have fewer than this limit and callers should always check "endCursor" in response body to know if there are more pages)

datestring

The ISO 8601 date in YYYY-MM-DD format (e.g. "2025-01-01"). If not specified, defaults to the current date.

rangestring

The date range in format like "7d" or "-7d" where "d" is days. A positive value means the range extends forward from the date, and a negative value means the range extends backward. Defaults to "-7d" (past week). Maximum range is 365 days. NOTE: "latest" is not supported for events.

startAfterCursorstring

The pagination cursor that was returned as the "endCursor" property in previous request. Unsupported cursor aliases return 400; unrelated query parameters are unchanged.

sortstring

Sort type (eventCreatedAt)

searchstring

Search keywords to filter events

filters.alertActionstring

Comma-separated list of alert actions (one of "error", "warn", "monitor", "ignore"). Filters on the policy-decided alert_action column.

filters.alertAction.notInstring

Comma-separated list of alert actions (one of "error", "warn", "monitor", "ignore"). Filters on the policy-decided alert_action column.

filters.artifactNamestring

Name of artifact

filters.artifactName.notInstring

Name of artifact

filters.artifactNamespacestring

Filter by artifact namespace

filters.artifactNamespace.notInstring

Filter by artifact namespace

filters.artifactPurlstring

Filter by artifact purl (matches on purl without version)

filters.artifactPurl.notInstring

Filter by artifact purl (matches on purl without version)

filters.artifactTypestring

Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be included

filters.artifactType.notInstring

Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be excluded

filters.artifactVersionstring

Filter by artifact version

filters.artifactVersion.notInstring

Filter by artifact version

filters.clientActionstring

Comma-separated list of client actions (e.g., "install", "scan", "block")

filters.clientAction.notInstring

Comma-separated list of client actions (e.g., "install", "scan", "block")

filters.clientMachineIdstring

Comma-separated list of client machine IDs for exact matching

filters.clientMachineId.notInstring

Comma-separated list of client machine IDs for exact matching

filters.clientProductNamestring

Comma-separated list of client product names (e.g., "socket-cli", "socket-firewall")

filters.clientProductName.notInstring

Comma-separated list of client product names (e.g., "socket-cli", "socket-firewall")

filters.clientUserAgentstring

Comma-separated list of HTTP request user-agent header values for exact matching

filters.clientUserAgent.notInstring

Comma-separated list of HTTP request user-agent header values for exact matching

filters.eventCategorystring

Comma-separated list of event categories (e.g., "audit", "analytics", "debug")

filters.eventCategory.notInstring

Comma-separated list of event categories (e.g., "audit", "analytics", "debug")

filters.eventCreatedAt.eqstring

Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone)

filters.eventCreatedAt.ltstring

Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone)

filters.eventCreatedAt.ltestring

Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone)

filters.eventCreatedAt.gtstring

Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone)

filters.eventCreatedAt.gtestring

Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone)

filters.eventLevelstring

Comma-separated list of event levels ("trace", "debug", "info", "warn", "error", "fatal")

filters.eventLevel.notInstring

Comma-separated list of event levels ("trace", "debug", "info", "warn", "error", "fatal")

filters.eventSourcestring

Comma-separated list of event sources (e.g., "api-v0", "socket-cli", "socket-firewall")

filters.eventSource.notInstring

Comma-separated list of event sources (e.g., "api-v0", "socket-cli", "socket-firewall")

filters.eventTypestring

Comma-separated list of event types (e.g., "show_ide_text_decoration", "firewall_package_download")

filters.eventType.notInstring

Comma-separated list of event types (e.g., "show_ide_text_decoration", "firewall_package_download")

filters.httpRequestRemoteIpstring

Comma-separated list of client IP addresses (HTTP request remote IPs) for exact matching

filters.httpRequestRemoteIp.notInstring

Comma-separated list of client IP addresses (HTTP request remote IPs) for exact matching

filters.repoFullNamestring

Comma-separated list of repo full names that should be included

filters.repoFullName.notInstring

Comma-separated list of repo full names that should be excluded

filters.repoSlugstring

Comma-separated list of repo slugs that should be included

filters.repoSlug.notInstring

Comma-separated list of repo slugs that should be excluded

Response

The paginated array of event items for the organization and related metadata.

endCursorstring nullable required

Changes