SOsocket-dev
fixes

Start fix computation

Changed on

Starts computing fixes for vulnerabilities in a repository, scan, or uploaded manifest, and returns a computation id right away. Poll Get fix computation with that id until the status is succeeded or failed to get the result.

Requires exactly one of repo_slug, full_scan_id, or tar_hash, as well as vulnerability_ids to be provided. vulnerability_ids can be a comma-separated list of GHSA or CVE IDs, or "*" for all vulnerabilities.

The computation runs in the background, so large or never-before-seen projects cannot time out the request, and a dropped connection does not cancel the work.

While a computation with the same parameters is still pending or running for your organization, this endpoint returns that computation's id instead of starting a new one. Once a computation has finished, a new request starts a fresh computation.

An organization can have at most 10 computations pending or running at once. A request that would start another one gets a 429 response. Retry once one of the active computations has finished.

This endpoint consumes 10 units of your quota.

This endpoint requires the following org token scopes:

  • fixes:list
post/orgs/{org_slug}/fixes/computations

Request

  • Base URL
    https://api.socket.dev/v0
  • URL
    https://api.socket.dev/v0/orgs/{org_slug}/fixes/computations
  • Auth
    • HTTP bearer
    • or HTTP basic

Path parameters

org_slugstring required

The slug of the organization

Query parameters

repo_slugstring

The slug of the repository to fetch fixes for (e.g. "my-repo" or "my-org/my-repo"). Use the full org/repo path to disambiguate when multiple GitHub orgs share the same repo name. Computes fixes based on the latest scan on the default branch

full_scan_idstring

The ID of the scan to fetch fixes for

tar_hashstring

A tarball hash from the upload-manifest-files endpoint. Mutually exclusive with repo_slug and full_scan_id.

vulnerability_idsstring required

Comma-separated list of GHSA or CVE IDs, or "*" for all vulnerabilities

allow_major_updatesboolean required

Whether to allow major version updates in fixes

minimum_release_agestring

Minimum release age for fixes packages (e.g., "1h", "2d", "1w"). Higher values reduces risk of installing recently released untested package versions. Applies to the ecosystems in minimum_release_age_ecosystems, or to every ecosystem when that is unset.

minimum_release_age_ecosystemsstring

Comma-separated PURL types (e.g. "npm" or "npm,pypi") that minimum_release_age applies to. Packages of other ecosystems get fixes regardless of release age. Defaults to every ecosystem.

minimum_release_age_excludestring

Comma-separated npm packages exempt from minimum_release_age, in the format of pnpm's minimumReleaseAgeExclude setting: an exact name ("lodash", "@myorg/pkg"), a name pattern with * ("@myorg/*"), or a name with exact versions joined by || ("webpack@4.47.0 || 5.102.1") to exempt only those versions. As in pnpm, the first entry matching a package decides. Only applies to npm packages.

override_targetsstring

Comma-separated npm package names that an npm overrides, pnpm overrides or yarn resolutions entry in the project targets. Such an entry forces one version of the package everywhere, so a fix only installs a second copy of a package next to the first when this list is sent and does not name it. Send it empty when the project has no such entries.

allow_overridesboolean

Set when the client writes an npm override, pnpm override or yarn resolution for a fix that needs one. The fix search may then fix an npm package whose parent declares a range that rejects every safe version: the fix lists that parent in overrides, and the client forces fixedVersion under it. Off by default, so a client that cannot write overrides never gets such a fix.

include_detailsboolean

Whether to include advisory details in the response

include_responsible_direct_dependenciesboolean

Set to include the direct dependencies responsible for introducing the dependency or dependencies with the vulnerability in the response

include_all_detected_ghsasboolean

Set to include an allDetectedGhsas field listing every GHSA detected in the project, regardless of the vulnerability_ids filter. Useful for CLI clients that request a specific GHSA and want to show the user which GHSAs actually exist when the request has no overlap.

include_stateful_alert_idsboolean

Set to include a statefulAlertIds map (GHSA ID → array of open stateful alert IDs detected in this organization) in the response. Lets callers correlate /fixes results back to the alert IDs surfaced by /v0/orgs/{org_slug}/alerts. Org-scoped only — multiple alerts across repos/branches may share a GHSA. Off by default to avoid an extra ClickHouse round-trip.

autofix_run_idstring

The id of an autofix-or-upgrade-cli-run record (created via /fixes/register-autofix-or-upgrade-cli-run) to associate this computation with. When set, the server records per-GHSA fix-computation telemetry into autofix_compute_vulnerability and updates the run's autofix_run row, mirroring the legacy /v0/fixes/compute-fixes endpoint. The caller must own the run's organization; foreign-org or unknown ids return 404.

Response

The fix computation was enqueued (or an identical in-flight computation was joined)

idstring required
status'pending' | 'running' | 'succeeded' | 'failed' required

Lifecycle state of the fix computation

Changes