---
title: "Start fix computation"
method: POST
path: "/orgs/{org_slug}/fixes/computations"
tags: ["fixes"]
---

# Start fix computation

`POST /orgs/{org_slug}/fixes/computations`

## Request

- Base URL: `https://api.socket.dev/v0`
- URL: `https://api.socket.dev/v0/orgs/{org_slug}/fixes/computations`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Starts computing fixes for vulnerabilities in a repository, scan, or uploaded manifest, and returns a computation id right away. Poll [Get fix computation](https://docs.socket.dev/reference/get-fix-computation) with that id until the status is `succeeded` or `failed` to get the result.

Requires exactly one of repo_slug, full_scan_id, or tar_hash, as well as vulnerability_ids to be provided.
vulnerability_ids can be a comma-separated list of GHSA or CVE IDs, or "*" for all vulnerabilities.

The computation runs in the background, so large or never-before-seen projects cannot time out the request, and a dropped connection does not cancel the work.

While a computation with the same parameters is still pending or running for your organization, this endpoint returns that computation's id instead of starting a new one. Once a computation has finished, a new request starts a fresh computation.

An organization can have at most 10 computations pending or running at once. A request that would start another one gets a `429` response. Retry once one of the active computations has finished.

This endpoint consumes 10 units of your quota.

This endpoint requires the following org token scopes:
- fixes:list

## Path parameters

- `org_slug` string, required

## Query parameters

- `repo_slug` string
- `full_scan_id` string
- `tar_hash` string
- `vulnerability_ids` string, required
- `allow_major_updates` boolean, required
- `minimum_release_age` string
- `minimum_release_age_ecosystems` string
- `minimum_release_age_exclude` string
- `override_targets` string
- `allow_overrides` boolean
- `include_details` boolean
- `include_responsible_direct_dependencies` boolean
- `include_all_detected_ghsas` boolean
- `include_stateful_alert_ids` boolean
- `autofix_run_id` string

## Response `202`

The fix computation was enqueued (or an identical in-flight computation was joined)

- object
  - `id` string, required
  - `status` 'pending' | 'running' | 'succeeded' | 'failed', required: Lifecycle state of the fix computation

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Insufficient max_quota for API method
- `404`: Resource not found
- `429`: Insufficient quota for API route

## Changes

- **2026-11-03** `5ad8bf36b1e7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/socket-dev/apis/socket/changes/orgs/:org_slug/fixes/computations/post.md)

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket/revisions/5ad8bf36b1e7?raw)