--- title: "List historical alerts (Beta)" method: GET path: "/orgs/{org_slug}/historical/alerts" tags: ["alerts"] --- # List historical alerts (Beta) `GET /orgs/{org_slug}/historical/alerts` List historical alerts. Pagination: keep requesting pages (passing the previous response's `endCursor` as `startAfterCursor`) until `endCursor` is `null`. Do not stop when `items` is empty — an empty page can be returned while more results still remain on later pages, so `endCursor` being `null` is the only reliable end-of-results signal. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - historical:alerts-list ## Path parameters - `org_slug` string, required ## Query parameters - `date` string - `range` string - `per_page` integer - `startAfterCursor` string - `filters.alertAction` string - `filters.alertAction.notIn` string - `filters.alertActionSourceType` string - `filters.alertActionSourceType.notIn` string - `filters.alertCategory` string - `filters.alertCategory.notIn` string - `filters.alertCveId` string - `filters.alertCveId.notIn` string - `filters.alertCveTitle` string - `filters.alertCveTitle.notIn` string - `filters.alertCweId` string - `filters.alertCweId.notIn` string - `filters.alertCweName` string - `filters.alertCweName.notIn` string - `filters.alertEPSS` string - `filters.alertEPSS.notIn` string - `filters.alertFixType` string - `filters.alertFixType.notIn` string - `filters.alertKEV` boolean - `filters.alertKEV.notIn` boolean - `filters.alertPriority` string - `filters.alertPriority.notIn` string - `filters.alertReachabilityAnalysisType` string - `filters.alertReachabilityAnalysisType.notIn` string - `filters.alertReachabilityType` string - `filters.alertReachabilityType.notIn` string - `filters.alertSeverity` string - `filters.alertSeverity.notIn` string - `filters.alertType` string - `filters.alertType.notIn` string - `filters.artifactName` string - `filters.artifactName.notIn` string - `filters.artifactType` string - `filters.artifactType.notIn` string - `filters.branch` string - `filters.branch.notIn` string - `filters.cvePatchStatus` string - `filters.cvePatchStatus.notIn` string - `filters.dependencyDead` boolean - `filters.dependencyDead.notIn` boolean - `filters.dependencyDev` boolean - `filters.dependencyDev.notIn` boolean - `filters.dependencyDirect` boolean - `filters.dependencyDirect.notIn` boolean - `filters.repoFullName` string - `filters.repoFullName.notIn` string - `filters.repoLabels` string - `filters.repoLabels.notIn` string - `filters.repoSlug` string - `filters.repoSlug.notIn` string ## Response `200` The paginated array of API tokens for the organization, and related metadata. - object - `endCursor` string, nullable, required - `items` object[], required - `repoFullName` string, required - `repoId` string, nullable, required - `repoSlug` string, required - `repoLabels` string[], required - `repoLabelIds` string[], required - `branch` string, required - `defaultBranch` boolean, required - `fullScanId` string, required - `scannedAt` string, required - `artifact` object, required - `id` string, nullable, required - `license` string, nullable, required - `name` string, required - `namespace` string, nullable, required - `type` string, required - `version` string, required - `artifact_id` string - `artifactId` string - `author` string - `capabilities` Capabilities - `env` boolean, required — Package can read or modify environment variables - `eval` boolean, required — Package uses dynamic code evaluation (eval, Function constructor, etc.) - `fs` boolean, required — Package can read or write to the file system - `net` boolean, required — Package can make network requests or create servers - `shell` boolean, required — Package can execute shell commands or spawn processes - `unsafe` boolean, required — Package uses unsafe or dangerous operations that could compromise security - `url` boolean, required — Package contains remote URL(s) in the source code - `qualifiers` unknown - `scores` SocketScore - `license` number, required — Score from 0.0 to 1.0 evaluating license permissiveness and compatibility - `maintenance` number, required — Score from 0.0 to 1.0 evaluating project maintenance health and activity - `overall` number, required — Combined score from 0.0 to 1.0 representing overall package health and safety - `quality` number, required — Score from 0.0 to 1.0 evaluating code quality, testing, and documentation - `supplyChain` number, required — Score from 0.0 to 1.0 evaluating supply chain security and provenance - `vulnerability` number, required — Score from 0.0 to 1.0 based on known vulnerabilities and their severity - `size` integer - `subpath` string - `alert` object, required - `key` string, required - `type` string, required - `severity` integer, required - `severityName` string, required - `action` string, required - `category` string, required - `file` string, nullable - `props` object, nullable — Additional alert-specific properties and metadata that vary by alert type. For vulnerability alerts this includes the `cveId` and `ghsaId` identifiers, either of which may be an empty string when GitHub has not assigned that identifier to the advisory. - `start` integer, nullable - `end` integer, nullable - `fix` object, nullable - `type` string, required - `description` string, required - `dependency` object, required - `direct` boolean, required - `dev` boolean, required - `dead` boolean, required - `manifestFiles` SocketManifestReference[] - `file` string, required — Path to the manifest file (e.g., package.json, pom.xml) - `start` integer — Starting line or position in the manifest file - `end` integer — Ending line or position in the manifest file - `topLevelAncestors` SocketId[] - `dependencies` SocketId[] - `meta` object, required - `organizationId` string, required - `queryStartTimestamp` number, required - `startDateInclusive` string, required - `endDateInclusive` string, required - `includeLatestAlertsOnly` boolean, required - `filters` object, required - `alertAction` string[] — Comma-separated list of alert actions ("error", "warn", "monitor", or "ignore) that should be included - `alertAction.notIn` string[] — Comma-separated list of alert actions ("error", "warn", "monitor", or "ignore) that should be excluded - `alertActionSourceType` string[] — Comma-separated list of alert action source types ("resolution", "alert-policy", "fallback", "injected-alert", "org-policy", "reachability", "repo-label-policy", "socket-yml", or "triage") that should be included - `alertActionSourceType.notIn` string[] — Comma-separated list of alert action source types ("resolution", "alert-policy", "fallback", "injected-alert", "org-policy", "reachability", "repo-label-policy", "socket-yml", or "triage") that should be excluded - `alertCategory` string[] — Comma-separated list of alert categories ("supplyChainRisk", "maintenance", "quality", "license", or "vulnerability") that should be included - `alertCategory.notIn` string[] — Comma-separated list of alert categories ("supplyChainRisk", "maintenance", "quality", "license", or "vulnerability") that should be excluded - `alertCveId` string[] — CVE ID - `alertCveId.notIn` string[] — CVE ID - `alertCveTitle` string[] — CVE title - `alertCveTitle.notIn` string[] — CVE title - `alertCweId` string[] — CWE ID - `alertCweId.notIn` string[] — CWE ID - `alertCweName` string[] — CWE name - `alertCweName.notIn` string[] — CWE name - `alertEPSS` string[] — Alert EPSS ("low", "medium", "high", "critical") - `alertEPSS.notIn` string[] — Alert EPSS ("low", "medium", "high", "critical") - `alertFixType` string[] — Comma-separated list of alert fix types ("upgrade", "cve", or "remove") that should be included - `alertFixType.notIn` string[] — Comma-separated list of alert fix types ("upgrade", "cve", or "remove") that should be excluded - `alertKEV` boolean[] — Alert KEV (Known Exploited Vulnerability) filter flag - `alertPriority` string[] — Alert priority ("low", "medium", "high", or "critical") - `alertPriority.notIn` string[] — Alert priority ("low", "medium", "high", or "critical") - `alertReachabilityAnalysisType` string[] — Comma-separated list of alert CVE reachability analysis types ("full-scan" or "precomputed") that should be included - `alertReachabilityAnalysisType.notIn` string[] — Comma-separated list of alert CVE reachability analysis types ("full-scan" or "precomputed") that should be excluded - `alertReachabilityType` string[] — Comma-separated list of alert CVE reachability types ("direct_dependency", "error", "maybe_reachable", "missing_support", "pending", "reachable", "undeterminable_reachability", "unknown", or "unreachable") that should be included - `alertReachabilityType.notIn` string[] — Comma-separated list of alert CVE reachability types ("direct_dependency", "error", "maybe_reachable", "missing_support", "pending", "reachable", "undeterminable_reachability", "unknown", or "unreachable") that should be excluded - `alertSeverity` string[] — Comma-separated list of alert severities ("low", "medium", "high", or "critical") that should be included - `alertSeverity.notIn` string[] — Comma-separated list of alert severities ("low", "medium", "high", or "critical") that should be excluded - `alertType` string[] — Comma-separated list of alert types (e.g. "usesEval", "unmaintained", etc.) that should be included - `alertType.notIn` string[] — Comma-separated list of alert types (e.g. "usesEval", "unmaintained", etc.) that should be excluded - `artifactName` string[] — Name of artifact - `artifactName.notIn` string[] — Name of artifact - `artifactType` string[] — Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be included - `artifactType.notIn` string[] — Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be excluded - `branch` string[] — Comma-separated list of branch names that should be included - `branch.notIn` string[] — Comma-separated list of branch names that should be excluded - `cvePatchStatus` string[] — Comma-separated list of patch statuses ("patch_unavailable", "patch_available", or "patch_applied") that should be included - `cvePatchStatus.notIn` string[] — Comma-separated list of patch statuses ("patch_unavailable", "patch_available", or "patch_applied") that should be excluded - `dependencyDead` boolean[] — Dead/reachable dependency filter flag - `dependencyDev` boolean[] — Development/production dependency filter flag - `dependencyDirect` boolean[] — Direct/transitive dependency filter flag - `repoFullName` string[] — Comma-separated list of repo full names that should be included - `repoFullName.notIn` string[] — Comma-separated list of repo full names that should be excluded - `repoLabels` string[] — Comma-separated list of repo labels that should be included. Use "" to filter for repositories with no labels. - `repoLabels.notIn` string[] — Comma-separated list of repo labels that should be excluded. Use "" to filter for repositories with no labels. - `repoSlug` string[] — Comma-separated list of repo slugs that should be included - `repoSlug.notIn` string[] — Comma-separated list of repo slugs that should be excluded ## Other responses - `400` — Bad request - `401` — Unauthorized - `403` — Insufficient max_quota for API method - `404` — Resource not found - `429` — Insufficient quota for API route --- [API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)