SOsocket-dev
threat-feed

Get Threat Feed Items (Beta)

Changed on

Paginated list of threats, sorted by updated_at by default. Set updated_after to the unix timestamp of your last sync while sorting by updated_at to synchronize all new or updated threats in the feed.

This endpoint requires an Enterprise Plan with Threat Feed add-on. Contact our sales team for more details.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:

  • threat-feed:list
get/orgs/{org_slug}/threat-feed

Request

  • Base URL
    https://api.socket.dev/v0
  • URL
    https://api.socket.dev/v0/orgs/{org_slug}/threat-feed
  • Auth
    • HTTP bearer
    • or HTTP basic

Path parameters

org_slugstring required

The slug of the organization

Query parameters

per_pageinteger

Number of threats per page

startAfterCursorstring

Pass the previous response endCursor to retrieve the next page. Takes precedence over page_cursor when both are supplied. Unsupported cursor aliases return 400; unrelated query parameters are unchanged.

page_cursorstring

Deprecated alias for startAfterCursor. Existing nextPageCursor values remain accepted.

sort'id' | 'created_at' | 'updated_at'

Set the sort order for the threat feed items. Default is descending order by updated_at, which includes all new and updated threat feed items.

updated_afterstring

A Unix timestamp in seconds that filters results to items only updated after the timestamp.

created_afterstring

A Unix timestamp in seconds that filters results to items only created after the date.

direction'desc' | 'asc'

Order direction of the provided sort field.

filter'u' | 'c' | 'fp' | 'tp' | 'mal' | 'vuln' | 'anom' | 'joke' | 'spy' | 'typo' | 'obf' | 'dual'

Filter by threat classification. Supported values: mal (malware, including possible malware), vuln (vulnerability), typo (typosquat, including possible typosquat), anom (anomaly), spy (telemetry), obf (obfuscated code), dual (dual-use tool), joke (protestware or joke package), tp (all confirmed true positives), fp (false positive), u (unreviewed), c (classified, i.e. anything except unreviewed).

namestring

Filter threats by package name

versionstring

Filter threats by package version.

is_human_reviewedboolean

Only return threats which have been human-reviewed

ecosystem'github' | 'cargo' | 'composer' | 'chrome' | 'firefox-extension' | 'edge-extension' | 'golang' | 'huggingface' | 'maven' | 'npm' | 'nuget' | 'vscode' | 'vscode-extension' | 'pypi' | 'gem' | 'swift'

Filter threats by package ecosystem.

Response

The paginated list of items in the threat feed and the next page cursor.

endCursorstring nullable required
nextPageCursorstring nullable required

Deprecated alias for endCursor.

Changes

  • 5ad8bf36b1e7Revision changes
    • breaking

      removed the enum value clawhub from the query request parameter ecosystem

    • info

      added the new optional query request parameter startAfterCursor

    • info

      query request parameter page_cursor was deprecated

    • info

      added the new enum value edge-extension to the query request parameter ecosystem

    • info

      added the new enum value firefox-extension to the query request parameter ecosystem

    • info

      added the new enum value vscode-extension to the query request parameter ecosystem

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      response property nextPageCursor deprecated

    • info

      added the required property to the response with the status