---
title: "List Org Alert Triage"
method: GET
path: "/orgs/{org_slug}/triage/alerts"
tags: ["triage"]
---

# List Org Alert Triage

`GET /orgs/{org_slug}/triage/alerts`

List triage actions for an organization. Results are paginated and can be sorted by created_at or updated_at.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- triage:alerts-list

## Path parameters

- `org_slug` string, required

## Query parameters

- `sort` string
- `direction` string
- `per_page` integer
- `page` integer

## Response `200`

Lists triage actions for the specified organization.

- object
  - `results` object[], required
    - `uuid` string, nullable — The uuid of the triage action
    - `package_type` string, nullable — The package type associated with the triage state
    - `package_namespace` string, nullable — The package namespace associated with the triage state
    - `package_name` string, nullable — The package name associated with the triage state
    - `package_version` string, nullable — The package version associated with the triage state, it can contain a * suffix for wildcard matching
    - `alert_key` string, nullable — The alert_key associated with the triage state
    - `alert_type` string, nullable — The alert type (e.g., criticalCVE, highCVE) associated with the triage state
    - `fix_available` 'available' | 'unavailable' | '*', nullable — Whether a fix must be available, unavailable, or * for any
    - `patch_available` 'available' | 'unavailable' | '*', nullable — Whether a patch must be available, unavailable, or * for any
    - `cvss_score_cmp` string, nullable — CVSS score comparison (e.g., >=7.5, >5.0, ==8.0)
    - `created_at` string — The creation date of the triage action
    - `updated_at` string — The last update date of the triage action
    - `note` string — The note associated with the triage action
    - `organization_id` string — The organization id associated with the triage action
    - `state` 'block' | 'ignore' | 'inherit' | 'monitor' | 'warn' — The triage state of the alert
    - `cve_or_ghsa_id` string, nullable — CVE or GHSA ID associated with the triage state
    - `reachability` 'reachable' | 'unreachable' | 'other' | '*', nullable — The reachability of the alert, can be reachable, unreachable, other, or * for any
    - `kevs` 'exist' | 'none' | '*', nullable — Whether the alert has a CISA KEV (Known Exploited Vulnerability), can be exist, none, or * for any
  - `nextPage` integer, nullable, required

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)