---
title: "Create/Update Org Alert Triage"
method: POST
path: "/orgs/{org_slug}/triage/alerts"
tags: ["triage"]
---

# Create/Update Org Alert Triage

`POST /orgs/{org_slug}/triage/alerts`

Create or update triage actions on organization alerts. Accepts a batch of triage entries. Omit `uuid` to create a new entry; provide an existing `uuid` to update it. Use `?force=true` for broad triages that lack a specific `alertKey` or granular package information.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- triage:alerts-update

## Path parameters

- `org_slug` string, required

## Query parameters

- `force` string

## Request body

- object
  - `alertTriage` object[], required
    - `uuid` string, nullable — The UUID of the triage entry. Omit to create a new entry; provide to update an existing one.
    - `packageType` string, nullable — The package ecosystem type (e.g., npm, pypi). Use null or "*" for wildcard.
    - `packageNamespace` string, nullable — The package namespace or scope. Use null or "*" for wildcard.
    - `packageName` string, nullable — The package name. Use null or "*" for wildcard.
    - `packageVersion` string, nullable — The package version. Supports a "*" suffix for wildcard prefix matching. Use null for any version.
    - `alertKey` string, nullable — The specific alert key to target.
    - `alertType` string, nullable — The alert type (e.g., criticalCVE, highCVE).
    - `fixAvailable` 'available' | 'unavailable' | '*' — Whether a fix is available, unavailable, or * for any
    - `patchAvailable` 'available' | 'unavailable' | '*' — Whether a patch is available, unavailable, or * for any
    - `kevs` 'exist' | 'none' | '*' — Whether the alert has a CISA KEV, can be exist, none, or * for any
    - `cveOrGhsaId` string, nullable — CVE or GHSA ID to match against.
    - `reachability` 'reachable' | 'unreachable' | 'other' | '*' — The reachability of the alert, can be reachable, unreachable, other, or * for any
    - `cvssScoreCmp` string, nullable — CVSS score comparison operator and value (e.g., >=7.5, >5.0, ==8.0).
    - `note` string — A note or comment for the triage action.
    - `state` 'block' | 'ignore' | 'inherit' | 'monitor' | 'warn' — The triage state of the alert

## Response `200`

Updated Alert Triage

- object
  - `result` string, required

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `409` — Resource already exists
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)