Alert Policy Migration Status

GET /v0/orgs/{org_slug}/alert-policies/migration/status returns where your organization is in the migration to Policies. It tells you when policy and rule writes start working, when the legacy writes stop, and which configuration is deciding your alerts right now.

The endpoint is read-only. Calling it never enrolls your organization in the migration and never starts the migration window.

Request

curl -u "$SOCKET_API_TOKEN:" \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/status

The token needs the alert-policy:list scope and organization-wide repository access. A repository-restricted token gets 403. Each call uses 1 unit of quota.

Response

An organization the migration has not reached yet:

{
  "state": null,
  "finalized_at": null,
  "deadline_at": null,
  "window_end_at": null,
  "deadline_admin_paused_at": null,
  "alert_policies_enabled": false,
  "legacy_evaluation_enabled": true
}

An organization that confirmed the migration partway through its window:

{
  "state": "accepted",
  "finalized_at": "2026-06-15T00:00:00.000Z",
  "deadline_at": "2026-07-01T00:00:00.000Z",
  "window_end_at": "2026-07-01T00:00:00.000Z",
  "deadline_admin_paused_at": null,
  "alert_policies_enabled": true,
  "legacy_evaluation_enabled": false
}

All timestamps are ISO-8601 and null when they do not apply.

Field	Meaning
`state`	`null`, `pending`, `previewing`, `accepted`, or `auto_finalized`. See the state table below.
`finalized_at`	When the migration was finalized, either because you confirmed it or because Socket auto-finalized it.
`deadline_at`	When Socket finalizes the migration automatically if you have not confirmed.
`window_end_at`	End of the organization's 30-day migration window.
`deadline_admin_paused_at`	When Socket paused the auto-finalization deadline.
`alert_policies_enabled`	Whether Policies decides alert actions for the organization right now.
`legacy_evaluation_enabled`	Whether the legacy Security Policy and Alert Triage Rules still decide alert actions.

States

`state`	What it means
`null`	The migration is not enabled for your organization yet. Organizations created after Policies launched also return `null`; they have nothing to migrate.
`pending`	The migration is enabled and the preview is being prepared.
`previewing`	The preview is ready in the dashboard. You can confirm the migration.
`accepted`	The migration was confirmed. Policy and rule writes work; legacy security-policy and triage writes return `409`.
`auto_finalized`	The window ended and Socket finalized the migration automatically. Writes behave the same as `accepted`.

Which Configuration Decides Your Alerts

state says where you are in the migration. The two booleans say which configuration actually decides alert actions right now:

Situation	`alert_policies_enabled`	`legacy_evaluation_enabled`
Migration not enabled, or still `pending` / `previewing`	`false`	`true`
`accepted` or `auto_finalized`	`true`	`false`
Organization created after Policies launched	`true`	`false`

Switching Scripts on the Response

While state is null, pending, or previewing: policy and rule writes return 409. Dry-run them instead. You can create alert resolutions at any time.
When state becomes accepted or auto_finalized: send the policy and rule requests without dry_run, and move your scripts off the legacy security-policy and triage endpoints. Those writes now return 409.
deadline_at and window_end_at tell you how long you have before Socket finalizes the migration for you.

Errors: 401 without a token, 403 without the alert-policy:list scope or with a repository-restricted token, 404 for an unknown organization.

Updating API Integrations — when to switch your scripts, and which endpoints replace which.
Translating Alert Triage Payloads — convert a POST /triage/alerts body into the new requests.
Dry-Run Policy and Resolution Writes — try a policy or rule write before you confirm the migration.
Migrating to Policies — what changes and how the migration works.
Policies — the configuration that takes over after the cutover.

Request

Response

States

Which Configuration Decides Your Alerts

Switching Scripts on the Response

Related Pages