# Socket Documentation > Socket is a developer-first security platform that protects your most critical apps from software supply chain attacks. Socket was built by prolific security experts whose open source software is installed over 1 billion times per month. Customers include top organizations in tech, media, manufacturing, and finance. ## Documentation: Introduction - [Getting started](https://docs.socket.dev/docs/getting-started.md) - [FAQ](https://docs.socket.dev/docs/faq.md): Frequently Asked Questions ## Documentation: Socket Alerts - [Alert Types](https://docs.socket.dev/docs/alert-types.md) - [Alert Categories](https://docs.socket.dev/docs/package-issues.md): How package issues are categorized by Socket - [Vulnerability](https://docs.socket.dev/docs/vulnerability.md) - [Supply Chain Risk](https://docs.socket.dev/docs/supply-chain-risk.md) - [Quality](https://docs.socket.dev/docs/quality.md) - [Maintenance](https://docs.socket.dev/docs/maintenance.md) - [License](https://docs.socket.dev/docs/license.md) - [Ecosystem Support](https://docs.socket.dev/docs/language-support.md): Languages ecosystems, programming languages, package managers, and features that Socket supports. - [Scala setup instructions](https://docs.socket.dev/docs/scala-setup-instructions.md) - [Kotlin setup instructions](https://docs.socket.dev/docs/kotlin-setup-instructions.md) - [Gradle setup instructions (for Java, Kotlin, and Scala)](https://docs.socket.dev/docs/gradle-setup-instructions-for-java-kotlin-and-scala.md) - [Anaconda setup instructions](https://docs.socket.dev/docs/anaconda-setup-instructions.md): Generating a `requirements.txt` from a Conda Environment for Socket Scanning - [Reachability Analysis](https://docs.socket.dev/docs/reachability-analysis.md): Socket SCA with Reachability Analysis allows you to safely disregard unreachable vulnerabilities and easily patch the ones that matter. - [Dependency Reachability](https://docs.socket.dev/docs/dependency-reachability.md): Dependency Reachability filters out unreachable alerts by constructing a dependency graph. - [Precomputed Reachability](https://docs.socket.dev/docs/precomputed-reachability.md): Precomputed reachability enhances dependency reachability by filtering out CVEs that affect functions never called within transitive dependencies. - [Full Application Reachability](https://docs.socket.dev/docs/full-application-reachability.md): Full application Reachability enhances the precomputed reachability by filtering out CVEs that affect functions never called in both the application source code and the dependency code. - [Static Reachability Analysis](https://docs.socket.dev/docs/static-reachability-analysis.md): Socket’s reachability analysis is based on static analysis of both your application’s source code and its dependencies. - [Phantom Dependencies](https://docs.socket.dev/docs/phantom-dependencies.md): Phantom dependencies are dependencies that are used in your code but are not explicitly declared in your manifest file (e.g., package.json, go.mod, etc.). - [Reachability Results](https://docs.socket.dev/docs/reachability-results.md): Result categories for precomputed and full application reachability analyses - [Reachability Analysis Changelog](https://docs.socket.dev/docs/reachability-analysis-changelog.md): Changes to the Coana analysis engine that powers Socket's reachability analysis. - [Alert Actions](https://docs.socket.dev/docs/security-policy-defaults.md) - [Alert Purpose Definitions](https://docs.socket.dev/docs/alert-purpose-definitions.md) - [Alert Actions and Triage Functionality](https://docs.socket.dev/docs/alert-actions-and-triage-functionality.md) - [Package Scores](https://docs.socket.dev/docs/package-scores.md) - [Manifest File Detection](https://docs.socket.dev/docs/manifest-file-detection-in-socket.md) ## Documentation: Socket Dashboard - [Organization Alerts](https://docs.socket.dev/docs/organization-alerts.md) - [Policies](https://docs.socket.dev/docs/policies.md) - [Rule Conditions](https://docs.socket.dev/docs/rule-conditions.md) - [Baseline Presets](https://docs.socket.dev/docs/baseline-presets.md) - [Resolve Alerts](https://docs.socket.dev/docs/alert-resolutions.md) - [Migrating to Policies](https://docs.socket.dev/docs/migrating-to-policies.md) - [Updating API Integrations](https://docs.socket.dev/docs/updating-api-integrations.md) - [Security Policy API](https://docs.socket.dev/docs/security-policy-api.md) - [Alert Triage API](https://docs.socket.dev/docs/alert-triage-api.md) - [Translating Alert Triage Payloads](https://docs.socket.dev/docs/translating-triage-payloads.md) - [Dry-Run Policy and Resolution Writes](https://docs.socket.dev/docs/dry-run-writes.md) - [Alert Policy Migration Status](https://docs.socket.dev/docs/alert-policy-migration-status.md) - [Dependency Search](https://docs.socket.dev/docs/dependency-search.md) - [Repositories](https://docs.socket.dev/docs/repositories-1.md) - [Scans](https://docs.socket.dev/docs/scans.md) - [Cool-down policy (recently published packages)](https://docs.socket.dev/docs/cool-down-policy.md) - [Security Policy (Default Enabled Alerts)](https://docs.socket.dev/docs/security-policy-default-enabled-alerts.md): These are the default set of Enabled Alerts - [Customizable Security Policies](https://docs.socket.dev/docs/enabled-issues.md) - [License Policy](https://docs.socket.dev/docs/license-policy.md) - [Threat Feed](https://docs.socket.dev/docs/threat-feed.md) - [Package Search](https://docs.socket.dev/docs/package-search.md) - [Users](https://docs.socket.dev/docs/users.md) - Settings - [API Tokens](https://docs.socket.dev/docs/api-keys.md) - [Billing](https://docs.socket.dev/docs/billing.md) - [Audit Log](https://docs.socket.dev/docs/audit-log.md) - [Integrations](https://docs.socket.dev/docs/integrations.md) ## Documentation: Integrations - [SCIM](https://docs.socket.dev/docs/scim.md): SCIM, or System for Cross-domain Identity Management allows for the automation of user provisioning for your Socket organization. - [SSO (Single Sign-On)](https://docs.socket.dev/docs/single-sign-on.md): Integrate Single Sign-On (SSO) with Socket to streamline login processes, enhance security, and simplify user management, now available for Business and Enterprise plans customers with support for… - [Slack alerts](https://docs.socket.dev/docs/slack-alerts.md): Receive pull request alerts in your Slack server - [Vanta integration](https://docs.socket.dev/docs/vanta-integration.md): This guide explains how to integrate Socket with Vanta to enhance your organization’s security and compliance efforts. - [Webhooks](https://docs.socket.dev/docs/webhooks.md): How to setup and configure webhooks. - [Notifications](https://docs.socket.dev/docs/notifications.md): Route organization alerts and supply chain attack campaigns to email, Slack, and Microsoft Teams. - [Jira Integration](https://docs.socket.dev/docs/jira-integration.md): Connect your Jira Cloud instance to Socket to create and manage tickets from alerts, with manual creation and automated ticketing rules. - [Linear Integration](https://docs.socket.dev/docs/linear-integration.md): Connect your Linear workspace to Socket to create and manage Linear issues from alerts, with manual creation and automated ticketing rules. - [ClickUp Integration](https://docs.socket.dev/docs/clickup-integration.md): Connect your ClickUp Workspace to Socket to create and manage ClickUp tasks from alerts, with manual creation and automated ticketing rules. - [Asana Integration](https://docs.socket.dev/docs/asana-integration.md): Connect your Asana workspace to Socket to create and manage Asana tasks from alerts, with manual creation and automated ticketing rules. ## Documentation: Socket for GitHub - [Guide to Socket for GitHub](https://docs.socket.dev/docs/socket-for-github.md) - [Install the App](https://docs.socket.dev/docs/socket-for-github-installation.md) - [Ignoring pull request alerts](https://docs.socket.dev/docs/ignoring-pull-request-alerts.md): Bot commands for the GitHub App - [socket.yml](https://docs.socket.dev/docs/socket-yml.md): Optional Socket GitHub App configuration file - [What to do when you receive an alert](https://docs.socket.dev/docs/what-to-do-with-socket-alerts.md): What should a developer do when they receive a Socket Alert on their pull request? - [GitHub App Permissions](https://docs.socket.dev/docs/permissions.md): What permissions does Socket for GitHub require? - [Enable branch protection](https://docs.socket.dev/docs/enable-branch-protection.md): How to enable branch protection to make Socket a required GitHub check. - [Understanding "Act on Your Behalf" Permission](https://docs.socket.dev/docs/understanding-act-on-your-behalf-permission.md) ## Documentation: CI-CD Integrations - [Socket for GitHub Actions](https://docs.socket.dev/docs/socket-for-github-actions.md) - [Socket for Gitlab Pipeline](https://docs.socket.dev/docs/socket-in-your-gitlab-pipeline.md) - [Socket for Bitbucket Pipeline](https://docs.socket.dev/docs/socket-in-your-bitbucket-pipeline.md) - [Socket for Jenkins Jobs](https://docs.socket.dev/docs/socket-for-jenkins-jobs.md) - [Socket for Azure DevOps](https://docs.socket.dev/docs/socket-for-azure-devops-1.md) - [Socket for Azure DevOps (Yaml)](https://docs.socket.dev/docs/socket-for-azure-devops-yaml.md) - [Socket for Azure DevOps (ADO Classic)](https://docs.socket.dev/docs/socket-for-azure-devops.md) - [Create Variable Group for ADO](https://docs.socket.dev/docs/create-variable-group-key-for-azure-devops.md) - [Create Socket API Key for CI/CD](https://docs.socket.dev/docs/create-socket-api-key-for-cicd.md) ## Documentation: Socket CLI - [Guide to Socket CLI](https://docs.socket.dev/docs/socket-cli.md): Introduction to Socket CLI - [v1 Migration guide](https://docs.socket.dev/docs/v1-migration-guide.md) - [Socket CLI Commands](https://docs.socket.dev/docs/test.md) - [socket analytics](https://docs.socket.dev/docs/socket-analytics.md): Get analytics data at the organization and repository level - [socket audit-log](https://docs.socket.dev/docs/socket-audit-log.md): Look up the audit log for an organization - [socket ci](https://docs.socket.dev/docs/socket-ci.md): Get feedback on state of the code health in an automated environment - [socket config](https://docs.socket.dev/docs/socket-config.md): Manage Socket CLI configuration - [socket install / uninstall](https://docs.socket.dev/docs/socket-install-uninstall.md): Install or uninstall Socket CLI tab completion - [socket login](https://docs.socket.dev/docs/socket-login.md): Socket API login - [socket logout](https://docs.socket.dev/docs/socket-logout.md): Socket API logout - [socket manifest](https://docs.socket.dev/docs/socket-manifest.md): Generate local manifests for certain languages - [socket manifest cdxgen](https://docs.socket.dev/docs/socket-cdxgen.md): Generate an SBOM of target directory using CycloneDX - [socket npm & socket npx](https://docs.socket.dev/docs/socket-npm-socket-npx.md): System global package manager integration for npm - [socket organization](https://docs.socket.dev/docs/socket-organizations.md): List organizations associated with the API key used - [socket optimize](https://docs.socket.dev/docs/socket-optimize.md): Optimize dependencies with @socketregistry overrides - [socket package](https://docs.socket.dev/docs/socket-package.md): Get score and other details on software packages - [socket raw-npm](https://docs.socket.dev/docs/socket-raw-npm.md): Run npm without the Socket wrapper - [socket raw-npx](https://docs.socket.dev/docs/socket-raw-npx.md): Run npx without the Socket wrapper - [socket repository](https://docs.socket.dev/docs/socket-repo.md): Repositories related commands - [socket scan](https://docs.socket.dev/docs/socket-scan.md): Scans related commands - [socket scan github](https://docs.socket.dev/docs/socket-scan-github.md): Additional options to create Socket scans for Github repos - [socket threat-feed](https://docs.socket.dev/docs/socket-threat-feed.md): Look up the Socket threat feed - [socket wrapper](https://docs.socket.dev/docs/socket-wrapper.md): Enable or disable the Socket npm/npx wrapper - [socket fix](https://docs.socket.dev/docs/socket-fix.md): Update dependencies with fixable Socket alerts - [Socket CLI FAQ](https://docs.socket.dev/docs/socket-cli-faq.md) - [safe-npm FAQ](https://docs.socket.dev/docs/safe-npm-faq.md): Start protecting your NPM usage today! - [Supported Node.js Versions](https://docs.socket.dev/docs/cli-support.md) - [socket.json](https://docs.socket.dev/docs/socketjson.md): A file containing local project settings to be used by the CLI ## Documentation: Socket MCP - [Guide to Socket MCP](https://docs.socket.dev/docs/guide-to-socket-mcp.md) - [Remote Socket MCP](https://docs.socket.dev/docs/remote-socket-mcp.md) - [Local Socket MCP](https://docs.socket.dev/docs/local-socket-mcp.md) - [Socket MCP for Claude Desktop](https://docs.socket.dev/docs/socket-mcp-for-claude-desktop.md) ## Documentation: Socket Firewall - [Socket Firewall Overview](https://docs.socket.dev/docs/socket-firewall-overview.md) - [Socket Firewall Free](https://docs.socket.dev/docs/socket-firewall-free.md) - [Socket Firewall Enterprise](https://docs.socket.dev/docs/socket-firewall-enterprise.md) - [Registry Mode](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode.md): Registry Mode Overview - [Artifactory Configuration](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-artifactory-configuration.md) - [AWS CodeArtifact Configuration](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-codeartifact-configuration.md) - [Configuration Reference](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-configuration-reference.md): Complete reference for Socket Registry Firewall configuration options. - [Installation Guide](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-installations.md) - [Nexus Configuration](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-nexus-configuration.md) - [Downstream Deployment Guide](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-setup-downstream.md) - [Upstream Deployment Guide](https://docs.socket.dev/docs/socket-firewall-enterprise-registry-mode-upstream-deployment-guide.md) - [Wrapper Mode](https://docs.socket.dev/docs/socket-firewall-enterprise-wrapper-mode.md) - [Configuration](https://docs.socket.dev/docs/socket-firewall-enterprise-wrapper-mode-configuration.md) ## Documentation: Socket for VS Code - [Guide to Socket for VS Code](https://docs.socket.dev/docs/socket-for-vs-code.md) ## Documentation: Socket REST API - [Vigil Selectors](https://docs.socket.dev/docs/vigil.md) - [Socket JavaScript SDK](https://docs.socket.dev/docs/socket-javascript-sdk.md): Use the Socket API from JavaScript/TypeScript. - [Socket Python SDK](https://docs.socket.dev/docs/socket-python-sdk.md) ## Documentation: Socket Chrome Extension - [Guide to Socket Chrome Extension](https://docs.socket.dev/docs/socket-security-chrome-extension.md) - [Extension Permissions](https://docs.socket.dev/docs/socket-chrome-extension-permissions-documentation.md) - [Deploying via Google Workspace](https://docs.socket.dev/docs/deploying-socket-web-extension-via-google-workspace.md) ## Documentation: Next steps - [Join the community](https://docs.socket.dev/docs/join-the-community.md) - [Contact support](https://docs.socket.dev/docs/contact-support.md) ## Documentation: Advanced - [Sample Test Packages](https://docs.socket.dev/docs/sample-malware-packages.md) - [Known issues](https://docs.socket.dev/docs/known-issues.md): Known issues with the Socket product, and workarounds when available. - [Incremental Rollout](https://docs.socket.dev/docs/incremental-rollout.md) - [Tool Configuration Files](https://docs.socket.dev/docs/tool-configuration-files.md) ## API Reference: API Endpoints - [Creating and Managing API Tokens](https://docs.socket.dev/reference/creating-and-managing-api-tokens.md) - [Authentication](https://docs.socket.dev/reference/authentication.md): This page will explain how Socket API authentication works - [Quota](https://docs.socket.dev/reference/quota.md): This page explains how Socket API quota works - [Socket Package URLs (purl)](https://docs.socket.dev/reference/socket-package-urls-purl.md): This page describes how Socket purls work - [Historical Data Endpoints](https://docs.socket.dev/reference/historical-data-endpoints.md): Historical data endpoints provide access to historical data that is collected via periodic snapshots and other events - [API Lifecycle and Deprecation Process](https://docs.socket.dev/reference/api-lifecycle-and-deprecation-process.md): Socket sometimes needs to deprecate or replace API endpoints with new ones. We offer a number of tools and channels to help notify and migrate customers to new endpoints. - Packages - [Get Packages by PURL (Org Scoped)](https://docs.socket.dev/reference/batchpackagefetchbyorg.md): Batch retrieval of package metadata and alerts by PURL strings for a specific organization. Compatible with CycloneDX reports. Package URLs (PURLs) are an ecosystem agnostic way to identify… - [List published versions for a package by PURL](https://docs.socket.dev/reference/get_v1-orgs-org-slug-purl-versions-purl.md): Given a package URL (PURL) *without* a version, returns every version Socket knows about for that package along with its publish date, sorted newest-first by publish date. This lets you enforce… - Deprecated - [SCM Comment for Scan Diff](https://docs.socket.dev/reference/getorgfullscandiffgfm.md): **This endpoint is deprecated.** Get the dependency overview and dependency alert comments in GitHub flavored markdown between the diff between two existing full scans. This endpoint consumes 1… - [Diff Full Scans](https://docs.socket.dev/reference/getorgdiffscan.md): **This endpoint is deprecated.** Get the immutable difference between two existing Full Scans. The result uses the policies active when it was computed and may be cached for reuse. This endpoint… - [Saturate License Policy (Legacy)](https://docs.socket.dev/reference/saturatelicensepolicy.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/updateorglicensepolicy) instead. Get the "saturated" version of a license policy's allow list, filling… - [Get Organization License Policy](https://docs.socket.dev/reference/getorglicensepolicy.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/viewlicensepolicy) instead. Retrieve the license policy of an organization. This endpoint consumes 1… - [Get organization analytics (unstable)](https://docs.socket.dev/reference/getorganalytics.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/historicalalertstrend) instead. Please implement against the [Historical… - [Get repository analytics](https://docs.socket.dev/reference/getrepoanalytics.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/historicalalertstrend) instead. Please implement against the [Historical… - [Get Threat Feed Items (Deprecated)](https://docs.socket.dev/reference/getthreatfeeditems.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/getorgthreatfeeditems) instead. Paginated list of threat feed items. This endpoint requires an… - [Get Packages by PURL](https://docs.socket.dev/reference/batchpackagefetch.md): **This endpoint is deprecated.** Deprecated since 2026-01-05. Batch retrieval of package metadata and alerts by PURL strings. Compatible with CycloneDX reports. Package URLs (PURLs) are an… - [Create a snapshot of all dependencies from manifest information](https://docs.socket.dev/reference/createdependenciessnapshot.md): **This endpoint is deprecated.** Upload a set of manifest or lockfiles to get your dependency tree analyzed by Socket. You can upload multiple lockfiles in the same request, but each filename must… - [Get supported files for report](https://docs.socket.dev/reference/getreportsupportedfiles.md): **This endpoint is deprecated.** Deprecated since 2023-01-15. Use the [successor version](https://docs.socket.dev/reference/getsupportedfiles) instead. This route has been moved to the… - [Delete a report](https://docs.socket.dev/reference/deletereport.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference) instead. Deprecated: Use `/orgs/{org_slug}/full-scans` instead. Delete a specific project report… - [Get list of reports](https://docs.socket.dev/reference/getreportlist.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference) instead. Deprecated: Use `/orgs/{org_slug}/full-scans` instead. Get all your project reports generated… - [Create a report](https://docs.socket.dev/reference/createreport.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/createorgfullscan) instead. Deprecated: Use `/orgs/{org_slug}/full-scans` instead. Upload a lockfile… - [View a report](https://docs.socket.dev/reference/getreport.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/getorgfullscan) instead. Deprecated: Use `/orgs/{org_slug}/full-scans` instead. Get all the issues,… - [List GitHub repositories](https://docs.socket.dev/reference/getrepolist.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/getorgrepolist) instead. Deprecated: Use `/orgs/{org_slug}/repos` instead. Get all GitHub repositories… - [Calculate settings](https://docs.socket.dev/reference/postsettings.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/updateorgsecuritypolicy) instead. Get current settings for the requested organizations and default… - [Get issues by package](https://docs.socket.dev/reference/getissuesbynpmpackage.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference) instead. Get all the issues related with a particular npm package version. This endpoint returns the… - [Get score by package](https://docs.socket.dev/reference/getscorebynpmpackage.md): **This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/batchpackagefetch) instead. Get all the scores and metrics by category that are used to evaluate the… - Dependencies - [Search dependencies](https://docs.socket.dev/reference/searchdependencies.md): Search for any dependency that is being used in your organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - No Scopes Required, but… - [Trend of historical dependencies (Beta)](https://docs.socket.dev/reference/historicaldependenciestrend.md): Trend analytics of historical dependencies. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - historical:dependencies-trend - Alerts - [List historical alerts (Beta)](https://docs.socket.dev/reference/historicalalertslist.md): List historical alerts. Pagination: keep requesting pages (passing the previous response's `endCursor` as `startAfterCursor`) until `endCursor` is `null`. Do not stop when `items` is empty — an… - [Trend of historical alerts (Beta)](https://docs.socket.dev/reference/historicalalertstrend.md): Trend analytics of historical alerts. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - historical:alerts-trend - [List latest alerts (Beta)](https://docs.socket.dev/reference/alertslist.md): List latest alerts. Pagination: keep requesting pages (passing the previous response's `endCursor` as `startAfterCursor`) until `endCursor` is `null`. Do not stop when `items` is empty — an empty… - [List full scans associated with alert (Beta)](https://docs.socket.dev/reference/alertfullscans.md): List full scans associated with alert. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - alerts:list - [List Org Alert Resolutions](https://docs.socket.dev/reference/getorgalertresolutions.md): List active alert resolutions for an organization. Results are paginated via an opaque cursor and ordered by created_at. Each row includes the anchor fields (alert_type, repo, repo_label, artifact_*)… - [Get Org Alert Resolution](https://docs.socket.dev/reference/getorgalertresolution.md): Fetch a single active alert resolution by UUID. Returns the same row shape as the list endpoint. Tokens restricted to specific repositories cannot read resolutions anchored to repositories outside… - [Delete Org Alert Resolution](https://docs.socket.dev/reference/deleteorgalertresolution.md): Delete an alert resolution by UUID. Once deleted, alerts previously hidden by this resolution will reappear after the next org snapshot. Tokens restricted to specific repositories may only delete… - [Create Org Alert Resolution](https://docs.socket.dev/reference/createorgalertresolution.md): Create an alert resolution. The `vigil_selector` describes which alerts the resolution applies to; matching alerts are hidden after the next org snapshot. Returns the same row shape as the list… - Full Scans - [Create full scan](https://docs.socket.dev/reference/createorgfullscan.md): Create a full scan from a set of package manifest files. Returns a full scan including all SBOM artifacts. To get a list of supported filetypes that can be uploaded in a full-scan, see the [Get… - [List full scans](https://docs.socket.dev/reference/getorgfullscanlist.md): Returns a paginated list of all full scans in an org, excluding SBOM artifacts. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - full-scans:list - [Stream full scan](https://docs.socket.dev/reference/getorgfullscan.md): Stream all SBOM artifacts for a full scan. This endpoint returns the latest, available alert data for artifacts in the full scan (stale while revalidate). Actively running analysis will be returned… - [Delete full scan](https://docs.socket.dev/reference/deleteorgfullscan.md): Delete an existing full scan. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - full-scans:delete - [Get full scan metadata](https://docs.socket.dev/reference/getorgfullscanmetadata.md): Get metadata for a single full scan This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - full-scans:list - [Create full scan from archive](https://docs.socket.dev/reference/createorgfullscanarchive.md): Create a full scan by uploading one or more archives. Supported archive formats include **.tar**, **.tar.gz/.tgz**, and **.zip**. Each uploaded archive is extracted server-side and any supported… - [Download full scan files as tarball](https://docs.socket.dev/reference/downloadorgfullscanfilesastar.md): Download all files associated with a full scan in tar format. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - full-scans:list - [Export OpenVEX Document (Beta)](https://docs.socket.dev/reference/exportopenvex.md): Export vulnerability exploitability data as an OpenVEX v0.2.0 document. OpenVEX (Vulnerability Exploitability eXchange) documents communicate the exploitability status of vulnerabilities in software… - [Export SPDX SBOM (Beta)](https://docs.socket.dev/reference/exportspdx.md): Export a Socket SBOM as a SPDX SBOM Supported ecosystems: - crates - go - maven - npm - nuget - pypi - rubygems - spdx - cdx Unsupported ecosystems are filtered from the export. This endpoint… - [Export CycloneDX SBOM (Beta)](https://docs.socket.dev/reference/exportcdx.md): Export a Socket SBOM as a CycloneDX SBOM Supported ecosystems: - crates - go - maven - npm - nuget - pypi - rubygems - spdx - cdx Unsupported ecosystems are filtered from the export. This… - [Rescan full scan](https://docs.socket.dev/reference/rescanorgfullscan.md): Create a new full scan by rescanning an existing scan. A "shallow" rescan reapplies the latest policies to the previously cached dependency resolution results. A "deep" rescan reruns dependency… - [Get supported file types](https://docs.socket.dev/reference/getsupportedfiles.md): Get a list of supported files for full scan generation. Files are categorized first by environment (e.g. NPM or PyPI), then by name. Files whose names match the patterns returned by this endpoint… - [Export CSV of alerts for full scan](https://docs.socket.dev/reference/getorgfullscancsv.md): Export a CSV file containing all alerts from a full scan. The CSV includes details about each alert and the affected packages. You can optionally filter using the request body "filters" array.… - [Generate PDF report for full scan](https://docs.socket.dev/reference/getorgfullscanpdf.md): Generate a PDF report for all alerts in a full scan. This endpoint streams a PDF document containing all alerts found in the full scan, with optional filtering and grouping options. Supported… - Fixes - [Fetch fixes for vulnerabilities in a repository, scan, or uploaded manifest](https://docs.socket.dev/reference/fetch-fixes.md): Fetches available fixes for vulnerabilities in a repository, scan, or uploaded manifest. Requires exactly one of repo_slug, full_scan_id, or tar_hash, as well as vulnerability_ids to be provided.… - Diff Scans - [List diff scans](https://docs.socket.dev/reference/listorgdiffscans.md): Returns a paginated list of all diff scans in an organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - diff-scans:list - [Get diff scan](https://docs.socket.dev/reference/getdiffscanbyid.md): Get the difference between two full scans from an existing diff scan resource. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - diff-scans:list - [Delete diff scan](https://docs.socket.dev/reference/deleteorgdiffscan.md): Delete an existing diff scan. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - diff-scans:delete - [SCM Comment for Diff Scan](https://docs.socket.dev/reference/getdiffscangfm.md): Get the dependency overview and dependency alert comments in GitHub flavored markdown for an existing diff scan. This endpoint consumes 1 unit of your quota. This endpoint requires the following… - [Create diff scan from repository HEAD full-scan](https://docs.socket.dev/reference/createorgrepodiff.md): Create a diff scan between the repository's current HEAD full scan and a new full scan from uploaded manifest files. Returns metadata about the diff scan. Once the diff scan is created, fetch the… - [Create diff scan from full scan IDs](https://docs.socket.dev/reference/createorgdiffscanfromids.md): Create a diff scan from two existing full scan IDs. The full scans must be in the same repository. Returns metadata about the diff scan. Once the diff scan is created, fetch the diff scan from the… - Triage - [List Org Alert Triage](https://docs.socket.dev/reference/getorgtriage.md): List triage actions for an organization. Results are paginated and can be sorted by created_at or updated_at. This endpoint consumes 1 unit of your quota. This endpoint requires the following org… - [Create/Update Org Alert Triage](https://docs.socket.dev/reference/updateorgalerttriage.md): Create or update triage actions on organization alerts. Accepts a batch of triage entries. Omit `uuid` to create a new entry; provide an existing `uuid` to update it. Use `?force=true` for broad… - [Delete Org Alert Triage](https://docs.socket.dev/reference/deleteorgalerttriage.md): Delete a specific triage rule by UUID. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - triage:alerts-update - Repos - [List repositories](https://docs.socket.dev/reference/getorgrepolist.md): Lists repositories for the specified organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - repo:list - [Create repository](https://docs.socket.dev/reference/createorgrepo.md): Create a repository. Repos collect Full scans and Diff scans and are typically associated with a git repo. This endpoint consumes 1 unit of your quota. This endpoint requires the following org… - [Get repository](https://docs.socket.dev/reference/getorgrepo.md): Retrieve a repository associated with an organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - repo:list - [Update repository](https://docs.socket.dev/reference/updateorgrepo.md): Update details of an existing repository. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - repo:update - [Delete repository](https://docs.socket.dev/reference/deleteorgrepo.md): Delete a single repository and all of its associated Full scans and Diff scans. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - repo:delete - Repo Labels - [Associate repository label (beta)](https://docs.socket.dev/reference/associateorgrepolabel.md): Associate a repository label with a repository. Labels can be used to group and organize repositories and to apply security/license policies. This endpoint consumes 1 unit of your quota. This… - [Create repository label (beta)](https://docs.socket.dev/reference/createorgrepolabel.md): Create a repository label. Labels can be used to group and organize repositories and to apply security/license policies. This endpoint consumes 1 unit of your quota. This endpoint requires the… - [List repository labels (beta)](https://docs.socket.dev/reference/getorgrepolabellist.md): Lists repository labels for the specified organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - repo-label:list - [Delete repository label (beta)](https://docs.socket.dev/reference/deleteorgrepolabel.md): Delete a repository label and all of its associations (repositories, security policy, license policy, etc.). This endpoint consumes 1 unit of your quota. This endpoint requires the following org… - [Get repository label (beta)](https://docs.socket.dev/reference/getorgrepolabel.md): Retrieve a repository label associated with an organization and label ID. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - repo-label:list - [Delete repository label setting (beta)](https://docs.socket.dev/reference/deleteorgrepolabelsetting.md): Delete the setting (e.g. security/license policy) for a repository label. Note that repository label settings currently only support `issueRules`, `issueRulesPolicyDefault`, `licensePolicy`, and… - [Update repository label (beta)](https://docs.socket.dev/reference/updateorgrepolabel.md): Update a repository label name. Labels can be used to group and organize repositories and to apply security/license policies. This endpoint consumes 1 unit of your quota. This endpoint requires… - [Get repository label setting (beta)](https://docs.socket.dev/reference/getorgrepolabelsetting.md): Retrieve the setting (e.g. security/license policy) for a repository label. Note that repository label settings currently only support `issueRules`, `issueRulesPolicyDefault`, `licensePolicy`, and… - [Update repository label setting (beta)](https://docs.socket.dev/reference/updateorgrepolabelsetting.md): Update the setting (e.g. security/license policy) for a repository label. Note that repository label settings currently only support `issueRules`, `issueRulesPolicyDefault`, `licensePolicy`, and… - [Disassociate repository label (beta)](https://docs.socket.dev/reference/disassociateorgrepolabel.md): Disassociate a repository label from a repository. Labels can be used to group and organize repositories and to apply security/license policies. This endpoint consumes 1 unit of your quota. This… - Threat Campaigns - [List threat campaigns](https://docs.socket.dev/reference/get_v1-orgs-org-slug-threat-campaigns.md): Returns a paginated list of supply chain attack campaigns. Supports filtering by status, ecosystem, and an incremental sync parameter (`updated_after`). Package PURLs are not inlined on the campaign… - [Get a threat campaign](https://docs.socket.dev/reference/get_v1-orgs-org-slug-threat-campaigns-campaign-id.md): Returns a single supply chain attack campaign by ID. Same shape as one item from the campaigns list; package PURLs are not inlined — fetch them from the paginated… - [List packages for a threat campaign](https://docs.socket.dev/reference/get_v1-orgs-org-slug-threat-campaigns-campaign-id-packages.md): Returns a cursor-paginated list of package PURLs affected by a single supply chain attack campaign. This is the primary way to retrieve all packages for a known campaign without an inline, unbounded… - Threat Feed - [Get Threat Feed Items (Beta)](https://docs.socket.dev/reference/getorgthreatfeeditems.md): Paginated list of threats, sorted by updated_at by default. Set updated_after to the unix timestamp of your last sync while sorting by updated_at to synchronize all new or updated threats in the… - Org Snapshots - [List details of periodic historical data snapshots (Beta)](https://docs.socket.dev/reference/historicalsnapshotslist.md): This API endpoint is used to list the details of historical snapshots. Snapshots of organization data are taken periodically, and each historical snapshot record contains high-level overview metrics… - [Start historical data snapshot job (Beta)](https://docs.socket.dev/reference/historicalsnapshotsstart.md): This API endpoint is used to start a historical snapshot job. While snapshots are typically taken multiple times a day for paid plans and once a day for free plans, this endpoint can be used to start… - Alert Policies - [List Org Alert Policies](https://docs.socket.dev/reference/getorgalertpolicies.md): List the alert policies of an organization. The default policy (which applies to all repositories without a policy label) is always first, followed by custom policies ordered by creation time.… - [Create Org Alert Policy](https://docs.socket.dev/reference/createorgalertpolicy.md): Create an alert policy. A repo label with the same name is created to scope the policy; repositories carrying that label are governed by the policy. Requires a token with org-wide repository access;… - [Get Org Alert Policy](https://docs.socket.dev/reference/getorgalertpolicy.md): Fetch a single alert policy by ID. Use `default` as the ID for the default policy, which applies to all repositories without a policy label. Requires a token with org-wide repository access;… - [Update Org Alert Policy](https://docs.socket.dev/reference/updateorgalertpolicy.md): Update an alert policy. Only the provided fields change; `repository_ids` replaces the full set of repositories the policy scopes to. The default policy cannot be renamed and its scope is implicit.… - [Delete Org Alert Policy](https://docs.socket.dev/reference/deleteorgalertpolicy.md): Delete an alert policy along with its rules and repo label. Repositories previously scoped to the policy fall back to the default policy after the next org snapshot. The default policy cannot be… - [List Org Alert Policy Rules](https://docs.socket.dev/reference/getorgalertpolicyrules.md): List the custom rules of an alert policy in evaluation order (ascending rank). Rules are evaluated before the policy baseline; the first matching rule decides the alert action. Requires a token with… - [Create Org Alert Policy Rule](https://docs.socket.dev/reference/createorgalertpolicyrule.md): Create a rule on an alert policy. Rules are evaluated in ascending rank order and the first matching rule decides the alert action. Provide at most one of `position`, `rank`, `before_rule_id`, or… - [Get Org Alert Policy Rule](https://docs.socket.dev/reference/getorgalertpolicyrule.md): Fetch a single alert policy rule by UUID. Returns the same row shape as the rules list endpoint. Requires a token with org-wide repository access; repo-restricted tokens receive 403. This endpoint… - [Update Org Alert Policy Rule](https://docs.socket.dev/reference/updateorgalertpolicyrule.md): Update an alert policy rule. Only the provided fields change. To move the rule, provide at most one of `position`, `rank`, `before_rule_id`, or `after_rule_id`. Requires a token with org-wide… - [Delete Org Alert Policy Rule](https://docs.socket.dev/reference/deleteorgalertpolicyrule.md): Delete an alert policy rule. Alerts previously matched by this rule are re-evaluated against the remaining rules and baseline after the next org snapshot. Requires a token with org-wide repository… - [Translate Org Alert Triage](https://docs.socket.dev/reference/translateorgalertpolicymigrationtriage.md): Translate a legacy alert triage payload — the same body as `POST /v0/orgs/{org_slug}/triage/alerts` — into the resolution or policy-rule requests that replace it. Nothing is created. Policy-rule… - [Get Org Alert Policy Migration Status](https://docs.socket.dev/reference/getorgalertpolicymigrationstatus.md): Retrieve the alert policy migration status of an organization. This is read-only and does not enroll organizations or start migration windows. Requires a token with org-wide repository access;… - Security Policy - [Get Organization Security Policy](https://docs.socket.dev/reference/getorgsecuritypolicy.md): Retrieve the security policy of an organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - security-policy:read - [Update Security Policy](https://docs.socket.dev/reference/updateorgsecuritypolicy.md): Update the security policy of an organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - security-policy:update - License Policy - [Get License Policy (Beta)](https://docs.socket.dev/reference/viewlicensepolicy.md): Returns an organization's license policy including allow, warn, monitor, and deny categories. The deny category contains all licenses that are not explicitly categorized as allow, warn, or monitor.… - [License Policy (Beta)](https://docs.socket.dev/reference/licensepolicy.md): Compare the license data found for a list of packages (given as PURL strings) with the contents of a configurable license policy, returning information about license data which does not comply… - [Update License Policy](https://docs.socket.dev/reference/updateorglicensepolicy.md): Set the organization's license policy ## License policy schema ```json { allow?: Array warn?: Array options?: Array } ``` Elements of the `allow` and `warn`… - Org Settings - [Get Socket Basics configuration, including toggles for the various tools it supports.](https://docs.socket.dev/reference/getsocketbasicsconfig.md): Socket Basics is a CI/CD security scanning suite that runs on your source code, designed to complement Socket SCA and provide full coverage. - **SAST** - Find issues and risks with your code via… - [Get integration events](https://docs.socket.dev/reference/getintegrationevents.md): This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - integration:list - Audit Log - [Get Audit Log Events](https://docs.socket.dev/reference/getauditlogevents.md): Paginated list of audit log events. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - audit-log:list - API Tokens - [Create API Token](https://docs.socket.dev/reference/postapitoken.md): Create an API Token. The API Token created must use a subset of permissions the API token creating them. This endpoint consumes 10 units of your quota. This endpoint requires the following org… - [Get quota](https://docs.socket.dev/reference/getquota.md): Get your current API quota. You can use this endpoint to prevent doing requests that might spend all your quota. This endpoint consumes 0 units of your quota. This endpoint requires the following… - [List API Tokens](https://docs.socket.dev/reference/getapitokens.md): List all API Tokens. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - api-tokens:list - [List organizations](https://docs.socket.dev/reference/getorganizations.md): Get information on the current organizations associated with the API token. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - No Scopes Required,… - [Update API Token](https://docs.socket.dev/reference/postapitokenupdate.md): Update an API Token. The API Token created must use a subset of permissions the API token creating them. This endpoint consumes 10 units of your quota. This endpoint requires the following org… - [Rotate API Token](https://docs.socket.dev/reference/postapitokensrotate.md): Rotate an API Token This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - api-tokens:rotate - [Revoke API Token](https://docs.socket.dev/reference/postapitokensrevoke.md): Revoke an API Token This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - api-tokens:revoke - Webhooks - [List all webhooks](https://docs.socket.dev/reference/getorgwebhookslist.md): List all webhooks in the specified organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - webhooks:list - [Create a webhook](https://docs.socket.dev/reference/createorgwebhook.md): Create a new webhook. Returns the created webhook details. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - webhooks:create - [Get webhook](https://docs.socket.dev/reference/getorgwebhook.md): Get a webhook for the specified organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - webhooks:list - [Update webhook](https://docs.socket.dev/reference/updateorgwebhook.md): Update details of an existing webhook. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - webhooks:update - [Delete webhook](https://docs.socket.dev/reference/deleteorgwebhook.md): Delete a webhook. This will stop all future webhook deliveries to the webhook URL. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: -… - Metadata - [Returns the OpenAPI definition](https://docs.socket.dev/reference/getopenapi.md): Retrieve the API specification in an Openapi JSON format. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - [Alert Types Metadata](https://docs.socket.dev/reference/alerttypes.md): For an array of alert type identifiers, returns metadata for each alert type. Optionally, specify a language via the 'language' query parameter. This endpoint consumes 1 unit of your quota. This… - [License Metadata](https://docs.socket.dev/reference/licensemetadata.md): For an array of license identifiers or names (short form SPDX identifiers, or long form license names), returns an array of metadata for the corresponding license, if the license is recognized.… - [Returns the OpenAPI definition](https://docs.socket.dev/reference/getopenapijson.md): Retrieve the API specification in an Openapi JSON format. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - Events - [Post organization events](https://docs.socket.dev/reference/post_v1-orgs-org-slug-events.md): Send events directly to Socket. Authentication: Organization API token only. Required token scopes: * - [Get Organization Telemetry Config](https://docs.socket.dev/reference/getorgtelemetryconfig.md): Retrieve the telemetry config of an organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - [Update Telemetry Config](https://docs.socket.dev/reference/updateorgtelemetryconfig.md): Update the telemetry config of an organization. This endpoint consumes 1 unit of your quota. This endpoint requires the following org token scopes: - telemetry-policy:update - events - [List organization events](https://docs.socket.dev/reference/listorgevents.md): List events for an organization. Events are records of actions taken across Socket products, such as firewall decisions and CLI/SDK actions. The maximum date range per request is 365 days. When… ## API Reference: Socket API v1 - meta - [Returns the OpenAPI definition](https://docs.socket.dev/reference/get_v1-openapi.md): Returns the OpenAPI 3.1 specification for the v1 API. No authentication required. - [Returns the OpenAPI definition](https://docs.socket.dev/reference/get_v1-openapi-json.md): Returns the OpenAPI 3.1 specification for the v1 API. No authentication required. - /v1/oauth2/device/authorize - [/v1/oauth2/device/authorize](https://docs.socket.dev/reference/post_v1-oauth2-device-authorize.md) - /v1/oauth2/device/verify - [/v1/oauth2/device/verify](https://docs.socket.dev/reference/post_v1-oauth2-device-verify.md)