Start fix computation

post

https://api.socket.dev/v0/orgs/{org_slug}/fixes/computations

Starts computing fixes for vulnerabilities in a repository, scan, or uploaded manifest, and returns a computation id right away. Poll Get fix computation with that id until the status is succeeded or failed to get the result.

Requires exactly one of repo_slug, full_scan_id, or tar_hash, as well as vulnerability_ids to be provided.
vulnerability_ids can be a comma-separated list of GHSA or CVE IDs, or "*" for all vulnerabilities.

The computation runs in the background, so large or never-before-seen projects cannot time out the request, and a dropped connection does not cancel the work.

While a computation with the same parameters is still pending or running for your organization, this endpoint returns that computation's id instead of starting a new one. Once a computation has finished, a new request starts a fresh computation.

This endpoint consumes 10 units of your quota.

This endpoint requires the following org token scopes:

fixes:list

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

org_slug

string

required

The slug of the organization

Query Params

repo_slug

string

The slug of the repository to fetch fixes for (e.g. "my-repo" or "my-org/my-repo"). Use the full org/repo path to disambiguate when multiple GitHub orgs share the same repo name. Computes fixes based on the latest scan on the default branch

full_scan_id

string

The ID of the scan to fetch fixes for

tar_hash

string

A tarball hash from the upload-manifest-files endpoint. Mutually exclusive with repo_slug and full_scan_id.

vulnerability_ids

string

required

Comma-separated list of GHSA or CVE IDs, or "*" for all vulnerabilities

allow_major_updates

boolean

required

Defaults to false

Whether to allow major version updates in fixes

minimum_release_age

string

Defaults to 0d

Minimum release age for fixes packages (e.g., "1h", "2d", "1w"). Higher values reduces risk of installing recently released untested package versions. Applies to the ecosystems in minimum_release_age_ecosystems, or to every ecosystem when that is unset.

minimum_release_age_ecosystems

string

Comma-separated PURL types (e.g. "npm" or "npm,pypi") that minimum_release_age applies to. Packages of other ecosystems get fixes regardless of release age. Defaults to every ecosystem.

minimum_release_age_exclude

string

Comma-separated npm packages exempt from minimum_release_age, in the format of pnpm's minimumReleaseAgeExclude setting: an exact name ("lodash", "@myorg/pkg"), a name pattern with ("@myorg/"), or a name with exact versions joined by || ("[email protected] || 5.102.1") to exempt only those versions. As in pnpm, the first entry matching a package decides. Only applies to npm packages.

override_targets

string

Comma-separated npm package names that an npm overrides, pnpm overrides or yarn resolutions entry in the project targets. Such an entry forces one version of the package everywhere, so a fix only installs a second copy of a package next to the first when this list is sent and does not name it. Send it empty when the project has no such entries.

allow_overrides

boolean

Defaults to false

Set when the client writes an npm override, pnpm override or yarn resolution for a fix that needs one. The fix search may then fix an npm package whose parent declares a range that rejects every safe version: the fix lists that parent in overrides, and the client forces fixedVersion under it. Off by default, so a client that cannot write overrides never gets such a fix.

include_details

boolean

Defaults to false

Whether to include advisory details in the response

include_responsible_direct_dependencies

boolean

Defaults to false

Set to include the direct dependencies responsible for introducing the dependency or dependencies with the vulnerability in the response

include_all_detected_ghsas

boolean

Defaults to false

Set to include an allDetectedGhsas field listing every GHSA detected in the project, regardless of the vulnerability_ids filter. Useful for CLI clients that request a specific GHSA and want to show the user which GHSAs actually exist when the request has no overlap.

include_stateful_alert_ids

boolean

Defaults to false

Set to include a statefulAlertIds map (GHSA ID → array of open stateful alert IDs detected in this organization) in the response. Lets callers correlate /fixes results back to the alert IDs surfaced by /v0/orgs/{org_slug}/alerts. Org-scoped only — multiple alerts across repos/branches may share a GHSA. Off by default to avoid an extra ClickHouse round-trip.

autofix_run_id

string

The id of an autofix-or-upgrade-cli-run record (created via /fixes/register-autofix-or-upgrade-cli-run) to associate this computation with. When set, the server records per-GHSA fix-computation telemetry into autofix_compute_vulnerability and updates the run's autofix_run row, mirroring the legacy /v0/fixes/compute-fixes endpoint. The caller must own the run's organization; foreign-org or unknown ids return 404.

Responses

202The fix computation was enqueued (or an identical in-flight computation was joined)

400Bad request

401Unauthorized

403Insufficient max_quota for API method

404Resource not found

429Insufficient quota for API route