Skip to main content

​
Create full scan

Action ID: tools.socket.create_full_scan Create a full scan. Calls POST /v0/orgs/{org_slug}/full-scans directly with multipart files. Reference: https://docs.socket.dev/reference/createorgfullscan

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
object
required
Multipart files map accepted by core.http_request.
​
string
required
Socket organization slug.
​
string
required
The slug of the repository to associate the full-scan with.
​
string | null
Base URL of the Socket API.Default: null.
​
string | null
The branch name to associate the full-scan with. Branch names must follow Git branch name rules: be 1-255 characters long; cannot be exactly @; cannot begin or end with /, ., or .lock; cannot contain ”//”, ”..”, or ”@{”; and cannot include control characters, spaces, or any of ~^:?*[.Default: null.
​
string | null
The commit hash to associate the full-scan with.Default: null.
​
string | null
The commit message to associate the full-scan with.Default: null.
​
array[string] | null
The committers to associate with the full-scan. Set query more than once to set multiple.Default: null.
​
string | null
The integration org slug to associate the full-scan with. If omitted, the Socket org name will be used. This is used to generate links and badges.Default: null.
​
string | null
The integration type to associate the full-scan with. Defaults to “Api” if omitted. Supported values are api, github, gitlab, bitbucket, azure and web.Default: null.
​
boolean | null
Set the default branch of the repository to the branch of this full-scan. A branch name is required with this option.Default: null.
​
integer | null
The pull request number to associate the full-scan with.Default: null.
​
string | null
The type of scan to perform. Defaults to ‘socket’. Must be 32 characters or less. Used for categorizing multiple SBOM heads per repository branch.Default: null.
​
boolean | null
Designate this full-scan as the latest scan of a given branch. Default branch head scans are included in org alerts. This is only supported on the default branch. A branch name is required with this option.Default: null.
​
boolean | null
Create a temporary full-scan that is not listed in the reports dashboard. Cannot be used when set_as_pending_head=true.Default: null.
​
string | null
The workspace of the repository to associate the full-scan with.Default: null.

​
Create full scan from archive

Action ID: tools.socket.create_full_scan_from_archive Create a full scan from an archive. Calls POST /v0/orgs/{org_slug}/full-scans/archive directly with multipart files. Reference: https://docs.socket.dev/reference/createorgfullscanarchive

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
object
required
Multipart archive files map accepted by core.http_request.
​
string
required
Socket organization slug.
​
string
required
The slug of the repository to associate the full-scan with.
​
string | null
Base URL of the Socket API.Default: null.
​
string | null
The branch name to associate the full-scan with. Branch names must follow Git branch name rules: be 1-255 characters long; cannot be exactly @; cannot begin or end with /, ., or .lock; cannot contain ”//”, ”..”, or ”@{”; and cannot include control characters, spaces, or any of ~^:?*[.Default: null.
​
string | null
The commit hash to associate the full-scan with.Default: null.
​
string | null
The commit message to associate the full-scan with.Default: null.
​
array[string] | null
The committers to associate with the full-scan. Set query more than once to set multiple.Default: null.
​
string | null
The integration org slug to associate the full-scan with. If omitted, the Socket org name will be used. This is used to generate links and badges.Default: null.
​
string | null
The integration type to associate the full-scan with. Defaults to “Api” if omitted. Supported values are api, github, gitlab, bitbucket, azure and web.Default: null.
​
boolean | null
Set the default branch of the repository to the branch of this full-scan. A branch name is required with this option.Default: null.
​
integer | null
The pull request number to associate the full-scan with.Default: null.
​
string | null
The type of scan to perform. Defaults to ‘socket’. Must be 32 characters or less. Used for categorizing multiple SBOM heads per repository branch.Default: null.
​
boolean | null
Designate this full-scan as the latest scan of a given branch. Default branch head scans are included in org alerts. This is only supported on the default branch. A branch name is required with this option.Default: null.
​
boolean | null
Create a temporary full-scan that is not listed in the reports dashboard. Cannot be used when set_as_pending_head=true.Default: null.
​
string | null
The workspace of the repository to associate the full-scan with.Default: null.

​
Fetch packages by PURL

Action ID: tools.socket.fetch_packages_by_purl Fetch packages by PURL. Calls POST /v0/orgs/{org_slug}/purl directly. Reference: https://docs.socket.dev/reference/batchpackagefetchbyorg

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
array[object]
required
API-native package components containing PURLs.
​
string
required
Socket organization slug.
​
string
Response media type to request.Default: "application/x-ndjson".
​
string | null
Include only alerts with comma separated actions defined by security policy. Supported values are error, monitor, warn and ignore.Default: null.
​
boolean | null
Include alert metadata.Default: null.
​
string | null
Base URL of the Socket API.Default: null.
​
boolean | null
Legacy fallback for older clients. Only used when poll is omitted: cachedResultsOnly=true behaves like poll=false, while cachedResultsOnly=false preserves the older blocking behavior.Default: null.
​
boolean | null
Compact metadata. When enabled, excludes metadata fields like author, scores, size, dependencies, and manifest files. Always includes: id, type, name, version, release, namespace, subpath, alerts, and alertPriorities.Default: null.
​
boolean | null
Include only fixable alerts.Default: null.
​
string | null
Repository label slugs to apply policies. Only one label is supported currently; the parameter is an array to allow future support for multiple labels.Default: null.
​
boolean | null
Include license attribution data, including license text and author information. Maps attribution/license text to a list of data objects to which that attribution info applies.Default: null.
​
boolean | null
Include detailed license information, including location and match strength, for each license datum.Default: null.
​
boolean | null
When true, wait up to timeoutSec for pending analysis to complete before returning. When false (default), return the current known state immediately, including synthesized pendingScan and notFound alerts when alerts=true unless purlErrors=true keeps legacy not-found errors.Default: null.
​
boolean | null
Return errors found with handling PURLs as error objects in the stream.Default: null.
​
boolean | null
Include a summary object at the end of the stream with counts of malformed, resolved, and not found PURLs.Default: null.
​
integer | null
Maximum time in seconds to wait for package resolution and, when poll=true, pending analysis. Inputs that have not completed processing when the timeout is reached return pendingScan alerts when alerts=true, or errors when purlErrors=true.Default: null.

​
Get full scan metadata

Action ID: tools.socket.get_full_scan_metadata Get full scan metadata. Calls GET /v0/orgs/{org_slug}/full-scans/{full_scan_id}/metadata directly. Reference: https://docs.socket.dev/reference/getorgfullscanmetadata

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
string
required
Socket full scan ID.
​
string
required
Socket organization slug.
​
string | null
Base URL of the Socket API.Default: null.

​
List full scans

Action ID: tools.socket.list_full_scans List full scans. Calls GET /v0/orgs/{org_slug}/full-scans directly. Reference: https://docs.socket.dev/reference/getorgfullscanlist

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
string
required
Socket organization slug.
​
string | null
Base URL of the Socket API.Default: null.
​
string | null
A branch name to filter full-scans by.Default: null.
​
string | null
A commit hash to filter full-scans by.Default: null.
​
string | null
Specify sort direction. Supported values are asc and desc. Socket defaults to desc.Default: null.
​
string | null
A Unix timestamp in seconds that filters full-scans prior to the date.Default: null.
​
integer | null
The page number to return when using offset-style pagination. Ignored when cursor pagination is used. Socket defaults to 1.Default: null.
​
integer | null
Specify the maximum number of results to return per page. Socket defaults to 30.Default: null.
​
string | null
A PR number to filter full-scans by.Default: null.
​
string | null
A repository slug to filter full-scans by.Default: null.
​
string | null
A scan type to filter full-scans by (e.g. socket, socket_tier1, socket_basics).Default: null.
​
string | null
Specify Sort order. Supported values are name and created_at. Socket defaults to created_at.Default: null.
​
string | null
Cursor token for pagination. Pass the returned nextPageCursor from previous responses to fetch the next set of results.Default: null.
​
boolean | null
Set to true on the first request to opt into cursor-based pagination.Default: null.
​
string | null
A repository workspace to filter full-scans by.Default: null.

​
List supported files

Action ID: tools.socket.list_supported_files List supported files. Calls GET /v0/orgs/{org_slug}/supported-files directly. Reference: https://docs.socket.dev/reference/getsupportedfiles

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
string
required
Socket organization slug.
​
string | null
Base URL of the Socket API.Default: null.

​
List threat feed items

Action ID: tools.socket.list_threat_feed_items List threat feed items. Calls GET /v0/orgs/{org_slug}/threat-feed directly. Reference: https://docs.socket.dev/reference/getorgthreatfeeditems

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
string
required
Socket organization slug.
​
string | null
Base URL of the Socket API.Default: null.
​
string | null
A Unix timestamp in seconds that filters results to items only created after the date.Default: null.
​
string | null
Order direction of the provided sort field. Supported values are desc and asc. Socket defaults to desc.Default: null.
​
string | null
Filter threats by package ecosystem. Supported values are github, cargo, clawhub, composer, chrome, firefox-extension, edge-extension, golang, huggingface, maven, npm, nuget, vscode, pypi, gem and swift.Default: null.
​
string | null
Filter by threat classification. Supported values: mal (malware, including possible malware), vuln (vulnerability), typo (typosquat, including possible typosquat), anom (anomaly), spy (telemetry), obf (obfuscated code), dual (dual-use tool), joke (protestware or joke package), tp (all confirmed true positives), fp (false positive), u (unreviewed), c (classified, i.e. anything except unreviewed). Socket defaults to mal.Default: null.
​
boolean | null
Only return threats which have been human-reviewed.Default: null.
​
string | null
Filter threats by package name.Default: null.
​
string | null
Page cursor token. Pass the returned nextPageCursor to this query string to fetch the next page of the threat feed.Default: null.
​
integer | null
Number of threats per page. Socket defaults to 30.Default: null.
​
string | null
Set the sort order for the threat feed items. Default is descending order by updated_at, which includes all new and updated threat feed items. Supported values are id, created_at and updated_at.Default: null.
​
string | null
A Unix timestamp in seconds that filters results to items only updated after the timestamp.Default: null.
​
string | null
Filter threats by package version.Default: null.

​
Stream full scan

Action ID: tools.socket.stream_full_scan Stream a full scan. Calls GET /v0/orgs/{org_slug}/full-scans/{full_scan_id} directly. Reference: https://docs.socket.dev/reference/getorgfullscan

​
Secrets

Required secrets:
  • socket: required values SOCKET_API_TOKEN.

​
Input fields

​
string
required
Socket full scan ID.
​
string
required
Socket organization slug.
​
string
Response media type to request.Default: "application/x-ndjson".
​
string | null
Base URL of the Socket API.Default: null.
​
boolean | null
Return cached immutable scan results. When enabled and results are cached, returns the pre-computed scan. When results are not yet cached, returns 202 Accepted and enqueues a background job.Default: null.
​
string | null
Control which alert priority fields to include in the response. Set to “true” to include all fields, “false” to exclude all fields, or specify individual fields like “components,formula” to include only those fields.Default: null.
​
boolean
Include license details in the response. This can increase the response size significantly.Default: false.
​
boolean
Include scores event in the response. include_scores_details implies this flag.Default: false.
​
string | null
Control which score detail fields to include in the scores event. Set to “true” to include all fields, “false” to exclude all fields, or specify individual fields like “components,formula” to include only those fields.Default: null.