> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Socket

> Reference for the Tracecat Socket integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Create full scan

Action ID: `tools.socket.create_full_scan`

Create a full scan. Calls POST /v0/orgs/\{org\_slug}/full-scans directly with multipart files.

Reference: [https://docs.socket.dev/reference/createorgfullscan](https://docs.socket.dev/reference/createorgfullscan)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="files" type="object" required>
  Multipart files map accepted by core.http\_request.
</ParamField>

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="repo" type="string" required>
  The slug of the repository to associate the full-scan with.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

<ParamField path="branch" type="string | null">
  The branch name to associate the full-scan with. Branch names must follow Git branch name rules: be 1-255 characters long; cannot be exactly @; cannot begin or end with /, ., or .lock; cannot contain "//", "..", or "@\{"; and cannot include control characters, spaces, or any of \~^:?\*\[.

  Default: `null`.
</ParamField>

<ParamField path="commit_hash" type="string | null">
  The commit hash to associate the full-scan with.

  Default: `null`.
</ParamField>

<ParamField path="commit_message" type="string | null">
  The commit message to associate the full-scan with.

  Default: `null`.
</ParamField>

<ParamField path="committers" type="array[string] | null">
  The committers to associate with the full-scan. Set query more than once to set multiple.

  Default: `null`.
</ParamField>

<ParamField path="integration_org_slug" type="string | null">
  The integration org slug to associate the full-scan with. If omitted, the Socket org name will be used. This is used to generate links and badges.

  Default: `null`.
</ParamField>

<ParamField path="integration_type" type="string | null">
  The integration type to associate the full-scan with. Defaults to "Api" if omitted. Supported values are api, github, gitlab, bitbucket, azure and web.

  Default: `null`.
</ParamField>

<ParamField path="make_default_branch" type="boolean | null">
  Set the default branch of the repository to the branch of this full-scan. A branch name is required with this option.

  Default: `null`.
</ParamField>

<ParamField path="pull_request" type="integer | null">
  The pull request number to associate the full-scan with.

  Default: `null`.
</ParamField>

<ParamField path="scan_type" type="string | null">
  The type of scan to perform. Defaults to 'socket'. Must be 32 characters or less. Used for categorizing multiple SBOM heads per repository branch.

  Default: `null`.
</ParamField>

<ParamField path="set_as_pending_head" type="boolean | null">
  Designate this full-scan as the latest scan of a given branch. Default branch head scans are included in org alerts. This is only supported on the default branch. A branch name is required with this option.

  Default: `null`.
</ParamField>

<ParamField path="tmp" type="boolean | null">
  Create a temporary full-scan that is not listed in the reports dashboard. Cannot be used when set\_as\_pending\_head=true.

  Default: `null`.
</ParamField>

<ParamField path="workspace" type="string | null">
  The workspace of the repository to associate the full-scan with.

  Default: `null`.
</ParamField>

## Create full scan from archive

Action ID: `tools.socket.create_full_scan_from_archive`

Create a full scan from an archive. Calls POST /v0/orgs/\{org\_slug}/full-scans/archive directly with multipart files.

Reference: [https://docs.socket.dev/reference/createorgfullscanarchive](https://docs.socket.dev/reference/createorgfullscanarchive)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="files" type="object" required>
  Multipart archive files map accepted by core.http\_request.
</ParamField>

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="repo" type="string" required>
  The slug of the repository to associate the full-scan with.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

<ParamField path="branch" type="string | null">
  The branch name to associate the full-scan with. Branch names must follow Git branch name rules: be 1-255 characters long; cannot be exactly @; cannot begin or end with /, ., or .lock; cannot contain "//", "..", or "@\{"; and cannot include control characters, spaces, or any of \~^:?\*\[.

  Default: `null`.
</ParamField>

<ParamField path="commit_hash" type="string | null">
  The commit hash to associate the full-scan with.

  Default: `null`.
</ParamField>

<ParamField path="commit_message" type="string | null">
  The commit message to associate the full-scan with.

  Default: `null`.
</ParamField>

<ParamField path="committers" type="array[string] | null">
  The committers to associate with the full-scan. Set query more than once to set multiple.

  Default: `null`.
</ParamField>

<ParamField path="integration_org_slug" type="string | null">
  The integration org slug to associate the full-scan with. If omitted, the Socket org name will be used. This is used to generate links and badges.

  Default: `null`.
</ParamField>

<ParamField path="integration_type" type="string | null">
  The integration type to associate the full-scan with. Defaults to "Api" if omitted. Supported values are api, github, gitlab, bitbucket, azure and web.

  Default: `null`.
</ParamField>

<ParamField path="make_default_branch" type="boolean | null">
  Set the default branch of the repository to the branch of this full-scan. A branch name is required with this option.

  Default: `null`.
</ParamField>

<ParamField path="pull_request" type="integer | null">
  The pull request number to associate the full-scan with.

  Default: `null`.
</ParamField>

<ParamField path="scan_type" type="string | null">
  The type of scan to perform. Defaults to 'socket'. Must be 32 characters or less. Used for categorizing multiple SBOM heads per repository branch.

  Default: `null`.
</ParamField>

<ParamField path="set_as_pending_head" type="boolean | null">
  Designate this full-scan as the latest scan of a given branch. Default branch head scans are included in org alerts. This is only supported on the default branch. A branch name is required with this option.

  Default: `null`.
</ParamField>

<ParamField path="tmp" type="boolean | null">
  Create a temporary full-scan that is not listed in the reports dashboard. Cannot be used when set\_as\_pending\_head=true.

  Default: `null`.
</ParamField>

<ParamField path="workspace" type="string | null">
  The workspace of the repository to associate the full-scan with.

  Default: `null`.
</ParamField>

## Fetch packages by PURL

Action ID: `tools.socket.fetch_packages_by_purl`

Fetch packages by PURL. Calls POST /v0/orgs/\{org\_slug}/purl directly.

Reference: [https://docs.socket.dev/reference/batchpackagefetchbyorg](https://docs.socket.dev/reference/batchpackagefetchbyorg)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="components" type="array[object]" required>
  API-native package components containing PURLs.
</ParamField>

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="accept" type="string">
  Response media type to request.

  Default: `"application/x-ndjson"`.
</ParamField>

<ParamField path="actions" type="string | null">
  Include only alerts with comma separated actions defined by security policy. Supported values are error, monitor, warn and ignore.

  Default: `null`.
</ParamField>

<ParamField path="alerts" type="boolean | null">
  Include alert metadata.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

<ParamField path="cachedResultsOnly" type="boolean | null">
  Legacy fallback for older clients. Only used when poll is omitted: cachedResultsOnly=true behaves like poll=false, while cachedResultsOnly=false preserves the older blocking behavior.

  Default: `null`.
</ParamField>

<ParamField path="compact" type="boolean | null">
  Compact metadata. When enabled, excludes metadata fields like author, scores, size, dependencies, and manifest files. Always includes: id, type, name, version, release, namespace, subpath, alerts, and alertPriorities.

  Default: `null`.
</ParamField>

<ParamField path="fixable" type="boolean | null">
  Include only fixable alerts.

  Default: `null`.
</ParamField>

<ParamField path="labels" type="string | null">
  Repository label slugs to apply policies. Only one label is supported currently; the parameter is an array to allow future support for multiple labels.

  Default: `null`.
</ParamField>

<ParamField path="licenseattrib" type="boolean | null">
  Include license attribution data, including license text and author information. Maps attribution/license text to a list of data objects to which that attribution info applies.

  Default: `null`.
</ParamField>

<ParamField path="licensedetails" type="boolean | null">
  Include detailed license information, including location and match strength, for each license datum.

  Default: `null`.
</ParamField>

<ParamField path="poll" type="boolean | null">
  When true, wait up to timeoutSec for pending analysis to complete before returning. When false (default), return the current known state immediately, including synthesized pendingScan and notFound alerts when alerts=true unless purlErrors=true keeps legacy not-found errors.

  Default: `null`.
</ParamField>

<ParamField path="purlErrors" type="boolean | null">
  Return errors found with handling PURLs as error objects in the stream.

  Default: `null`.
</ParamField>

<ParamField path="summary" type="boolean | null">
  Include a summary object at the end of the stream with counts of malformed, resolved, and not found PURLs.

  Default: `null`.
</ParamField>

<ParamField path="timeoutSec" type="integer | null">
  Maximum time in seconds to wait for package resolution and, when poll=true, pending analysis. Inputs that have not completed processing when the timeout is reached return pendingScan alerts when alerts=true, or errors when purlErrors=true.

  Default: `null`.
</ParamField>

## Get full scan metadata

Action ID: `tools.socket.get_full_scan_metadata`

Get full scan metadata. Calls GET /v0/orgs/\{org\_slug}/full-scans/\{full\_scan\_id}/metadata directly.

Reference: [https://docs.socket.dev/reference/getorgfullscanmetadata](https://docs.socket.dev/reference/getorgfullscanmetadata)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="full_scan_id" type="string" required>
  Socket full scan ID.
</ParamField>

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

## List full scans

Action ID: `tools.socket.list_full_scans`

List full scans. Calls GET /v0/orgs/\{org\_slug}/full-scans directly.

Reference: [https://docs.socket.dev/reference/getorgfullscanlist](https://docs.socket.dev/reference/getorgfullscanlist)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

<ParamField path="branch" type="string | null">
  A branch name to filter full-scans by.

  Default: `null`.
</ParamField>

<ParamField path="commit_hash" type="string | null">
  A commit hash to filter full-scans by.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  Specify sort direction. Supported values are asc and desc. Socket defaults to desc.

  Default: `null`.
</ParamField>

<ParamField path="from" type="string | null">
  A Unix timestamp in seconds that filters full-scans prior to the date.

  Default: `null`.
</ParamField>

<ParamField path="page" type="integer | null">
  The page number to return when using offset-style pagination. Ignored when cursor pagination is used. Socket defaults to 1.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Specify the maximum number of results to return per page. Socket defaults to 30.

  Default: `null`.
</ParamField>

<ParamField path="pull_request" type="string | null">
  A PR number to filter full-scans by.

  Default: `null`.
</ParamField>

<ParamField path="repo" type="string | null">
  A repository slug to filter full-scans by.

  Default: `null`.
</ParamField>

<ParamField path="scan_type" type="string | null">
  A scan type to filter full-scans by (e.g. socket, socket\_tier1, socket\_basics).

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  Specify Sort order. Supported values are name and created\_at. Socket defaults to created\_at.

  Default: `null`.
</ParamField>

<ParamField path="startAfterCursor" type="string | null">
  Cursor token for pagination. Pass the returned nextPageCursor from previous responses to fetch the next set of results.

  Default: `null`.
</ParamField>

<ParamField path="use_cursor" type="boolean | null">
  Set to true on the first request to opt into cursor-based pagination.

  Default: `null`.
</ParamField>

<ParamField path="workspace" type="string | null">
  A repository workspace to filter full-scans by.

  Default: `null`.
</ParamField>

## List supported files

Action ID: `tools.socket.list_supported_files`

List supported files. Calls GET /v0/orgs/\{org\_slug}/supported-files directly.

Reference: [https://docs.socket.dev/reference/getsupportedfiles](https://docs.socket.dev/reference/getsupportedfiles)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

## List threat feed items

Action ID: `tools.socket.list_threat_feed_items`

List threat feed items. Calls GET /v0/orgs/\{org\_slug}/threat-feed directly.

Reference: [https://docs.socket.dev/reference/getorgthreatfeeditems](https://docs.socket.dev/reference/getorgthreatfeeditems)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

<ParamField path="created_after" type="string | null">
  A Unix timestamp in seconds that filters results to items only created after the date.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  Order direction of the provided sort field. Supported values are desc and asc. Socket defaults to desc.

  Default: `null`.
</ParamField>

<ParamField path="ecosystem" type="string | null">
  Filter threats by package ecosystem. Supported values are github, cargo, clawhub, composer, chrome, firefox-extension, edge-extension, golang, huggingface, maven, npm, nuget, vscode, pypi, gem and swift.

  Default: `null`.
</ParamField>

<ParamField path="filter" type="string | null">
  Filter by threat classification. Supported values: mal (malware, including possible malware), vuln (vulnerability), typo (typosquat, including possible typosquat), anom (anomaly), spy (telemetry), obf (obfuscated code), dual (dual-use tool), joke (protestware or joke package), tp (all confirmed true positives), fp (false positive), u (unreviewed), c (classified, i.e. anything except unreviewed). Socket defaults to mal.

  Default: `null`.
</ParamField>

<ParamField path="is_human_reviewed" type="boolean | null">
  Only return threats which have been human-reviewed.

  Default: `null`.
</ParamField>

<ParamField path="name" type="string | null">
  Filter threats by package name.

  Default: `null`.
</ParamField>

<ParamField path="page_cursor" type="string | null">
  Page cursor token. Pass the returned nextPageCursor to this query string to fetch the next page of the threat feed.

  Default: `null`.
</ParamField>

<ParamField path="per_page" type="integer | null">
  Number of threats per page. Socket defaults to 30.

  Default: `null`.
</ParamField>

<ParamField path="sort" type="string | null">
  Set the sort order for the threat feed items. Default is descending order by updated\_at, which includes all new and updated threat feed items. Supported values are id, created\_at and updated\_at.

  Default: `null`.
</ParamField>

<ParamField path="updated_after" type="string | null">
  A Unix timestamp in seconds that filters results to items only updated after the timestamp.

  Default: `null`.
</ParamField>

<ParamField path="version" type="string | null">
  Filter threats by package version.

  Default: `null`.
</ParamField>

## Stream full scan

Action ID: `tools.socket.stream_full_scan`

Stream a full scan. Calls GET /v0/orgs/\{org\_slug}/full-scans/\{full\_scan\_id} directly.

Reference: [https://docs.socket.dev/reference/getorgfullscan](https://docs.socket.dev/reference/getorgfullscan)

### Secrets

Required secrets:

* `socket`: required values `SOCKET_API_TOKEN`.

### Input fields

<ParamField path="full_scan_id" type="string" required>
  Socket full scan ID.
</ParamField>

<ParamField path="org_slug" type="string" required>
  Socket organization slug.
</ParamField>

<ParamField path="accept" type="string">
  Response media type to request.

  Default: `"application/x-ndjson"`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Socket API.

  Default: `null`.
</ParamField>

<ParamField path="cached" type="boolean | null">
  Return cached immutable scan results. When enabled and results are cached, returns the pre-computed scan. When results are not yet cached, returns 202 Accepted and enqueues a background job.

  Default: `null`.
</ParamField>

<ParamField path="include_alert_priority_details" type="string | null">
  Control which alert priority fields to include in the response. Set to "true" to include all fields, "false" to exclude all fields, or specify individual fields like "components,formula" to include only those fields.

  Default: `null`.
</ParamField>

<ParamField path="include_license_details" type="boolean">
  Include license details in the response. This can increase the response size significantly.

  Default: `false`.
</ParamField>

<ParamField path="include_scores" type="boolean">
  Include scores event in the response. include\_scores\_details implies this flag.

  Default: `false`.
</ParamField>

<ParamField path="include_scores_details" type="string | null">
  Control which score detail fields to include in the scores event. Set to "true" to include all fields, "false" to exclude all fields, or specify individual fields like "components,formula" to include only those fields.

  Default: `null`.
</ParamField>