Policy methods cover policy and rule CRUD, alert resolution creation, migration status, and triage translation. Write options accept dry_run. Results retain the HTTP status, including 200 for previews and 201 for creation. Policy identifiers can include the virtual default policy.

Check getOrgAlertPolicyMigrationStatus before using legacy policy writes. Migration gates can reject legacy writes with 409. Migration status requires alert-policy:list. Translation accepts any one of triage:alerts-update, alert-policy:read, or alert-resolution:create. It returns translations and untranslatable entries without writing a policy.

getOrgPurlVersions uses v1. It preserves server ordering and nullable publishedAt and prerelease fields. Its optional limit must be a positive integer.

getOrgFixes accepts exactly one of repo_slug, full_scan_id, or tar_hash. It also accepts autofix_run_id and include_all_detected_ghsas. Its typed results distinguish available fixes, partial fixes, unavailable fixes, inapplicable fixes, and computation failures.

Public clients do not inherit credentials from SocketSdk. They send no automatic telemetry.

SocketPurlClient supports PURL lookup, buffered batches, streaming batches, and organization batches. Proxy query options include alerts, actions, compact, fixable, licenseattrib, licensedetails, purlErrors, and cachedResultsOnly. Organization calls also accept one labels string. Unsupported proxy options are rejected.

Set apiToken for a static credential or authProvider to resolve a credential for each request. The provider returns a token and its basic or bearer scheme. Provider credentials take precedence over a valid static token. A provider failure stops the request and does not select anonymous access. Omitted or undefined credentials leave public PURL methods anonymous.

const purlClient = new SocketPurlClient({
  authProvider: async () => ({
    token: await refreshApplicationToken(),
    authScheme: 'bearer',
  }),
})

const result = await purlClient.batchOrgPackageFetch('example-org', {
  components: [{ purl: 'pkg:npm/example-package@1.0.0' }],
})

The provider function must be valid. If you also set apiToken, the client validates it even when the provider supplies request credentials.

SocketPatchClient supports searches by CVE, GHSA, and package; patch views; batch searches; free package download grants; blobs; and diffs. Binary methods return bytes. They do not extract or execute downloaded content.

SocketPublicMalwareClient.checkPackages posts package PURLs to the public v1 malware check endpoint. It preserves input order and duplicate entries. Results use confirmed_malware, no_known_malware, unknown, unsupported, or error. no_known_malware reports complete observations for the request; it does not prove that a package is safe. The optional candidateRevision is request context only. Results use reuse: 'none' and do not establish a reusable revision.

This client rejects credential options and URLs with user information. It does not read credentials from the environment or keychain. The production route must be deployed and available before applications adopt this client; a disabled route returns an unsuccessful 404 result.

const publicMalwareClient = new SocketPublicMalwareClient()
const result = await publicMalwareClient.checkPackages({
  packages: [{ purl: 'pkg:npm/example-package@1.0.0' }],
})

checkMalware uses public PURL analysis and returns one entry per input, including duplicate inputs. Each entry has inputPurl and a status: complete, pending, not_found, or error. An empty alert list establishes completed analysis only when the status is complete.