@socketsecurity/sdk

@socketsecurity/sdk

Official SDK for Socket.dev - Programmatic access to security analysis, vulnerability scanning, and compliance monitoring for your software supply chain.

Installation

pnpm add @socketsecurity/sdk

Quick Start

import { SocketSdk } from '@socketsecurity/sdk'

const client = new SocketSdk('your-api-key', {
  retries: 3,        // Retry failed requests up to 3 times
  retryDelay: 1000,  // Start with 1s delay, exponential backoff
  timeout: 30000,    // 30 second timeout
})

// Check your quota
const quota = await client.getQuota()
if (quota.success) {
  console.log(`Available quota: ${quota.data.quota} units`)
}

// Analyze a package
const result = await client.getScoreByNpmPackage('express', '4.18.0')
if (result.success) {
  console.log(`Security Score: ${result.data.score}/100`)
}

// Batch analyze multiple packages
const batchResult = await client.batchPackageFetch({
  components: [
    { purl: 'pkg:npm/express@4.18.0' },
    { purl: 'pkg:npm/react@18.0.0' }
  ]
})

→ Configuration Options

API Methods

Package Analysis - Quick security checks

batchPackageFetch() • batchPackageStream() • getIssuesByNpmPackage() • getScoreByNpmPackage()

→ Documentation

Scanning & Analysis - Project scanning

createDependenciesSnapshot() • createOrgFullScan() • createScanFromFilepaths() • getScan() • getScanList() • getSupportedScanFiles()

→ Documentation

Organization Management - Orgs and repos

getOrganizations() • createOrgRepo() • getOrgRepo() • getOrgRepoList() • updateOrgRepo() • deleteOrgRepo()

→ Documentation

Policy & Settings - Security configuration

getOrgSecurityPolicy() • updateOrgSecurityPolicy() • getOrgLicensePolicy() • updateOrgLicensePolicy() • postSettings()

→ Documentation

Full Scan Management - Deep analysis

getOrgFullScanList() • getOrgFullScanMetadata() • getOrgFullScanBuffered() • streamOrgFullScan() • deleteOrgFullScan()

→ Documentation

Diff Scans - Compare scans

createOrgDiffScanFromIds() • getDiffScanById() • listOrgDiffScans() • deleteOrgDiffScan()

→ Documentation

Patches & Vulnerabilities - Security fixes

streamPatchesFromScan() • viewPatch()

→ Documentation

Alert & Triage - Alert management

getOrgTriage() • updateOrgAlertTriage()

→ Documentation

Export & Integration - SBOM export

exportCDX() • exportSPDX() • searchDependencies() • uploadManifestFiles()

→ Documentation

Repository Labels - Categorization

createOrgRepoLabel() • getOrgRepoLabel() • getOrgRepoLabelList() • updateOrgRepoLabel() • deleteOrgRepoLabel()

→ Documentation

Analytics & Monitoring - Usage metrics

getQuota() • getOrgAnalytics() • getRepoAnalytics() • getAuditLogEvents()

→ Documentation

Authentication & Access - API tokens

getAPITokens() • postAPIToken() • postAPITokensRotate() • postAPITokensRevoke() • postAPITokenUpdate()

→ Documentation

Entitlements - Feature access

getEnabledEntitlements() • getEntitlements()

→ Documentation

Quota Utilities - Cost helpers

getQuotaCost() • getRequiredPermissions() • calculateTotalQuotaCost() • hasQuotaForMethods() • getMethodsByQuotaCost() • getMethodsByPermissions() • getQuotaUsageSummary() • getAllMethodRequirements()

→ Documentation

Advanced Query Methods - Raw API

getApi() • sendApi()

→ Documentation

→ Complete API Reference

→ Usage Examples

→ Quota Management - Cost tiers: 0 units (free), 10 units (standard), 100 units (batch/uploads)

→ Testing Utilities - Mock factories, fixtures, and type guards for SDK testing

See Also

• Socket.dev API Reference - Official API documentation
• Socket CLI - Command-line interface
• Socket GitHub App - GitHub integration

License

MIT

Changelog

1.11.1 - 2025-10-06

Added

• Performance optimizations with memoization for normalizeBaseUrl and quota utility functions
• Performance tracking to HTTP client functions
• Comprehensive error handling tests for SDK methods across organization, scanning, and batch APIs
• Reusable assertion helpers for SDK tests

Changed

• Improved test coverage and reliability with additional test cases
• Streamlined documentation (README, TESTING.md, QUOTA.md, EXAMPLES.md) for better clarity and discoverability