## Queries - auditLog: undefined - auditLogs: undefined - auditLogFilterOptions: undefined - agents: undefined - agent: undefined - agentAudit: undefined - topAgentCountByOwner: undefined - topAgentCountByEnvironment: undefined - topAgentCountByPlatform: undefined - topAgentCountByAIPlatform: undefined - topAgentCountByAccessibility: undefined - topAgentCountByDataSource: undefined - topAgentCountByFindingType: undefined - topAgentsByTokenCount: Agents ranked by approximate token volume inside `before`/`after`, highest first. This is the only token figure that respects the requested window, so it is what a "usage in the last N days" question needs; repeat it per day to build a daily series. Agents with no measurable volume are omitted, and `limit` truncates by rank, so the returned rows do not sum to a tenant total. Capsule has no server-side rollup of token volume by owner, model, platform or day, and no cost data at all. Where an agent represents one person's assistant the ranking doubles as per-user consumption. See `Agent.tokenCount` for how it is estimated. - auditTimeline: undefined - listEnvironments: undefined - listPlatforms: undefined - aiPlatforms: undefined - listTools: undefined - usageRange: Bounds for the activity-count filter slider. `min` is always 0; `max` is the highest single-agent count. - tokenCountRange: Bounds for the token filter slider. `min` is always 0; `max` is the highest single-agent total, not a tenant sum. - lastSessionRange: undefined - listFoundationalModels: undefined - complianceFrameworks: List all supported compliance frameworks, optionally filtered. - complianceFramework: Get a single compliance framework by its identifier. - detection: undefined - detections: Every detection in the tenant matching `filter`, across all anchor resource types. - finding: Get a single finding by ID - findings: Get findings by resource ID - flows: undefined - flow: undefined - organizationIdpGroups: IdP groups available on the organization's SSO connection (requires SCIM group sync). - idpGroupRoleMappings: IdP group -> Capsule role mappings configured for the current tenant. - integrations: undefined - platforms: undefined - integration: undefined - tools: undefined - tool: undefined - dataSources: undefined - dataSource: undefined - accessChannels: undefined - accessChannel: undefined - skills: undefined - skill: undefined - skillsGroups: undefined - topSkillByName: undefined - devices: undefined - device: undefined - models: undefined - model: undefined - modelsGroups: undefined - inventoryCategories: undefined - listToolTypes: undefined - topToolByExternalType: undefined - mcpServerOptions: undefined - listDataSourceTypes: undefined - listSkillTypes: undefined - mcpServers: undefined - mcpServer: undefined - mcpServerEndpoints: undefined - notificationChannels: undefined - notificationChannel: undefined - notificationIntegration: undefined - notificationChannelLimit: undefined - owners: undefined - ownerDepartments: Distinct owner departments across the tenant, for the inventory department filter. `search` matches department names case-insensitively. - ownerGroups: Distinct owner groups across the tenant, for the inventory group filter. `search` matches group names case-insensitively. - ownerVerticals: Distinct owner verticals across the tenant, for the policy mapping filter. `search` matches vertical names case-insensitively. - ownerBusinessUnits: Distinct owner business units across the tenant, for the policy mapping filter. `search` matches business unit ids case-insensitively. - ownerEmployeeTypes: Distinct owner employee types across the tenant, for the policy mapping filter. `search` matches employee type names case-insensitively. - policies: Get a list of policies with optional filtering and sorting - policyTemplates: Get default policy templates (static, no tenant context needed) - policy: Get a specific policy by ID - policyTriggerTypes: Get available trigger types for building policy UI dynamically. Optional triggerType parameter for future filtering support. - policyActionTypes: Get available action types for building policy UI dynamically. Optional triggerType parameter for future context-aware filtering (e.g., only show actions valid for the selected trigger). - policyFilterOptions: Get filter options for policies including dynamic ranges for numeric and date fields. Returns min/max values for violationsCount, and lastExecutedAt. - previewPolicyImpact: Preview the impact of a policy before applying it. Shows matching entities and estimated violation impact (create/update/close counts). - policyCountsBySeverity: How many policies are configured to file issues at each severity. This counts policy configuration, not observed risk - it says nothing about how many violations or issues exist at a given severity. For actual risk, query `violations` with a severity filter. - policyCountsByMode: How many policies are configured in each mode. Counts policy configuration, not activity. - reputations: Browsable reputation catalog — usable internally or as an open-source catalog surface. Defaults to the riskiest artifacts first (RISK_LEVEL DESC, then NAME ASC) when `orderBy` is omitted. - reputation: undefined - serviceAccounts: undefined - serviceAccount: undefined - session: undefined - sessions: Paginated list of sessions matching the filter. Defaults to TIMESTAMP DESC when `orderBy` is omitted. - activities: Returns individual activities (not grouped by session) matching the filter. Used for inventory item detail pages (tools, skills) that display an infinite-scrolling activity feed scoped to a specific resource via the filter's tool/skill/dataSource sub-filters. Defaults to TIMESTAMP DESC when `orderBy` is omitted. - activitiesTimelineChart: undefined - listSessionParticipants: Participants (by user email) ranked by the number of sessions they took part in. Only `filter.dateRange` is applied: it bounds the sessions to those with a user message that occurred inside the window. Other SessionFilter fields are ignored. - users: Get a list of users with optional filtering and sorting - organizationConfiguration: Get SSO configuration for an organization - organizationScimConfiguration: Get SCIM provisioning configuration for an organization - violation: undefined - violations: undefined - customRoles: undefined - customRole: undefined - tenantRoles: Every role assignable to a user in the current tenant: the built-in system roles followed by the tenant's custom roles. - siemIntegrations: List the current tenant's SIEM integrations. - tenantSettings: Get the current tenant's settings. ## Mutations - syncAgent: undefined - syncFlow: undefined - setIdpGroupRoleMapping: Create or update the role granted to members of an IdP group in the current tenant. - deleteIdpGroupRoleMapping: Remove an IdP group -> role mapping from the current tenant. - createIntegration: undefined - deleteIntegration: undefined - updateIntegrationName: undefined - startIntegrationInstallation: undefined - applyIntegrationConfig: undefined - updateIntegrationStatus: undefined - syncIntegration: undefined - testIntegrationConnection: undefined - syncMcpServer: undefined - createNotificationChannel: undefined - updateNotificationChannel: undefined - deleteNotificationChannel: undefined - testNotificationChannel: undefined - validateSlackChannel: undefined - disconnectSlack: undefined - updateSlackDefaults: undefined - configureSentinelDestination: undefined - disconnectSentinel: undefined - configureTeamsWebhook: undefined - configureEmailChannel: undefined - configureFreshserviceChannel: undefined - createPolicy: Create a new policy - updatePolicy: Update an existing policy - updatePolicyMode: Update policy mode - deletePolicy: Delete a policy - duplicatePolicy: Duplicate an existing policy as a draft copy - flag: undefined - unflag: undefined - createServiceAccount: undefined - updateServiceAccount: undefined - addServiceAccountSecret: undefined - revokeServiceAccountSecret: undefined - deleteServiceAccount: undefined - markDetectionTriage: Apply or clear a triage verdict on a v2 detection. Restricted to ADMIN and SECURITY_ADMIN roles. Marking as FALSE_POSITIVE or IGNORED flips linked CapsuleIssues to Ignored; clearing or marking as TRUE_POSITIVE leaves issue status unchanged. - markFindingTriage: Apply or clear a triage verdict on a v2 resource finding. Restricted to ADMIN and SECURITY_ADMIN roles. Marking as FALSE_POSITIVE or IGNORED flips linked CapsuleIssues to Ignored; clearing or marking as TRUE_POSITIVE leaves issue status unchanged. - markViolationTriage: Apply or clear a triage verdict on a violation. Restricted to ADMIN and SECURITY_ADMIN roles. Marking as FALSE_POSITIVE or IGNORED flips the violation to Ignored; clearing or marking as TRUE_POSITIVE leaves its status unchanged. - updateManyViolationTriage: Apply or clear a triage verdict on every violation matching `filter`, minus `excludeIds`. Use for "select all matching" scenarios - the server resolves the set, so no bound is placed on how many violations are affected. Restricted to ADMIN and SECURITY_ADMIN roles. Side-effects match `markViolationTriage`: FALSE_POSITIVE and IGNORED flip each violation to Ignored, while clearing or marking TRUE_POSITIVE leaves status unchanged. - batchUpdateViolationTriage: Apply or clear a triage verdict on the given violations. Use for explicit selection scenarios. Restricted to ADMIN and SECURITY_ADMIN roles; side-effects match `markViolationTriage`. - updateUser: undefined - removeUserFromTenant: undefined - createUser: undefined - setOrganizationSSOConfiguration: Configure SSO for an organization - clearOrganizationSSOConfiguration: Clear SSO configuration for an organization - enableOrganizationScim: Enable SCIM provisioning on the organization's existing SSO connection - disableOrganizationScim: Disable SCIM provisioning on the organization's SSO connection - createOrganizationScimToken: Create a SCIM provisioning token. The secret is returned only once. - revokeOrganizationScimToken: Revoke a SCIM provisioning token by id - createCustomRole: undefined - updateCustomRole: undefined - deleteCustomRole: undefined - createSiemIntegration: Create a SIEM integration for the current tenant. Restricted to tenant admins. - updateSiemIntegration: Update one of the current tenant's SIEM integrations. Restricted to tenant admins. - deleteSiemIntegration: Delete one of the current tenant's SIEM integrations. Restricted to tenant admins. - updateTenantSettings: Update the current tenant's settings. Restricted to tenant admins. ## Directives - include: Directs the executor to include this field or fragment only when the `if` argument is true. - skip: Directs the executor to skip this field or fragment when the `if` argument is true. - deprecated: Marks an element of a GraphQL schema as no longer supported. - specifiedBy: Exposes a URL that specifies the behavior of this scalar. - oneOf: Indicates exactly one field must be supplied and this field must not be `null`. ## Unions - EvidenceItem: Evidence item that can be either a citation (contextual information) or a leaked value (sensitive data that has been redacted). The frontend should handle highlighting based on the type. - FlowStepResource: undefined - PolicyActionParams: Union of all possible policy action parameters - EvidenceGraphNode: undefined - AssessmentScopeItemPreview: Union of all scope item preview types - ActivityAnchor: The entity a session/activity is anchored on. Sessions are anchored on the unified resource registry, where the anchor may be an agent or a flow. - TimelineIndicatorItem: undefined ## Scalars - ID: The `ID` scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as `"4"`) or integer (such as `4`) input value will be accepted as an ID. - Int: The `Int` scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1. - String: The `String` scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text. - Boolean: The `Boolean` scalar type represents `true` or `false`. - DateTime: undefined - JSON: undefined - Float: The `Float` scalar type represents signed double-precision fractional values as specified by [IEEE 754](https://en.wikipedia.org/wiki/IEEE_floating_point). ## Interfaces - Activity: Shape shared by every activity, runtime or posture. `type` lives on the family interfaces instead: each family has its own enum, and GraphQL does not allow an implementing type to narrow an interface's enum field. - AuditLog: undefined - AgentSettings: Base settings interface shared across all agent platforms. - Node: undefined - Platform: undefined - ChartBucket: One category, time interval or numeric range on a chart's axis. `key` is the stable machine value a client filters by; `label` is display text. `isNull` marks the bucket that holds items with no value on the axis field - a distinct concept from a bucket whose count happens to be zero. - ChartSeries: `data` is index-aligned to the chart's buckets. Elements are nullable on purpose: null means "not observed", 0 means "observed as zero". - Human: undefined - InventoryItem: undefined - LifecycleActivity: Inventory resource lifecycle activities (epic #6120). These are posture events about an inventory item - no session, no agent, no runtime semantics - so they live in their own table and are read through the owning resource rather than the runtime `activities` connection. - NotificationChannel: undefined - ReputationAssessment: Security reputation for a supply-chain artifact — its provenance and behavioral assessment (risk-relevant behaviors + assessed risks). A subject-agnostic interface: concrete subtypes (McpReputationAssessment today; SkillReputationAssessment in the near future) are discriminated by __typename and add domain-specific fields. - Flaggable: undefined - SessionActivity: Something an agent did during a runtime session. ## Enums - ActivityFilterType: Activity types that are worth filtering on in policy conditions. Deliberately narrower than the persisted activity types, which also carry lifecycle and bookkeeping events nobody filters by. - AuditSource: undefined - AuditCategory: undefined - AuditType: undefined - AuditLogOrderByField: undefined - AgentIdentityMatchMethod: How an identity was linked to the agent: EXACT when the agent's own platform reported the identity's object id, DISPLAY_NAME when the link was inferred from a matching display name. - AgentAccessibility: undefined - AgentIdentityType: Whether the agent acts on behalf of the user operating it (e.g. coding agents, personal GPTs) or runs standalone under its own identity (e.g. workspace GPTs, Copilot Studio bots, managed Bedrock agents). - EdgeDirection: undefined - EdgeType: undefined - PlatformType: undefined - SettingsScope: Scope at which a setting is defined. Higher scopes take precedence. - EffortLevel: undefined - ClaudeLoginMethod: undefined - EnvironmentType: undefined - IntegrationPlatformReleaseStage: undefined - AgentAuditType: undefined - AgentOrderByField: undefined - PlatformCategory: undefined - Trend: undefined - HeatmapLevel: Quantile band a cell falls into, computed server-side over the chart's own value set. Shipped alongside the raw value rather than left to the client so two heatmaps on one page bin identically, and so a truncated matrix stays binnable by a client that never received the omitted rows. NONE is reserved for an observed zero. A cell with no observation at all carries a null value and no level. - Weekday: Explicit and echoed back, because ISO Monday-start is the norm outside the US and a SOC rota will not agree with a US consumer product. - ChartGranularity: undefined - ChartPeriod: undefined - ChartAggregateOperation: undefined - DetectionHeatmapField: AGENT is the detection's anchor resource. On a resource-scoped connection it collapses to a single bucket, so SESSION is the axis that varies there. - ViolationChartField: undefined - SortDirection: undefined - ComplianceFrameworkType: Supported compliance framework identifier. - EvidenceUnavailableReason: Why supporting evidence cannot be shown for a detection or finding. - DetectionType: undefined - DetectionOrderByField: undefined - DetectionChartField: TYPE partitions the set - a detection has exactly one type. RESOURCE_TYPE also partitions it, since a detection has exactly one anchor resource. - GraphNodeType: Node type discriminator — maps to concrete type __typename values. - FindingType: undefined - FindingOrderByField: undefined - FlowStatus: undefined - FlowType: Categorization of AI agent flows — only flows involving at least one AI agent are in scope. - StepType: undefined - ConnectionType: undefined - FlowOrderByField: undefined - IntegrationStatus: undefined - AzureConnectivityMode: How Capsule reaches an Azure AI Foundry account. `PUBLIC` ingests over the public endpoint (default). `PRIVATE_LINK` provisions an Azure Private Endpoint in Capsule's hub VNet that targets the customer's Foundry account; the customer must approve the pending connection out-of-band before ingestion can succeed. - AzurePrivateEndpointStatus: Lifecycle of the Private Endpoint Capsule creates for a PRIVATE_LINK connection. PENDING_APPROVAL means the ARM request succeeded and the customer must approve the connection in their Azure portal; FAILED means the request could not be issued (see `error`); CONFIG_MISSING means Capsule's hub infrastructure is not configured for private-link installs. - IntuneDistributionStatus: undefined - IntuneAuthorizationMode: undefined - IntuneApprovalOperation: undefined - IntuneApprovalScriptRole: undefined - IntuneApprovalFlow: Which multi-step chain an approval belongs to. Install, update and delete share STANDARD; UNINSTALL marks the deliver-cleanup-then-remove-install sequence. - IntuneDistributionComponent: undefined - IntuneApprovalState: undefined - IntuneConsentPhase: undefined - IntuneDistributionMechanism: Which Intune object carries a distribution. A remediation re-checks every assigned device on a schedule; a platform script runs once per device. - JamfDistributionStatus: undefined - InventoryCategoryType: undefined - ToolProtocol: undefined - ToolOrderByField: undefined - DataSourceOrderByField: undefined - AccessChannelOrderByField: undefined - SkillOrderByField: undefined - DeviceOrderByField: undefined - ModelLocation: undefined - ModelOrderByField: undefined - ModelsGroupByKey: undefined - ToolsGroupByKey: undefined - SkillsGroupByKey: undefined - LifecycleActivityType: undefined - McpProtocol: Transport used to reach the MCP server. The MCP application protocol is always `MCP`; this enum distinguishes the wire transport so the UI and detections can reason about it (e.g. STDIO endpoints are local-only). - McpLocation: undefined - McpAuthType: undefined - McpServerOrderByField: undefined - NotificationProviderType: undefined - NotificationChannelStatusType: undefined - NotificationIntegrationStatusType: undefined - NotificationChannelErrorCode: undefined - OwnerOrderByField: undefined - PolicySeverity: undefined - PolicyMode: Enforcement mode of a policy - PolicyTriggerType: Types of events that can trigger a policy - PolicyResourceType: Resource types a POSTURE policy can be scoped to - PolicyActionType: Types of actions a policy can execute - PolicyOrderByField: Fields available for sorting policies - EnvironmentTypeEnum: Environment type enumeration for categorizing environments - PrecisionTier: undefined - ReputationRiskLevel: Overall reputation classification of an artifact. - McpSourceType: How an MCP is packaged at its source. - ReputationSignatureStatus: undefined - ReputationBehavior: undefined - ReputationOrderByField: undefined - SessionActivityType: undefined - ToolCallStatus: undefined - IndicatorType: undefined - SessionOrderByField: undefined - ActivityOrderByField: undefined - TriageVerdict: User-applied triage verdict on a v2 detection or finding. - FALSE_POSITIVE: confirms the observation is not a real issue. Linked CapsuleIssues are flipped to Ignored and policy processor v2 filters the observation out of subsequent evaluations. - TRUE_POSITIVE: acknowledges the observation as a real issue. Recorded for audit purposes only — issue status is left unchanged. - IGNORED: suppresses the observation without asserting it is a false positive. Same side-effects as FALSE_POSITIVE (linked CapsuleIssues are flipped to Ignored, observation is filtered from subsequent policy runs) but recorded as a distinct verdict. - UserStatus: User account status - SSOStrategy: SSO strategy type - ScimIdpProvider: The identity provider behind the organization's SAML connection. Selects the SCIM attribute mapping preset applied when provisioning is enabled. - ViolationFunnelStage: Stages of the violation impact funnel, in enum order: the monitored inventory, the risk signals found on it, the violations they produced, and the critical subset. FINDINGS and DETECTIONS are alternative second stages - posture views request FINDINGS, runtime views request DETECTIONS. - ViolationStatus: Lifecycle status of a violation. OPEN is live; IGNORED and RESOLVED are triaged away. - ViolationOrderByField: Fields available for sorting violations - ViolationGroupByField: Fields available for grouping violations. Grouping is implemented as a primary sort key that clusters consecutive rows into groups on the flat connection. - ViolationGroupOrderByField: Orders the `groups` list. KEY orders by the group key itself (policy name, owner name, severity rank, calendar day). COUNT orders by group size, so the axis reads as a ranking of where violations concentrate. - PermissionKey: A permission that can be granted to a custom role. Mirrors the backend permission key registry; values are the SCREAMING_SNAKE form of the underlying `area:action` key. - TenantRoleKind: Whether a role is one of the built-in system roles or a tenant-defined custom role. - SiemIntegrationType: undefined - SiemEventVerbosity: How much of each event is sent. FULL carries the whole envelope; COMPACT drops activity message bodies, which dominate an envelope's size, for destinations billed by ingested volume. - SiemDeliveryStatus: Outcome of the most recent delivery attempt for this integration. ## Objects - ActivityTypeFilterOutput: undefined - AuditActor: undefined - AdminAuditLog: undefined - AuditLogEdge: undefined - AuditLogConnection: undefined - AuditLogFilterOptions: undefined - AgentIdentityBlueprint: undefined - AgentIdentityOwner: undefined - AgentIdentity: An agent identity registered in an identity provider (Microsoft Entra Agent ID). - Agent: undefined - AgentModel: undefined - SettingsKeyValuePair: A key-value pair for environment variables, model overrides, and similar maps. - PermissionRules: Permission rules controlling which tools/actions are allowed or denied. - NetworkSettings: Network sandbox settings controlling outbound traffic and proxy configuration. - FilesystemSettings: Filesystem sandbox settings controlling read/write access. - SandboxSettings: Sandbox configuration controlling bash command isolation from filesystem and network. - ClaudeAgentSettings: Claude Code-specific agent settings. See: https://code.claude.com/docs/en/settings - Environment: undefined - Edge: undefined - IntegrationPlatform: undefined - AgentAudit: undefined - AgentAuditResponse: undefined - AuditTimelineEntry: undefined - AgentCountByEnvironment: undefined - AgentCountByPlatform: undefined - AgentCountByAccessibility: undefined - AgentCountByDataSource: undefined - AgentCountByFindingType: undefined - AgentTokenCount: undefined - AccessibilityFilterOutput: undefined - EnvironmentTypeFilterOutput: undefined - EnvironmentFilterOutput: undefined - PlatformTypeFilterOutput: undefined - PlatformFilterOutput: undefined - PlatformOption: undefined - ToolOption: undefined - SeverityDistribution: undefined - AgentHealthStats: undefined - DetectionsByTypeAggregation: undefined - DetectionsAggregation: undefined - AgentAggregations: undefined - AgentsResponse: undefined - Usage: undefined - FoundationalModelOption: undefined - AggregateValue: An aggregate that may be exact or estimated. Any metric whose exact computation is unbounded (owner rollups, whole-table counts) must be free to degrade to an estimate rather than time out or silently lie. - NamedMetric: undefined - CategoryBucket: undefined - BasicChartSeries: undefined - HeatmapScale: The legend. `thresholds` are the upper bounds of the first three quartiles, so a client can render a legend and tooltips without recomputing quantiles, and without needing the rows a truncated chart withheld. Never a color: a palette on the wire cannot survive two themes. - HeatmapCell: One cell. `value` is null when nothing was observed, which is distinct from an observed zero - the same rule as ChartSeries.data. - CalendarHeatmapWeek: undefined - CalendarHeatmapDay: undefined - CalendarHeatmapSeverityCount: undefined - CalendarHeatmapMonth: `totalWeeks` is the column span of this month's label in the rendered grid, counting weeks that *start* in the month. - TimeWindow: undefined - DetectionHeatmapChart: undefined - DetectionCalendarHeatmapChart: undefined - ViolationHeatmapChart: undefined - ViolationCalendarHeatmapChart: undefined - DetectionsConnection: undefined - ViolationConnection: undefined - BooleanFilterOutput: undefined - StringFilterOutput: undefined - DateTimeFilterOutput: undefined - UsageRange: undefined - DateRange: undefined - PageInfo: undefined - BatchCount: Count breakdown for batch operations. - BatchPayload: Response for batch mutation operations. Deliberately carries counts only - a list of affected IDs is unbounded for filter-based operations. - ComplianceFramework: A compliance framework containing a versioned set of controls. - FrameworkControl: A single control within a compliance framework (e.g. "ASI01: Agent Goal Hijack"). - ComplianceFrameworkEdge: undefined - ComplianceFrameworkConnection: undefined - ComplianceControlCoverageChart: Covered vs uncovered control counts per framework, over the frameworks the connection's filter selected. `totalCount` is the number of controls the chart was computed over, not the number of frameworks, so the two series always sum to it. Buckets are frameworks because a per-control axis would only ever plot ones and zeros - the controls themselves are already available on `ComplianceFramework.controls`. - ComplianceCoverageMetricsChart: Coverage posture as a single set of headline numbers, computed from one read of the policy set so the parts cannot disagree with each other. `COVERAGE_RATIO` is a fraction between 0 and 1, not a percentage, and is 0 when there are no controls in scope rather than null - an empty framework selection covers nothing. - Policy: Represents a policy that evaluates agent events and creates issues - Detection: undefined - EvidenceUnavailable: Explains why evidence is missing, so clients can tell expected data expiry apart from a failure. - CitationEvidence: Citation evidence that references contextual information related to the detection. Use this for highlighting relevant text excerpts, context, or explanations. - LeakedValueEvidence: Evidence containing sensitive values that have been redacted for security. The text field contains the already-redacted content with placeholders. - DetectionTypeAggregation: undefined - DetectionFilterOutput: undefined - DetectionTypeFilterOutput: undefined - DetectionConnection: Paginated list of detections for a resource node. - DetectionBreakdownChart: Categorical breakdown of detections. Every axis is single-valued per detection, so the buckets partition the set and the series always sums to `totalCount` minus whatever `omittedBucketCount` reports. - OwnersConnection: Paginated list of resource owners. - FindingNode: undefined - FindingsConnection: Paginated list of findings for a resource node. - FindingFilterOutput: Filter for findings (output - mirrors FindingFilter input) - FindingTypeFilterOutput: Filter for finding types (output - mirrors FindingTypeFilter input) - FindingsByTypeAggregation: undefined - FindingsAggregation: undefined - Flow: undefined - FlowGraph: undefined - Position: undefined - FlowStep: undefined - FlowStepEdge: Edge connecting two flow steps — the graph may contain cycles. - FlowEdge: undefined - FlowConnection: undefined - Tool: undefined - DataSource: undefined - AccessChannel: undefined - DetectionNode: undefined - SessionNode: undefined - AgentNode: undefined - ToolNode: undefined - DataSourceNode: undefined - AccessChannelNode: undefined - Skill: undefined - SkillNode: undefined - ModelNode: undefined - ActorNode: undefined - McpNode: MCP server node for the discovery graph. - FlowNode: AI agent flow node for the discovery graph. Carries the flow's category (`flowType`) and lifecycle (`flowStatus`); the heavy inline DAG stays on the standalone `flow(id)` query and is intentionally absent here. - McpConnection: Paginated list of MCP server nodes. - ToolsConnection: Paginated list of tools. - DataSourcesConnection: Paginated list of data sources. - AccessChannelsConnection: Paginated list of access channels. - SkillsConnection: Paginated list of skills. - AgentsConnection: Paginated list of agents. - ModelsConnection: Paginated list of models. - DeviceNode: Endpoint device node for the graph. - OwnerNode: Owner node for the graph. - DevicesConnection: Paginated list of endpoint devices. - Actor: undefined - Participant: undefined - IdpGroup: An SSO IdP group discovered from the organization's SSO connection (SCIM-synced). - IdpGroupRoleMapping: A mapping from an IdP group to a Capsule role within a tenant. `roleId` is a `TenantRole.id`: a system role key or a custom role's UUID. - Integration: undefined - IntegrationEnvironment: undefined - IntegrationParams: Platform-specific runtime state container. Sub-fields are populated only for the matching integration type and are null otherwise. - AzureAiFoundryDiscoveredProject: A Foundry project discovered during the OAuth callback. `isPublic` is derived from ARM `publicNetworkAccess` on both the account and the project, plus the account's `networkAcls.defaultAction` — a project is treated as private when either reports network access disabled or the account restricts access to selected networks and private endpoints (`networkAcls.defaultAction: Deny`). - AzureAiFoundryPrivateEndpoint: Per-account Private Endpoint state for a PRIVATE_LINK install. One entry per unique private Foundry account once `approveAzureAiFoundryPrivateEndpoints` has been invoked. - AzureAiFoundryIntegrationParams: undefined - IntuneIntegrationParams: undefined - JamfIntegrationParams: undefined - IntegrationsResponse: undefined - PlatformsResponse: undefined - IntegrationInstallationResponse: undefined - CursorHooksConfigJson: undefined - CursorScriptFile: undefined - CursorManualConfig: undefined - CursorConfig: undefined - ClaudeCodeWindowsArchiveFile: undefined - ClaudeCodeManualConfig: undefined - ClaudeCodeCloudCommands: undefined - ClaudeCodeConfig: undefined - GitHubCopilotHooksConfigJson: undefined - GitHubCopilotScriptFile: undefined - GitHubCopilotManualConfig: undefined - GitHubCopilotConfig: undefined - WindsurfManagedConfig: undefined - WindsurfConfig: undefined - ClaudeCoworkConfig: undefined - ClineManualConfig: undefined - ClineConfig: undefined - CodexScriptFile: undefined - CodexManualConfig: undefined - CodexManagedConfig: undefined - CodexConfig: undefined - AntigravityScriptFile: undefined - AntigravityManualConfig: undefined - AntigravityConfig: undefined - OpenClawConfig: undefined - HermesConfig: undefined - BifrostConfig: undefined - LiteLlmConfig: undefined - OpenWebUiConfig: undefined - GenericWebhookConfig: undefined - ClaudeInferenceHooksConfig: undefined - KiroManualConfig: undefined - KiroCloudCommands: undefined - KiroConfig: undefined - IntegrationTestResult: undefined - IntegrationTestError: undefined - IntegrationFieldError: undefined - IntuneDistributionApproval: undefined - IntuneDistributionHealth: Aggregated Intune Remediations run results for the distribution's detection script. Null until Intune has reported at least one device run. - IntuneDistribution: undefined - JamfDistributionScopeGroup: A computer group a distribution is scoped to, with the display name resolved at apply time. The name may be stale if the group was renamed in Jamf since. - JamfDistribution: undefined - McpMetadata: undefined - InventoryCategory: undefined - InventoryCategoriesResponse: undefined - InventoryAgent: undefined - ExecutionsSummary: undefined - AccessSummary: undefined - InventoryToolListItem: undefined - InventoryTool: undefined - InventoryDataSourceListItem: undefined - InventoryDataSource: undefined - InventoryAccessChannelListItem: undefined - InventoryAccessChannel: undefined - InventorySkillListItem: undefined - InventorySkill: undefined - SkillsResponse: undefined - InventoryToolsConnection: undefined - ToolExternalTypeCount: undefined - SkillNameCount: undefined - DataClassification: Sensitivity/classification enrichment reported by a DSPM integration (e.g. Microsoft Purview) for a data source. Sourced from the integration-owned data-classification tables. - DataSourcesResponse: undefined - AccessChannelsResponse: undefined - DeviceListItem: undefined - Device: undefined - DevicesResponse: undefined - ModelListItem: undefined - Model: undefined - ModelsResponse: undefined - ModelsGroup: undefined - ModelsGroupsResponse: undefined - McpServerOptionsResponse: undefined - SkillsGroup: undefined - SkillsGroupsResponse: undefined - ResourceSnapshot: Item state at the time the event was recorded. - InventoryItemDiscoveredActivity: Emitted on first observation of an inventory item in the tenant. - LifecycleActivityEdge: undefined - LifecycleActivitiesConnection: undefined - McpServer: MCP server modeled as a first-class resource in the platform graph. - McpAuth: undefined - McpCapability: Per the MCP spec, each capability is declared as a sub-object whose feature flags qualify the support level. Presence of the sub-object means the server advertises that capability; absence means it does not. See: https://modelcontextprotocol.io/specification/server/utilities/logging#capabilities - McpToolsCapability: undefined - McpPromptsCapability: undefined - McpLoggingCapability: Logging capability is presence-based in the MCP spec and currently carries no feature flags. Modeled as an empty object so future flags can be added without a breaking change. - McpServerEdge: undefined - McpServerConnection: undefined - Plugin: Stub for the upcoming Plugin resource. Surfaced here so MCP servers can advertise the plugins that wrap them; will be expanded when the Plugin domain lands. - PluginEdge: undefined - PluginsConnection: undefined - DetectionEdge: undefined - NotificationIntegration: undefined - SlackNotificationChannel: undefined - SentinelNotificationChannel: undefined - TeamsNotificationChannel: undefined - EmailNotificationChannel: undefined - FreshserviceNotificationChannel: undefined - PolicyEdge: undefined - PolicyConnection: undefined - NotificationChannelEdge: undefined - NotificationChannelConnection: undefined - NotificationChannelError: undefined - NotificationTestResult: undefined - NotificationChannelResult: undefined - Owner: undefined - AgentCountByOwner: undefined - OwnerFilterOutput: undefined - OwnerDepartment: A distinct department an owner belongs to. `id` is the department name itself, which is the natural unique key per tenant. - OwnerGroup: A distinct group an owner belongs to. `id` is the group name itself, which is the natural unique key per tenant. - OwnerVertical: A distinct vertical an owner belongs to. `id` is the vertical name itself, which is the natural unique key per tenant. - OwnerBusinessUnit: A distinct business unit an owner belongs to. `id` is the business unit id itself, which is the natural unique key per tenant. - EmployeeType: A distinct employee type an owner belongs to. `id` is the employee type itself, which is the natural unique key per tenant. - OwnerDepartmentConnection: Relay connection of distinct owner departments. `totalCount` is the number of distinct departments. - OwnerGroupConnection: Relay connection of distinct owner groups. `totalCount` is the number of distinct groups. - OwnerVerticalConnection: Relay connection of distinct owner verticals. `totalCount` is the number of distinct verticals. - OwnerBusinessUnitConnection: Relay connection of distinct owner business units. `totalCount` is the number of distinct business units. - EmployeeTypeConnection: Relay connection of distinct owner employee types. `totalCount` is the number of distinct employee types. - OwnerSummary: undefined - OwnersResult: undefined - ViolationsSummary: undefined - PolicyOwner: The owner of a policy, assigned at creation time - PolicyTrigger: Event that triggers policy evaluation - AgentPolicyFilterOutput: undefined - ToolPolicyFilterOutput: undefined - SkillPolicyFilterOutput: undefined - DataSourcePolicyFilterOutput: undefined - McpServerPolicyFilterOutput: undefined - PolicyResourceTypeFilterOutput: undefined - PolicyConditionGroup: Group of conditions combined with AND/OR logic. Supports agent properties, findings, and runtime detections. - PolicyAction: Action to execute when policy matches. Policy assigns severity based on context - the same finding can result in different severity issues. - PolicyCreateIssueActionParams: Parameters for CREATE_ISSUE action - IntRange: Integer range output type - DateTimeRange: DateTime range output type - PolicyFilterOptions: Filter options for policies page including dynamic ranges - PoliciesResponse: Response type for policies query containing items and total count - PolicyImpactPreview: Preview of policy impact before applying changes. Shows matching entities. - MatchingEntityGroup: Group of entities matching the policy conditions - ModeDistribution: Distribution of policies by mode - EnvironmentTypeDistribution: Distribution of items by environment type (reusable across entities) - EnvironmentDistribution: Distribution of items by specific environment name - PolicyAggregations: Aggregated statistics for policies - PolicyTemplate: undefined - EvidenceGraphEdge: undefined - PolicyCountBySeverity: undefined - PolicyCountByMode: undefined - PolicyDetectionTypeSummaryItem: undefined - PolicyFindingTypeSummaryItem: undefined - DetectionTypePreview: undefined - FindingTypePreview: undefined - AgentsScopeSummary: undefined - FindingsScopeSummary: undefined - PolicySummary: undefined - McpReputationAssessment: undefined - SkillReputationAssessment: undefined - Publisher: Who published an artifact. Node-level provenance (reused by McpServer, Skill), not a reputation-assessment output. - ReputationBehaviorFinding: A single behavior the analyzer found in the artifact - what it can do to the host or your data (run shell, delete resources, access private data, ...). Distinct from McpCapability, which describes MCP protocol handshake features. Only found behaviors are listed, each backed by evidence from the artifact's own content. Labels and long descriptions are static per behavior and rendered client-side. - ReputationBehaviorEvidence: Where the behavior was observed in the artifact's content. - ReputationAssessmentEdge: undefined - ReputationAssessmentConnection: undefined - UserError: undefined - FlagPayload: undefined - ServiceAccount: undefined - ServiceAccountSecret: undefined - CreateServiceAccountResult: undefined - AddServiceAccountSecretResult: undefined - MessageAttachment: A file shared inside a message. Metadata only, stored with the activity so it falls under the tenant's activity retention window. - ParticipantMessageActivity: undefined - UserMessageActivity: @deprecated Use ParticipantMessageActivity instead - AgentMessageActivity: undefined - AgentReasoningActivity: undefined - ToolCallActivity: undefined - ErrorActivity: undefined - SystemMessageActivity: Platform-authored telemetry inside a session - topic routing, lifecycle markers, model-call boundaries. Informational, never a failure. - SessionStartedActivity: undefined - DataSourceAccessActivity: undefined - PolicyEvaluatedActivity: undefined - AccessChannelActivity: undefined - SkillInvokedActivity: undefined - Session: undefined - FindingIndicator: undefined - DetectionIndicator: undefined - ViolationIndicator: undefined - TimelineQueryMetadata: undefined - ActivitiesTimelineBin: undefined - TimeRange: Date-time range for a cluster - ActivitiesTimelineChartResponse: undefined - SessionParticipantOption: undefined - SessionsResponse: undefined - ActivitiesResponse: undefined - ToolAnnotations: undefined - ToolDefinition: undefined - ViolationTriagePayload: Returns the freshly triaged violation so the client can refresh its cache, alongside any validation `userErrors`. - User: Represents a user in the system - OrganizationConfiguration: Organization configuration - OrganizationSSOConfiguration: undefined - OrganizationSSOConfigurationValues: Organization SSO configuration. Strategy-specific fields are null for the other strategy: SAML populates signInEndpoint, identifier and replyUrl; OIDC populates clientId, issuerUrl and callbackUrl. - OrganizationScimConfiguration: Organization SCIM provisioning configuration - OrganizationScimConfigurationValues: undefined - OrganizationScimToken: Metadata for an issued SCIM token. Never includes the token secret. - OrganizationScimTokenWithSecret: A newly created SCIM token. The secret is returned only once, at creation. - ViolationEvidence: undefined - Violation: undefined - ViolationActivitiesConnection: undefined - ViolationEdge: undefined - ViolationGroup: A single violation group: its stable key, display label, and member count across the full filtered set. - ViolationGroupConnection: Cursor-based paginated list of violation groups. - ViolationFunnelStageResult: undefined - ViolationFunnelChart: Violation impact funnel. Pass the connection's `filter`, so the violation stages are always exactly the list the user is looking at. - ViolationControlBreakdownChart: Which compliance frameworks the connection's violations have actually reached, ranked by how many of each framework's controls are violated. A control counts as violated when at least one violation in scope carries a finding or detection whose type maps to it. The single `violated` series is index-aligned to the framework buckets and sums to `totalCount`, so a bucket reads as its share of the violated controls across all frameworks. Breadth, not volume: a control hit once and a control hit nine hundred times count the same. Frameworks with no violated control are left out entirely rather than plotted as an empty bar. - TenantRole: A role that can be assigned to a user. `id` is the system role key for SYSTEM roles and the custom role's UUID for CUSTOM roles. `name` is the raw system role key for SYSTEM roles (clients localize it) and the tenant-authored name for CUSTOM roles. `permissions` is everything the role grants on its own, before it is unioned with the user's other roles. - CustomRole: A tenant-defined role. Its permission set is resolved per request, so edits take effect on the next request without re-authentication. - SiemS3ConnectionDetails: Connection details for the Capsule-owned per-tenant S3 export bucket. Present only once the bucket has been provisioned on the infrastructure side. - SiemSplunkConnectionDetails: Connection details for a Splunk HTTP Event Collector destination. The HEC token is held in Secret Manager and is never returned. - SiemIntegration: A SIEM export integration. Detection, finding, and policy-violation events are either written to a Capsule-owned per-tenant bucket the customer is granted read access to, or pushed to a customer-operated endpoint. A tenant may configure multiple integrations. - TenantSettings: Tenant-level settings managed by tenant admins. ## Inputs - ActivityTypeFilter: undefined - AuditLogOrderByInput: undefined - AuditSourceFilter: undefined - AuditCategoryFilter: undefined - AuditTypeFilter: undefined - AuditLogFilterInput: undefined - SeverityFilter: undefined - AccessibilityFilter: undefined - EnvironmentTypeFilter: undefined - EnvironmentFilter: undefined - PlatformFilter: undefined - PlatformTypeFilter: undefined - ToolFilter: undefined - AgentFilter: undefined - ToolProtocolFilter: undefined - AgentOrderByInput: undefined - CategoricalAxisInput: `limit` bounds the number of buckets returned; anything past it is reported via `omittedBucketCount` and, when `includeOtherBucket` is set, rolled into `otherBucket`. - TimeWindowInput: undefined - ChartAggregateInput: `field` is required for every operation except COUNT, and is a domain-specific field name validated by the resolver. An explicit error beats an empty chart. - HeatmapAxisInput: undefined - CalendarHeatmapInput: undefined - BooleanFilter: undefined - StringFilter: undefined - UsageRangeFilter: undefined - DateRangeFilter: undefined - DateTimeFilter: undefined - StringContainsFilter: Substring match filter. - ComplianceFrameworkTypeFilter: undefined - ComplianceFrameworkFilter: undefined - DetectionFilter: undefined - ResourceTypeFilter: undefined - DetectionTypeFilter: undefined - DetectionsFilter: Filter for a resource node's detections connection. - DetectionOrderByInput: undefined - FindingsFilter: Filter for a resource node's findings connection. - FindingOrderByInput: undefined - FindingFilter: Filter for findings - FindingTypeFilter: Filter for finding types - FlowStatusFilter: undefined - FlowTypeFilter: undefined - FlowAgentFilter: undefined - FlowFilter: undefined - FlowOrderByInput: undefined - SetIdpGroupRoleMappingInput: undefined - CreateIntegrationInput: undefined - StartIntegrationInstallationInput: undefined - ApplyIntegrationConfigInput: Declarative integration configuration. The server reconciles incoming state against persisted state — fields left null/undefined are treated as "do not change" for OAuth-style settings, while platform-specific config blocks (e.g. `intune`) replace the full desired state when provided. - TestIntegrationConnectionInput: undefined - IntuneConfigInput: Microsoft Intune-specific apply payload. The `distributions` list is the full desired state — the server creates entries with no `id`, updates entries matched by `id`, and soft-deletes any persisted distribution whose id is absent from the list. - IntuneDistributionInput: undefined - JamfConfigInput: Jamf Pro-specific apply payload. The `distributions` list is the full desired state; the server creates entries with no `id`, updates entries matched by `id`, and soft-deletes any persisted distribution whose id is absent. - JamfDistributionInput: undefined - InventoryCategoriesGroupingInput: Grouping context for inventory category counts. When a page is displaying a grouped view, the matching count should be the number of distinct group values rather than the row count. - SkillFilterInput: undefined - SkillOrderByInput: undefined - McpServerFilterInput: undefined - ToolFilterInput: undefined - DataSourceFilterInput: undefined - AccessChannelFilterInput: undefined - ToolOrderByInput: undefined - DataSourceOrderByInput: undefined - AccessChannelOrderByInput: undefined - DeviceFilterInput: undefined - DeviceOrderByInput: undefined - ModelLocationFilter: undefined - NullableStringFilter: undefined - ModelFilter: undefined - ModelOrderByInput: undefined - LifecycleActivityTypeFilter: undefined - LifecycleActivityFilter: undefined - McpProtocolFilter: undefined - McpServerFilter: undefined - McpServerOrderByInput: undefined - CreateNotificationChannelInput: undefined - UpdateNotificationChannelInput: undefined - UpdateSlackDefaultsInput: undefined - SentinelDestinationInput: undefined - TeamsWebhookInput: undefined - EmailChannelInput: undefined - FreshserviceChannelInput: undefined - CreatePolicyInput: Input for creating a new policy. - UpdatePolicyInput: Input for updating an existing policy - OwnerFilter: undefined - OwnersFilter: undefined - OwnerOrderByInput: undefined - AgentPolicyFilterInput: undefined - ToolPolicyFilterInput: undefined - SkillPolicyFilterInput: undefined - DataSourcePolicyFilterInput: undefined - McpServerPolicyFilterInput: undefined - PolicyResourceTypeFilterInput: undefined - PolicyConditionGroupInput: Input for defining condition groups - PolicyCreateIssueActionParamsInput: Input for CREATE_ISSUE action parameters - PolicyActionInput: Input for defining policy actions - IntRangeFilter: Filter for integer ranges - PolicyFilter: Filter for policies - PolicyModeFilter: Filter for policy mode - PolicyTriggerTypeFilter: Filter for policy trigger types - PolicyTriggerInput: Input for policy trigger - PolicyOrderByInput: Input for specifying policy sorting - AgentReferenceFilter: undefined - ReputationFilter: undefined - ReputationOrderByInput: undefined - ResourceFlagInput: undefined - CreateServiceAccountInput: undefined - UpdateServiceAccountInput: undefined - SessionActivityTypeFilter: undefined - ActivityFilter: undefined - ViolationReferenceFilter: undefined - ToolReferenceFilter: undefined - DataSourceReferenceFilter: undefined - AccessChannelReferenceFilter: undefined - SkillReferenceFilter: undefined - ParticipantReferenceFilter: undefined - McpServerReferenceFilter: undefined - SessionFilter: undefined - TimelineQueryInput: undefined - SessionOrderByInput: undefined - ActivityOrderByInput: undefined - MarkDetectionTriageInput: undefined - MarkFindingTriageInput: undefined - MarkViolationTriageInput: undefined - UpdateManyViolationTriageInput: undefined - BatchUpdateViolationTriageInput: undefined - TriageVerdictFilter: Filter for triage verdicts. - ConfigureSSOInput: Input for configuring SSO. SAML requires signInEndpoint and signingCertBase64; OIDC requires clientId, clientSecret and issuerUrl. - ViolationStatusFilter: Filter violations by their lifecycle status - ViolationFilter: Filter for violations - ViolationPolicyFilter: Filter violations by their associated policy - ViolationOrderByInput: Input for specifying violation sorting - ViolationGroupingInput: Grouping view preference for the violations list. Data stays flat; grouping orders the stream by a primary group key (see ViolationGroupByField). - CreateCustomRoleInput: undefined - UpdateCustomRoleInput: Omitted fields are left unchanged. Providing `permissions` replaces the role's entire permission set. - CreateSiemIntegrationInput: Input for creating a SIEM integration. The integration type is fixed at creation. Toggles default to enabled server-side when omitted. The S3 fields (principalArn, externalId, dataRetentionDays) and the Splunk fields are each only accepted for their own type. - UpdateSiemIntegrationInput: Input for updating a SIEM integration. Every field is optional so each setting can be updated independently. The integration type cannot be changed. Omitting splunkToken leaves the stored token untouched. - UpdateTenantSettingsInput: Input for updating the current tenant's settings. Every field is optional so each setting can be updated independently.