Skip to content
API Reference
/
/
detections

GraphQL Overview

Download GraphQL schema
agent.graphql

Queries

Overview

listChannelTypes

[String!]!,non-null

Return type

[String!]!

The String scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text.

Query sample
query listChannelTypes {
  listChannelTypes 
}
Response sample
{
  "data": [
    "Example String"
  ]
}

sessionActivities

(sessionId)
[SessionSubActivity!]!,non-null

Arguments

sessionId
ID!,non-nullrequired

Return type

[SessionSubActivity!]!
PolicyEvaluatedActivity
UserMessageActivity
AgentMessageActivity
AgentReasoningActivity
ToolCallActivity
ErrorActivity
SessionStartedActivity
DataSourceAccessActivity
AccessChannelActivity
Query sample
query sessionActivities($sessionId: ID!) {
  sessionActivities(sessionId: $sessionId) {
    id 
    type 
    timestamp 
    agent {
      __typename
      # ...AgentFragment
    }
    message 
    policy {
      __typename
      # ...PolicyFragment
    }
    issue {
      __typename
      # ...IssueFragment
    }
  }
}
Variables
{
  "sessionId": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4"
}
Response sample
{
  "data": [
    {
      "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
      "type": "SESSION",
      "timestamp": "Example Custom Scalar",
      "agent": {
        "__typename": "Agent"
      },
      "message": "Example String",
      "policy": {
        "__typename": "Policy"
      },
      "issue": {
        "__typename": "Issue"
      }
    }
  ]
}

sessions

(...args)
[Session!]!,non-null

Arguments

filter
SessionFilter
orderBy
[SessionOrderByInput!],non-null
limit
Int
Default:100
offset
Int
Default:0

Return type

[Session!]!
type
ActivityType!,non-null
timestamp
DateTime!,non-null
agent
Agent!,non-null
message
String
sessionId
ID!,non-null
detections
[Detection!]!,non-null

Detections that were created as part of the session

violations
[ViolationPreview!]!,non-null

Violations that were created as part of the session.

Query sample
query sessions(
  $filter: SessionFilter
  $orderBy: [SessionOrderByInput!]
  $limit: Int
  $offset: Int
) {
  sessions(
    filter: $filter
    orderBy: $orderBy
    limit: $limit
    offset: $offset
  ) {
    type 
    timestamp 
    agent {
      __typename
      # ...AgentFragment
    }
    message 
    sessionId 
    detections {
      __typename
      # ...DetectionFragment
    }
    violations {
      __typename
      # ...ViolationPreviewFragment
    }
  }
}
Variables
{
  "filter": {
    "sessionId": {
      "__typename": "StringFilter"
    },
    "activityType": {
      "__typename": "ActivityTypeFilter"
    },
    "dateRange": {
      "__typename": "DateTimeFilter"
    },
    "agent": {
      "__typename": "AgentReferenceFilter"
    },
    "search": "Example String",
    "findingType": {
      "__typename": "FindingTypeFilter"
    },
    "issue": {
      "__typename": "IssueReferenceFilter"
    },
    "detections": {
      "__typename": "DetectionFilter"
    },
    "tool": {
      "__typename": "ToolReferenceFilter"
    },
    "dataSource": {
      "__typename": "DataSourceReferenceFilter"
    },
    "accessChannel": {
      "__typename": "AccessChannelReferenceFilter"
    }
  },
  "orderBy": [
    {
      "field": "TIMESTAMP",
      "direction": "ASC"
    }
  ],
  "limit": 40,
  "offset": 40
}
Response sample
{
  "data": [
    {
      "type": "SESSION",
      "timestamp": "Example Custom Scalar",
      "agent": {
        "__typename": "Agent"
      },
      "message": "Example String",
      "sessionId": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
      "detections": [
        {
          "__typename": "Detection"
        }
      ],
      "violations": [
        {
          "__typename": "ViolationPreview"
        }
      ]
    }
  ]
}

sessionsCount

(filter)
Int!,non-null

Arguments

filter
SessionFilter

Return type

Int!

The Int scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1.

Query sample
query sessionsCount($filter: SessionFilter) {
  sessionsCount(filter: $filter) 
}
Variables
{
  "filter": {
    "sessionId": {
      "__typename": "StringFilter"
    },
    "activityType": {
      "__typename": "ActivityTypeFilter"
    },
    "dateRange": {
      "__typename": "DateTimeFilter"
    },
    "agent": {
      "__typename": "AgentReferenceFilter"
    },
    "search": "Example String",
    "findingType": {
      "__typename": "FindingTypeFilter"
    },
    "issue": {
      "__typename": "IssueReferenceFilter"
    },
    "detections": {
      "__typename": "DetectionFilter"
    },
    "tool": {
      "__typename": "ToolReferenceFilter"
    },
    "dataSource": {
      "__typename": "DataSourceReferenceFilter"
    },
    "accessChannel": {
      "__typename": "AccessChannelReferenceFilter"
    }
  }
}
Response sample
{
  "data": 40
}

activitiesTimelineChart

(input)
ActivitiesTimelineChartResponse!,non-null

Arguments

input
TimelineQueryInput!,non-nullrequired

Return type

ActivitiesTimelineChartResponse!
metadata
TimelineQueryMetadata!,non-null
bins
[ActivitiesTimelineBin!]!,non-null
totalActivities
Int!,non-null
totalIndicators
Int!,non-null
Query sample
query activitiesTimelineChart($input: TimelineQueryInput!) {
  activitiesTimelineChart(input: $input) {
    metadata {
      __typename
      # ...TimelineQueryMetadataFragment
    }
    bins {
      __typename
      # ...ActivitiesTimelineBinFragment
    }
    totalActivities 
    totalIndicators 
  }
}
Variables
{
  "input": {
    "timeRange": {
      "__typename": "DateTimeFilter"
    },
    "binCount": 40,
    "timezone": "Example String",
    "filters": {
      "__typename": "SessionFilter"
    }
  }
}
Response sample
{
  "data": {
    "metadata": {
      "__typename": "TimelineQueryMetadata"
    },
    "bins": [
      {
        "__typename": "ActivitiesTimelineBin"
      }
    ],
    "totalActivities": 40,
    "totalIndicators": 40
  }
}

detections

(...args)
DetectionsResponse!,non-null

Arguments

limit
Int
Default:100
offset
Int
Default:0

Return type

DetectionsResponse!
items
[Detection!]!,non-null
total
Int!,non-null
Query sample
query detections($limit: Int, $offset: Int) {
  detections(limit: $limit, offset: $offset) {
    items {
      __typename
      # ...DetectionFragment
    }
    total 
  }
}
Variables
{
  "limit": 40,
  "offset": 40
}
Response sample
{
  "data": {
    "items": [
      {
        "__typename": "Detection"
      }
    ],
    "total": 40
  }
}

detection

(id)
Detection

Arguments

id
ID!,non-nullrequired

Return type

Detection
id
ID!,non-null
title
String!,non-null
type
DetectionType!,non-null
detectedAt
DateTime!,non-null
issue
Issue
session
Session
activities
[AuditEvent!]!,non-nulldeprecated
Deprecation reason

Use 'messages' field instead for typed message access

agent
Agent!,non-null
description
String
Query sample
query detection($id: ID!) {
  detection(id: $id) {
    id 
    title 
    type 
    detectedAt 
    issue {
      __typename
      # ...IssueFragment
    }
    session {
      __typename
      # ...SessionFragment
    }
    activities {
      __typename
      # ...AuditEventFragment
    }
    agent {
      __typename
      # ...AgentFragment
    }
    description 
  }
}
Variables
{
  "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4"
}
Response sample
{
  "data": {
    "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
    "title": "Example String",
    "type": "PII_LEAKAGE",
    "detectedAt": "Example Custom Scalar",
    "issue": {
      "__typename": "Issue"
    },
    "session": {
      "__typename": "Session"
    },
    "activities": [
      {
        "__typename": "AuditEvent"
      }
    ],
    "agent": {
      "__typename": "Agent"
    },
    "description": "Example String"
  }
}

flows

(...args)
FlowConnection!,non-null

Arguments

filter
FlowFilter
orderBy
[FlowOrderByInput!],non-null
first
Int
after
String
last
Int
before
String

Return type

FlowConnection!
nodes
[Flow!]!,non-null
edges
[FlowEdge!]!,non-null
pageInfo
PageInfo!,non-null
totalCount
Int!,non-null
aggregations
FlowAggregations
Query sample
query flows(
  $filter: FlowFilter
  $orderBy: [FlowOrderByInput!]
  $first: Int
  $after: String
  $last: Int
  $before: String
) {
  flows(
    filter: $filter
    orderBy: $orderBy
    first: $first
    after: $after
    last: $last
    before: $before
  ) {
    nodes {
      id 
      externalId 
      name 
      description 
      platform {
        __typename
        # ...PlatformFragment
      }
      environment {
        __typename
        # ...EnvironmentFragment
      }
      owner {
        __typename
        # ...OwnerFragment
      }
      status 
      mode 
      version 
      graph {
        __typename
        # ...FlowGraphFragment
      }
      agents {
        __typename
        # ...AgentPreviewFragment
      }
      tools {
        __typename
        # ...ToolPreviewFragment
      }
      dataSources {
        __typename
        # ...DataSourcePreviewFragment
      }
      findings {
        __typename
        # ...FindingFragment
      }
      issues {
        __typename
        # ...IssueFragment
      }
      createdAt 
      updatedAt 
      capturedAt 
      platformCreatedAt 
      platformUpdatedAt 
      metadata 
    }
    edges {
      node {
        id 
        externalId 
        name 
        description 
        platform {
          __typename
          # ...PlatformFragment
        }
        environment {
          __typename
          # ...EnvironmentFragment
        }
        owner {
          __typename
          # ...OwnerFragment
        }
        status 
        mode 
        version 
        graph {
          __typename
          # ...FlowGraphFragment
        }
        agents {
          __typename
          # ...AgentPreviewFragment
        }
        tools {
          __typename
          # ...ToolPreviewFragment
        }
        dataSources {
          __typename
          # ...DataSourcePreviewFragment
        }
        findings {
          __typename
          # ...FindingFragment
        }
        issues {
          __typename
          # ...IssueFragment
        }
        createdAt 
        updatedAt 
        capturedAt 
        platformCreatedAt 
        platformUpdatedAt 
        metadata 
      }
      cursor 
    }
    pageInfo {
      hasNextPage 
      hasPreviousPage 
      startCursor 
      endCursor 
    }
    totalCount 
    aggregations {
      __typename
      # ...FlowAggregationsFragment
    }
  }
}
Variables
{
  "filter": {
    "id": {
      "__typename": "StringFilter"
    },
    "search": "Example String",
    "status": {
      "__typename": "FlowStatusFilter"
    },
    "platform": {
      "__typename": "PlatformFilter"
    },
    "environment": {
      "__typename": "EnvironmentFilter"
    },
    "owner": {
      "__typename": "OwnerFilter"
    },
    "mode": {
      "__typename": "FlowModeFilter"
    },
    "hasExternalTrigger": {
      "__typename": "BooleanFilter"
    },
    "severity": {
      "__typename": "SeverityFilter"
    },
    "findings": {
      "__typename": "FindingFilter"
    },
    "agents": {
      "__typename": "FlowAgentFilter"
    },
    "createdAt": {
      "__typename": "DateTimeFilter"
    },
    "updatedAt": {
      "__typename": "DateTimeFilter"
    }
  },
  "orderBy": [
    {
      "field": "NAME",
      "direction": "ASC"
    }
  ],
  "first": 40,
  "after": "Example String",
  "last": 40,
  "before": "Example String"
}
Response sample
{
  "data": {
    "nodes": [
      {
        "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
        "externalId": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
        "name": "Example String",
        "description": "Example String",
        "platform": {
          "__typename": "Platform"
        },
        "environment": {
          "__typename": "Environment"
        },
        "owner": {
          "__typename": "Owner"
        },
        "status": "ACTIVE",
        "mode": "SYNC",
        "version": "Example String",
        "graph": {
          "__typename": "FlowGraph"
        },
        "agents": [
          {
            "__typename": "AgentPreview"
          }
        ],
        "tools": [
          {
            "__typename": "ToolPreview"
          }
        ],
        "dataSources": [
          {
            "__typename": "DataSourcePreview"
          }
        ],
        "findings": [
          {
            "__typename": "Finding"
          }
        ],
        "issues": [
          {
            "__typename": "Issue"
          }
        ],
        "createdAt": "Example Custom Scalar",
        "updatedAt": "Example Custom Scalar",
        "capturedAt": "Example Custom Scalar",
        "platformCreatedAt": "Example Custom Scalar",
        "platformUpdatedAt": "Example Custom Scalar",
        "metadata": "Example Custom Scalar"
      }
    ],
    "edges": [
      {
        "node": {
          "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
          "externalId": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
          "name": "Example String",
          "description": "Example String",
          "platform": {
            "__typename": "Platform"
          },
          "environment": {
            "__typename": "Environment"
          },
          "owner": {
            "__typename": "Owner"
          },
          "status": "ACTIVE",
          "mode": "SYNC",
          "version": "Example String",
          "graph": {
            "__typename": "FlowGraph"
          },
          "agents": [
            {
              "__typename": "AgentPreview"
            }
          ],
          "tools": [
            {
              "__typename": "ToolPreview"
            }
          ],
          "dataSources": [
            {
              "__typename": "DataSourcePreview"
            }
          ],
          "findings": [
            {
              "__typename": "Finding"
            }
          ],
          "issues": [
            {
              "__typename": "Issue"
            }
          ],
          "createdAt": "Example Custom Scalar",
          "updatedAt": "Example Custom Scalar",
          "capturedAt": "Example Custom Scalar",
          "platformCreatedAt": "Example Custom Scalar",
          "platformUpdatedAt": "Example Custom Scalar",
          "metadata": "Example Custom Scalar"
        },
        "cursor": "Example String"
      }
    ],
    "pageInfo": {
      "hasNextPage": true,
      "hasPreviousPage": true,
      "startCursor": "Example String",
      "endCursor": "Example String"
    },
    "totalCount": 40,
    "aggregations": {
      "__typename": "FlowAggregations"
    }
  }
}

flow

(id)
Flow

Arguments

id
ID!,non-nullrequired

Return type

Flow
id
ID!,non-null
externalId
ID!,non-null
name
String!,non-null
description
String
platform
Platform!,non-null
environment
Environment!,non-null
owner
Owner
status
FlowStatus!,non-null
mode
FlowMode!,non-null
version
String
graph
FlowGraph!,non-null
agents
[AgentPreview!]!,non-null
tools
[ToolPreview!]!,non-null
dataSources
[DataSourcePreview!]!,non-null
findings
[Finding!]!,non-null
issues
[Issue!]!,non-null
createdAt
DateTime!,non-null
updatedAt
DateTime!,non-null
capturedAt
DateTime!,non-null
platformCreatedAt
DateTime
platformUpdatedAt
DateTime
metadata
JSON
Query sample
query flow($id: ID!) {
  flow(id: $id) {
    id 
    externalId 
    name 
    description 
    platform {
      __typename
      # ...PlatformFragment
    }
    environment {
      __typename
      # ...EnvironmentFragment
    }
    owner {
      __typename
      # ...OwnerFragment
    }
    status 
    mode 
    version 
    graph {
      __typename
      # ...FlowGraphFragment
    }
    agents {
      __typename
      # ...AgentPreviewFragment
    }
    tools {
      __typename
      # ...ToolPreviewFragment
    }
    dataSources {
      __typename
      # ...DataSourcePreviewFragment
    }
    findings {
      __typename
      # ...FindingFragment
    }
    issues {
      __typename
      # ...IssueFragment
    }
    createdAt 
    updatedAt 
    capturedAt 
    platformCreatedAt 
    platformUpdatedAt 
    metadata 
  }
}
Variables
{
  "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4"
}
Response sample
{
  "data": {
    "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
    "externalId": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
    "name": "Example String",
    "description": "Example String",
    "platform": {
      "__typename": "Platform"
    },
    "environment": {
      "__typename": "Environment"
    },
    "owner": {
      "__typename": "Owner"
    },
    "status": "ACTIVE",
    "mode": "SYNC",
    "version": "Example String",
    "graph": {
      "__typename": "FlowGraph"
    },
    "agents": [
      {
        "__typename": "AgentPreview"
      }
    ],
    "tools": [
      {
        "__typename": "ToolPreview"
      }
    ],
    "dataSources": [
      {
        "__typename": "DataSourcePreview"
      }
    ],
    "findings": [
      {
        "__typename": "Finding"
      }
    ],
    "issues": [
      {
        "__typename": "Issue"
      }
    ],
    "createdAt": "Example Custom Scalar",
    "updatedAt": "Example Custom Scalar",
    "capturedAt": "Example Custom Scalar",
    "platformCreatedAt": "Example Custom Scalar",
    "platformUpdatedAt": "Example Custom Scalar",
    "metadata": "Example Custom Scalar"
  }
}

policies

(...args)
PoliciesResponse!,non-null

Get a list of policies with optional filtering and sorting

Arguments

filter
PolicyFilter
orderBy
[PolicyOrderByInput!],non-null
limit
Int
Default:100
offset
Int
Default:0

Return type

PoliciesResponse!
items
[Policy!]!,non-null

List of policies matching the filter

total
Int!,non-null

Total count of policies matching the filter (ignoring pagination)

aggregations
PolicyAggregations

Aggregated statistics for the filtered policies (computed lazily via field resolver)

Query sample
query policies(
  $filter: PolicyFilter
  $orderBy: [PolicyOrderByInput!]
  $limit: Int
  $offset: Int
) {
  policies(
    filter: $filter
    orderBy: $orderBy
    limit: $limit
    offset: $offset
  ) {
    items {
      __typename
      # ...PolicyFragment
    }
    total 
    aggregations {
      __typename
      # ...PolicyAggregationsFragment
    }
  }
}
Variables
{
  "filter": {
    "search": "Example String",
    "mode": {
      "__typename": "PolicyModeFilter"
    },
    "status": {
      "__typename": "PolicyStatusFilter"
    },
    "triggerType": {
      "__typename": "PolicyTriggerTypeFilter"
    },
    "issuesCount": {
      "__typename": "IntRangeFilter"
    },
    "lastExecutedAt": {
      "__typename": "DateTimeFilter"
    },
    "isDefault": true,
    "findingType": {
      "__typename": "FindingTypeFilter"
    },
    "detectionType": {
      "__typename": "DetectionTypeFilter"
    }
  },
  "orderBy": [
    {
      "field": "NAME",
      "direction": "ASC"
    }
  ],
  "limit": 40,
  "offset": 40
}
Response sample
{
  "data": {
    "items": [
      {
        "__typename": "Policy"
      }
    ],
    "total": 40,
    "aggregations": {
      "__typename": "PolicyAggregations"
    }
  }
}

policy

(id)
Policy

Get a specific policy by ID

Arguments

id
ID!,non-nullrequired

Return type

Policy
id
ID!,non-null

Unique identifier for the policy

name
String!,non-null

Policy name

description
String

Detailed description of what the policy does

mode
PolicyMode!,non-null

Current enforcement mode of the policy

status
PolicyStatus!,non-null

Current status of the policy

trigger
PolicyTrigger!,non-null

Event that triggers policy evaluation

conditions
PolicyConditionGroup!,non-null

Conditions that must be met for the policy to match

actions
[PolicyAction!]!,non-null

Actions to execute when policy conditions match

autoResolve
Boolean!,non-null

Automatically resolve issues when conditions are no longer met

isDefault
Boolean!,non-null

Indicates if this policy is a system default or custom/modified by the tenant

issuesCount
Int!,non-null

Number of issues created by this policy

lastExecutedAt
DateTime

When the policy was last executed

createdAt
DateTime!,non-null

When the policy was created

updatedAt
DateTime!,non-null

When the policy was last updated

createdBy
Owner

User who created the policy

updatedBy
Owner

User who last updated the policy

version
Int!,non-null

Version number, incremented on each update

deletedAt
DateTime

When the policy was soft-deleted (null if active)

environmentTypes
[EnvironmentType!]!,non-null

Effective environment types where this policy applies. Returns specific environments if conditions include environment filters, or all environments (Prod, Sandbox, Dev) if no environment filter is specified.

Query sample
query policy($id: ID!) {
  policy(id: $id) {
    id 
    name 
    description 
    mode 
    status 
    trigger {
      __typename
      # ...PolicyTriggerFragment
    }
    conditions {
      __typename
      # ...PolicyConditionGroupFragment
    }
    actions {
      __typename
      # ...PolicyActionFragment
    }
    autoResolve 
    isDefault 
    issuesCount 
    lastExecutedAt 
    createdAt 
    updatedAt 
    createdBy {
      __typename
      # ...OwnerFragment
    }
    updatedBy {
      __typename
      # ...OwnerFragment
    }
    version 
    deletedAt 
    environmentTypes 
  }
}
Variables
{
  "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4"
}
Response sample
{
  "data": {
    "id": "9cfb1c81-4c79-452f-b1f5-8ee6571276b4",
    "name": "Example String",
    "description": "Example String",
    "mode": "DRAFT",
    "status": "ACTIVE",
    "trigger": {
      "__typename": "PolicyTrigger"
    },
    "conditions": {
      "__typename": "PolicyConditionGroup"
    },
    "actions": [
      {
        "__typename": "PolicyAction"
      }
    ],
    "autoResolve": true,
    "isDefault": true,
    "issuesCount": 40,
    "lastExecutedAt": "Example Custom Scalar",
    "createdAt": "Example Custom Scalar",
    "updatedAt": "Example Custom Scalar",
    "createdBy": {
      "__typename": "Owner"
    },
    "updatedBy": {
      "__typename": "Owner"
    },
    "version": 40,
    "deletedAt": "Example Custom Scalar",
    "environmentTypes": [
      "Prod"
    ]
  }
}

Mutations

Overview

Objects

Overview

Interfaces

Overview

Unions

Overview

Enums

Overview

Inputs

Overview

Scalars

Overview