1. Docs
2. Reference
3. REST API Docs
4. Schema
5. GraphQueryRequest

A graph selection query over an organization’s resource graph.

Properties

• scope GraphQueryScope optional
  Bounds where the anchor set is selected. Traversal may walk beyond the scope; only RBAC visibility and depth/fanout caps bound traversal. Omitted means all visible resources in the organization.
• ↳ accounts array[string] optional
  Insights account names to select anchors from. Naming an account also selects every account beneath it in the ‘/’-separated hierarchy. Omitted means all accounts visible to the caller.
• ↳ stacks array[string] optional
  Stack selectors in ‘project/stack’ form. The stack segment may be the literal ‘*’ to select every stack in the project. Never org-qualified: a query already runs inside one organization, so the ‘org/project/stack’ form used elsewhere in the API — and reported as a stack node’s id — is rejected here with a 400. Omitted means all stacks visible to the caller.
• ↳ includeDiscovered boolean optional
  Whether discovered (non-IaC) resources are included in anchor selection. Defaults to true.
• anchor GraphQueryAnchor required
  The anchor (zero-hop) node selection.
• ↳ nodeType enum required
  The node type to select.
  Values: resource, stack
• ↳ match GraphNodeMatch optional
  Structured predicate over node attributes. Omit it, and ‘query’ with it, to select every node of the given type.
• ↳ query string optional
  A resource search query string in the Pulumi resource search syntax, as an alternative to ‘match’. Only valid for the ‘resource’ node type.
• ↳ limit integer optional
  Maximum number of anchor nodes to resolve, up to the engine’s anchor cap. When more match, the result is reported as meta.resultMode ’truncated’. Omitting this, or naming a value above the cap, leaves the bound to the engine — and a query that also traverses is then rejected rather than truncated.
• traverse array[GraphTraverseStep] optional
  Ordered, typed, depth-bounded traversal steps applied from the anchor set. Each step’s result becomes the frontier for the next step.
• ↳ edgeTypes array[string] required
  The edge type(s) to follow, as listed in the graph schema. Multiple types may be named together only when they share the same backing store (for example reference and inferred_reference); naming the same type twice, or types that span different backing stores, is rejected with a 400.
• ↳ direction enum required
  Direction to walk edges relative to the current frontier.
  Values: in, out, both
• ↳ depth GraphDepthRange optional
  Bounded traversal depth. Defaults to exactly one hop (min 1, max 1).
• ↳ target GraphTraverseTarget optional
  Terminal predicate over the nodes reached by this step.
• ↳ alias string optional
  Alias for this step’s frontier, referencable from return.select. Defaults to ‘step’ where N is the step’s zero-based index. An alias that collides with ‘anchor’ or with an earlier step is rejected.
• aggregate GraphQueryAggregate optional
  Flat aggregation over the anchor node set (group-by plus metrics). Only valid when ’traverse’ is empty; aggregation fused with traversal is not supported.
• ↳ groupBy array[string] required
  Queryable node fields to bucket by, in nesting order. A resource that does not carry one of these fields — including one whose stored value is empty — is in no bucket at all.
• ↳ metrics array[GraphAggregateMetric] required
  Metrics computed per bucket.
• return GraphQueryReturn optional
  Shapes the response: which named frontiers to return, which node fields to project, and whether to include evidence paths.
• ↳ select array[string] optional
  Named frontiers to include in the response nodes: ‘anchor’ and/or traversal step aliases. Defaults to the anchor plus the final traversal frontier.
• ↳ fields array[string] optional
  Node fields to project into each returned node’s fields map. Every name must appear in the projectableFields list the schema endpoint advertises for the resource node type; a node type projects only the subset in its own list. Not valid together with aggregate.
• ↳ paths boolean optional
  When true, the response includes explicit evidence paths to the final traversal frontier, regardless of which frontiers return.select projects. Defaults to false.
• page GraphQueryPage optional
  Pagination controls: the page size and the continuation token to resume from. To bound the anchor set itself rather than the page, use anchor.limit.
• ↳ pageSize integer optional
  Page size: the maximum number of nodes (or aggregation buckets) to return per page. Omitted means the default of 200; set, it must be at least 1.
• ↳ continuationToken string optional
  Opaque token from a previous response’s pageInfo.continuationToken. Omit (or empty) for the first page. A token the server cannot verify is a 400.