Graph Query Language - Anyshift Docs

The Anyshift Graph Query Language gives you deterministic, read-only access to infrastructure graph data. Use it when you know the operation you need and want the same query to produce the same typed result in a terminal, script, CI job, or application. This page is generated from the versioned query catalog published in the Graph API OpenAPI contract. The same catalog is embedded in Annie CLI and published with the Graph SDK.

Discover queries from Annie CLI

You do not need to memorize table or filter names. Annie CLI can inspect its embedded catalog without authentication, a selected project, or network access:

$ annie graph query --list
$ annie graph query --describe spof

The second command explains that spof accepts a kind filter, lists serviceaccount as an accepted value, and prints a copy-pasteable query. See the Annie CLI guide for authentication, project selection, and output modes. For event-story correlation and operational incident response, prefer the named commands:

$ annie graph correlations checkout --since 2h
$ annie graph incidents --provider pagerduty --status open
$ annie graph triage checkout --since 2h

correlations reconstructs Anyshift event groups. incidents reads provider response cases; the raw v1 query target for those cases is response_incidents. Grouped stored hops for one incident or mapped service use incident_context; annie graph triage includes those hops when present.

Syntax

SELECT <*|count(*)> FROM <table> [WHERE k = v [AND ...]] [LIMIT n] [OFFSET n]

Selectors: *, count(*). Accepted selector aliases: count(1). Values may be bare words or single- or double-quoted strings. Filters use equality and can be combined with AND. A target only accepts the filters and enum values documented below. LIMIT and OFFSET are listed per target because not every result supports both modifiers.

Query targets

Target	Purpose	Filters	Modifiers
`resolve`	Resolve a resource name or fragment to ranked current graph resources.	`term`	`LIMIT`
`resource_details`	Read one current graph resource by exact stable ID with safe properties and bounded relationships.	`id`	`LIMIT`
`events`	Read the infrastructure change-event timeline.	`type`, `target`, `namespace`, `noise`, `since`	`LIMIT`, `OFFSET`
`cloud_events`	Read evidence-backed AWS, Azure, and GCP change events without parsing summaries.	`provider`, `scope`, `region`, `category`, `type`, `resource`, `actor`, `correlation`, `operation`, `stats`, `noise`, `diff`, `since`, `cursor`	`LIMIT`
`cloud_resources`	Inspect current or recently deleted AWS, Azure, and GCP resources with freshness and provenance.	`provider`, `scope`, `region`, `type`, `resource`, `lifecycle`, `provenance`, `freshness`, `max_age`, `cursor`	`LIMIT`
`delivery_events`	Read commit, CI, release, and deployment evidence from the delivery graph.	`stage`, `type`, `resource`, `actor`, `source`, `since`, `cursor`	`LIMIT`
`provenance`	Trace a resource to stored release, commit, and actor evidence.	`resource`	`LIMIT`
`ownership`	Resolve observed GitHub user or team code ownership and contact identities.	`resource`	`LIMIT`
`graph_coverage`	Inspect current node, relationship, bridge, and event evidence by graph source.	`source`	None
`resources`	Count and sample current resources of one graph resource type.	`type`, `source`	`LIMIT`, `OFFSET`
`operational_impact`	Find potential operational impact through reviewed directional graph relationships.	`resource`, `depth`	`LIMIT`, `OFFSET`
`connections`	Inspect direct upstream and downstream relationships for a resource.	`resource`	`LIMIT`
`hotspots`	Rank noisy resources, namespaces, alert rules, or alerting workloads.	`type`, `by`, `namespace`, `noise`, `since`	`LIMIT`
`correlations`	Reconstruct a correlated Anyshift event group around a target or correlation identifier.	`target`, `id`, `type`, `since`	None
`incidents`	Deprecated alias for correlations. Reconstruct a correlated Anyshift event group around a target or correlation identifier.	`target`, `id`, `type`, `since`	None
`failures`	Read recent failure-class infrastructure events.	`target`, `namespace`, `since`	`LIMIT`, `OFFSET`
`deployments`	Read recent workload deployments and image changes.	`target`, `namespace`, `since`	`LIMIT`, `OFFSET`
`audit`	Read configuration, identity, and infrastructure audit events.	`target`, `namespace`, `type`, `since`	`LIMIT`, `OFFSET`
`nodes`	Read node lifecycle and capacity events.	`target`, `since`	`LIMIT`, `OFFSET`
`deploy_impact`	Join recent deployments to the failures that followed them.	`target`, `since`	`LIMIT`
`common_cause`	Find shared infrastructure or dependencies behind recent failures.	`namespace`, `since`	`LIMIT`
`blast_radius`	Calculate the transitive workloads, pods, and services affected by a resource.	`resource`	`LIMIT`
`spof`	Rank highly shared ConfigMaps, service accounts, or nodes by fan-in.	`kind`, `namespace`	`LIMIT`
`orphans`	Find unused or dangling Kubernetes resources.	`kind`, `namespace`	`LIMIT`
`coverage`	Find service, monitor, or metrics coverage gaps.	`kind`, `namespace`	`LIMIT`
`access`	Inspect RBAC reach or rank over-privileged service accounts.	`resource`, `mode`	`LIMIT`
`exposure`	Trace bidirectional stored public-exposure routes and attached controls for one resource.	`resource`, `resource_id`, `resource_type`, `resource_namespace`, `resource_cluster`, `cursor`	`LIMIT`
`tenancy`	Find workloads co-located with a resource on the same node.	`resource`	`LIMIT`
`sharedconfig`	Find workloads coupled through shared configuration.	`resource`	`LIMIT`
`path`	Find the shortest infrastructure or operational path between two resources; both scopes include reviewed Cloudflare traffic edges.	`from`, `from_exact`, `from_id`, `from_type`, `from_namespace`, `from_cluster`, `to`, `to_exact`, `to_id`, `to_type`, `to_namespace`, `to_cluster`, `scope`	None
`cascade`	Trace an incident correlation group in propagation order.	`target`, `id`, `since`	None
`alert_impact`	Find monitors and SLOs affected by a resource failure.	`resource`	`LIMIT`
`monitor`	Resolve a monitor to the infrastructure it observes.	`target`	None
`datastore`	Inspect datastore dependencies or rank widely used datastores.	`target`, `source`	`LIMIT`
`flow`	Inspect stream producers and consumers or rank busy streams.	`target`, `source`	`LIMIT`
`external_dep`	Inspect external dependencies or rank high-fan-in external hosts.	`target`, `source`	`LIMIT`
`alerts`	List normalized operational alerts while retaining legacy Datadog firing-monitor fields.	`target`, `provider`, `status`, `severity`, `service_id`, `service`, `service_type`, `service_namespace`, `service_cluster`, `provider_service_id`, `since`, `from`, `to`, `at`, `cursor`	`LIMIT`
`response_incidents`	List provider-neutral response incidents that coordinate alert handling.	`provider`, `status`, `service_id`, `service`, `service_type`, `service_namespace`, `service_cluster`, `provider_service_id`, `since`, `from`, `to`, `at`, `cursor`, `responder`, `urgency`	`LIMIT`
`oncall`	List effective on-call responsibility for a point in time or bounded window.	`provider`, `status`, `service_id`, `service`, `service_type`, `service_namespace`, `service_cluster`, `provider_service_id`, `from`, `to`, `at`, `cursor`, `person`, `schedule`	`LIMIT`
`incident_context`	Group stored incident, alert, service, on-call, responder, and reviewed history hops without live provider calls.	`id`, `target`, `provider`, `since`	`LIMIT`
`alert_noise`	Rank flapping or stuck monitors.	`target`, `kind`, `since`	`LIMIT`
`calls`	Inspect APM service callers, callees, and HTTP route evidence or rank call-graph fan-in.	`target`, `source`	`LIMIT`
`servicetree`	Expand a service’s downstream services, datastores, and external dependencies.	`target`, `source`	`LIMIT`
`alert_cause`	Join a firing service or workload to recent Kubernetes changes.	`target`, `since`	`LIMIT`
`slo`	Inspect one SLO or rank breaching and at-risk SLOs.	`target`	`LIMIT`
`alertrules`	Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory.	`subject`, `namespace`, `target`	`LIMIT`
`iac`	Inspect Terraform code-to-state-to-cloud provenance and linkage coverage.	`resource`, `status`, `freshness`	`LIMIT`, `OFFSET`
`iac_drift`	Compare last-applied Terraform state with fresh observed cloud properties.	`resource`, `status`, `freshness`	`LIMIT`, `OFFSET`
`gitops`	Inspect GitOps drift, unmanaged workloads, or resource ownership.	`subject`, `namespace`, `resource`	`LIMIT`
`image`	Inspect image usage, workload containers, or container hygiene gaps.	`target`, `workload`, `digest`, `kind`, `namespace`	`LIMIT`
`netpol`	Inspect NetworkPolicy coverage, policies, or east-west reach.	`mode`, `namespace`, `target`	`LIMIT`
`priority`	Inspect scheduling priority gaps, the class ladder, or one target’s priority.	`kind`, `namespace`, `target`	`LIMIT`
`storage`	Inspect workload storage and find orphaned or unclaimed volumes.	`mode`, `workload`, `resource`, `class`, `namespace`	`LIMIT`
`pdb`	Find workloads without PodDisruptionBudgets or inspect one workload or PDB.	`target`, `workload`, `pdb`	`LIMIT`
`scaling`	Find workloads without HPAs, list autoscaled workloads, or inspect one target.	`mode`, `namespace`, `target`	`LIMIT`
`topology`	Build a typed service topology at a selected level.	`service`, `level`, `source`, `endpoint`, `dependency`	None

resolve

Resolve a resource name or fragment to ranked current graph resources. Result intent: resolve Aliases: search Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`term`	string	Yes	Any string	Resource name or fragment to resolve.

Resolve resources

Return ranked candidates for a resource name or fragment.

$ annie graph query "SELECT * FROM resolve WHERE term = checkout LIMIT 10"

resource_details

Read one current graph resource by exact stable ID with safe properties and bounded relationships. Result intent: resource Aliases: resource_detail, details Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`id`	string	Yes	Any string	Exact hashedID or Anyshift ID.

Exact resource details

Return one resource by stable graph identity; names and fuzzy selectors are not accepted.

$ annie graph query "SELECT * FROM resource_details WHERE id = 'pagerduty/escalation-policy/PQ3UO6W' LIMIT 100"

events

Read the infrastructure change-event timeline. Result intent: events Aliases: event Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`type`	string	No	Any string	Event type or type fragment, such as oom or scaling.
`target`	string	No	Any string	Resource name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`noise`	enum	No	`signal` (aliases: `false`, `exclude`) `all` (aliases: `true`, `include`)	Whether to include noisy events.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Recent resource events

Read recent events for a resource inside a time window.

$ annie graph query "SELECT * FROM events WHERE target = checkout AND since = 2h LIMIT 20"

cloud_events

Read evidence-backed AWS, Azure, and GCP change events without parsing summaries. Result intent: cloudevents Aliases: cloudevents, cloud_event Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`provider`	enum	No	`aws` `azure` `gcp`	Cloud provider.
`scope`	string	No	Any string	Provider scope: AWS account, Azure subscription, or GCP project.
`region`	string	No	Any string	Cloud region or location.
`category`	enum	No	`security` `identity` `lifecycle` `configuration` `capacity` `backup` `other`	Normalized cloud-change category.
`type`	string	No	Any string	Exact normalized event type. Underscores are preserved.
`resource`	string	No	Any string	Exact ARN, ARM ID, graph id, or unambiguous resource name.
`actor`	string	No	Any string	Actor identity, name, or graph id.
`correlation`	string	No	Any string	Anyshift event-story correlation id.
`operation`	string	No	Any string	Provider-native operation id.
`stats`	enum	No	`exact` `none`	Whether to calculate exact full-window statistics.
`noise`	enum	No	`signal` (aliases: `false`, `exclude`) `all` (aliases: `true`, `include`, `raw`)	Whether to include high-noise evidence.
`diff`	enum	No	`false` (aliases: `no`, `none`) `true` (aliases: `yes`, `include`)	Whether to include sanitized before/after values.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.
`cursor`	string	No	Any string	Opaque seek cursor returned by the previous page.

Recent cloud changes

Read a bounded provider-neutral cloud-change timeline.

$ annie graph query "SELECT * FROM cloud_events WHERE provider = aws AND category = security AND since = 24h LIMIT 50"

cloud_resources

Inspect current or recently deleted AWS, Azure, and GCP resources with freshness and provenance. Result intent: cloudresources Aliases: cloudresources, cloud_inventory Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`provider`	enum	No	`aws` `azure` `gcp`	Cloud provider.
`scope`	string	No	Any string	Provider scope: AWS account, Azure subscription, or GCP project.
`region`	string	No	Any string	Cloud region or location.
`type`	string	No	Any string	Provider resource type, such as EC2_INSTANCE or COMPUTE_INSTANCES.
`resource`	string	No	Any string	Exact native id, graph id, or unambiguous resource name.
`lifecycle`	enum	No	`alive` `deleted` `all`	Resource lifecycle. Defaults to alive.
`provenance`	enum	No	`managed` `configured` `unknown`	IaC provenance status.
`freshness`	enum	No	`fresh` `stale` `unknown`	Freshness verdict relative to max_age.
`max_age`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.
`cursor`	string	No	Any string	Opaque seek cursor returned by the previous page.

Current cloud inventory

List provider resources with explicit freshness and provenance evidence.

$ annie graph query "SELECT * FROM cloud_resources WHERE provider = aws AND type = EC2_INSTANCE LIMIT 50"

delivery_events

Read commit, CI, release, and deployment evidence from the delivery graph. Result intent: deliveryevents Aliases: deliveryevents, delivery Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`stage`	enum	No	`commit` `ci` (aliases: `pipeline`) `release` `deploy` (aliases: `deployment`)	Delivery stage.
`type`	string	No	Any string	Exact event type, such as event_release or argocd_synced.
`resource`	string	No	Any string	Exact graph id or unambiguous target name.
`actor`	string	No	Any string	Actor identity, name, or graph id.
`source`	string	No	Any string	Persisted event source.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.
`cursor`	string	No	Any string	Opaque seek cursor returned by the previous page.

Recent delivery activity

Read a bounded software-delivery timeline without inferring missing actors or commits.

$ annie graph query "SELECT * FROM delivery_events WHERE stage = release AND since = 7d LIMIT 50"

provenance

Trace a resource to stored release, commit, and actor evidence. Result intent: provenance Aliases: release_provenance, delivery_provenance Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Resource, repository, release, image, or service to trace.

Release provenance

Return only stored release-to-commit-to-actor evidence.

$ annie graph query "SELECT * FROM provenance WHERE resource = checkout LIMIT 20"

ownership

Resolve observed GitHub user or team code ownership and contact identities. Result intent: ownership Aliases: owners, code_ownership Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Repository or resource whose observed owner is required.

Observed code ownership

Return OWNS_CODE evidence and any linked people; missing edges remain unknown.

$ annie graph query "SELECT * FROM ownership WHERE resource = anyshift-io/checkout LIMIT 20"

graph_coverage

Inspect current node, relationship, bridge, and event evidence by graph source. Result intent: graphcoverage Aliases: graphcoverage, source_coverage Modifiers: None

Filter	Type	Required	Accepted values	Description
`source`	enum	No	`kubernetes` (aliases: `k8s`) `cloud` `github` (aliases: `scm`) `datadog` `tempo` `dynatrace` `victoria` `grafana`	Source universe.

Graph source coverage

Report only observed graph evidence; absent does not imply configuration state.

$ annie graph query "SELECT * FROM graph_coverage"

resources

Count and sample current resources of one graph resource type. Result intent: inventory Aliases: resource, inventory Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`type`	string	Yes	Any string	Graph resource type, such as service or deployment.
`source`	enum	No	`cloud_api` `terraform_state` `evaluation` `unknown`	Stored inventory provenance. The filter is applied before canonical deduplication.

Resource inventory

Return the inventory for one resource type.

$ annie graph query "SELECT * FROM resources WHERE type = deployment LIMIT 50"

operational_impact

Find potential operational impact through reviewed directional graph relationships. Result intent: impact Aliases: potential_impact Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Root resource whose potential impact to evaluate.
`depth`	integer	No	Any string	Maximum propagation depth from 1 to 3. Defaults to 2.

Potential operational impact

Return resources reachable through reviewed operational impact relationships.

$ annie graph query "SELECT * FROM operational_impact WHERE resource = checkout-db AND depth = 2 LIMIT 50"

connections

Inspect direct upstream and downstream relationships for a resource. Result intent: connections Aliases: connection, deps Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Resource name or identifier.

Direct connections

Return the resource and its direct graph neighbors.

$ annie graph query "SELECT * FROM connections WHERE resource = checkout LIMIT 50"

hotspots

Rank noisy resources, namespaces, alert rules, or alerting workloads. Result intent: hotspots Aliases: hotspot Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`type`	string	No	Any string	Event type or type fragment.
`by`	enum	No	`resource` (aliases: `resources`) `namespace` (aliases: `namespaces`, `ns`) `alertrule` (aliases: `alertrules`, `rule`) `alertworkload` (aliases: `alertworkloads`, `workload`)	Ranking dimension.
`namespace`	string	No	Any string	Kubernetes namespace scope.
`noise`	enum	No	`signal` (aliases: `false`, `exclude`) `all` (aliases: `true`, `include`)	Whether to include noisy events.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Resource hotspots

Rank resources by recent event activity.

$ annie graph query "SELECT * FROM hotspots WHERE by = resource AND since = 24h LIMIT 10"

correlations

Reconstruct a correlated Anyshift event group around a target or correlation identifier. Result intent: correlations Aliases: correlation Modifiers: None

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`id`	string	No	Any string	Correlation identifier.
`type`	string	No	Any string	Optional event type filter.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Correlation by target

At least one of target or id is required; since bounds target resolution.

$ annie graph query "SELECT * FROM correlations WHERE target = checkout AND since = 2h"

Correlation by id

Load one exact correlation group.

$ annie graph query "SELECT * FROM correlations WHERE id = incident-123"

incidents

Deprecated alias for correlations. Reconstruct a correlated Anyshift event group around a target or correlation identifier. Result intent: incident Aliases: incident Modifiers: None

Deprecated since v1. Use correlations for new queries.

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`id`	string	No	Any string	Correlation identifier.
`type`	string	No	Any string	Optional event type filter.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Incident by target

Deprecated. Prefer correlations. At least one of target or id is required; since bounds target resolution.

$ annie graph query "SELECT * FROM incidents WHERE target = checkout AND since = 2h"

Incident by correlation id

Deprecated. Prefer correlations. Load one exact correlation group.

$ annie graph query "SELECT * FROM incidents WHERE id = incident-123"

failures

Read recent failure-class infrastructure events. Result intent: failures Aliases: None Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Recent failures

Read failures for a target, namespace, or the whole project.

$ annie graph query "SELECT * FROM failures WHERE namespace = commerce AND since = 2h LIMIT 20"

deployments

Read recent workload deployments and image changes. Result intent: deployments Aliases: deployment, rollouts Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Workload name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Recent deployments

Read deployments for a target, namespace, or the whole project.

$ annie graph query "SELECT * FROM deployments WHERE namespace = commerce AND since = 24h LIMIT 20"

audit

Read configuration, identity, and infrastructure audit events. Result intent: audit Aliases: changes Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`type`	string	No	Any string	Audit event type or fragment, such as rbac.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

RBAC audit

Read recent RBAC-related changes.

$ annie graph query "SELECT * FROM audit WHERE type = rbac AND since = 24h LIMIT 20"

nodes

Read node lifecycle and capacity events. Result intent: nodes Aliases: node Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Node name or fragment.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Node activity

Read recent node events.

$ annie graph query "SELECT * FROM nodes WHERE since = 6h LIMIT 20"

deploy_impact

Join recent deployments to the failures that followed them. Result intent: deployimpact Aliases: impact, risky Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Workload name or fragment.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Deployment impact

Rank recent deployment fallout or inspect one workload.

$ annie graph query "SELECT * FROM deploy_impact WHERE target = checkout AND since = 24h LIMIT 10"

common_cause

Find shared infrastructure or dependencies behind recent failures. Result intent: commoncause Aliases: commoncause, cause Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`namespace`	string	No	Any string	Kubernetes namespace scope.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Shared failure causes

Intersect recent failures by node, workload, datastore, and external dependency.

$ annie graph query "SELECT * FROM common_cause WHERE namespace = commerce AND since = 2h LIMIT 10"

blast_radius

Calculate the transitive workloads, pods, and services affected by a resource. Result intent: blast Aliases: blast Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Starting resource name or identifier.

Resource blast radius

Walk impact outward from one resource.

$ annie graph query "SELECT * FROM blast_radius WHERE resource = shared-runtime-sa LIMIT 100"

spof

Rank highly shared ConfigMaps, service accounts, or nodes by fan-in. Result intent: spof Aliases: spofs Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`configmap` (aliases: `configmaps`, `cm`) `serviceaccount` (aliases: `serviceaccounts`, `sa`) `node` (aliases: `nodes`)	Resource kind to rank. Defaults to configmap.
`namespace`	string	No	Any string	Kubernetes namespace scope.

Shared service accounts

Rank service accounts by dependent workloads and pods.

$ annie graph query "SELECT * FROM spof WHERE kind = serviceaccount LIMIT 10"

orphans

Find unused or dangling Kubernetes resources. Result intent: orphans Aliases: orphan, unused, dangling Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`configmap` (aliases: `configmaps`, `cm`) `serviceaccount` (aliases: `serviceaccounts`, `sa`) `role` (aliases: `roles`) `replicaset` (aliases: `replicasets`, `rs`)	Resource kind to inspect. Defaults to configmap.
`namespace`	string	No	Any string	Kubernetes namespace scope.

Orphaned roles

Find roles with no observed consumers.

$ annie graph query "SELECT * FROM orphans WHERE kind = role AND namespace = commerce LIMIT 20"

coverage

Find service, monitor, or metrics coverage gaps. Result intent: coverage Aliases: blindspots, unmonitored, uncovered Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`service` (aliases: `services`, `workload`, `workloads`) `monitor` (aliases: `monitors`) `metrics` (aliases: `metric`)	Coverage dimension. Defaults to service.
`namespace`	string	No	Any string	Kubernetes namespace scope.

Monitoring gaps

Find unmonitored services in one namespace.

$ annie graph query "SELECT * FROM coverage WHERE kind = service AND namespace = commerce LIMIT 20"

access

Inspect RBAC reach or rank over-privileged service accounts. Result intent: access Aliases: rbac, permissions Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	No	Any string	Subject or role name in reach mode; optional namespace scope in privileged mode.
`mode`	enum	No	`reach` `privileged`	Access analysis mode. Defaults to reach.

Subject reach

Reach mode requires resource.

$ annie graph query "SELECT * FROM access WHERE resource = ci-deployer"

Privileged identities

Privileged mode can optionally scope resource to a namespace.

$ annie graph query "SELECT * FROM access WHERE mode = privileged LIMIT 10"

exposure

Trace bidirectional stored public-exposure routes and attached controls for one resource. Result intent: exposure Aliases: exposed, attack_surface Modifiers: LIMIT Selector: exactly one of resource, resource_id; non-empty: resource, resource_id, resource_type, resource_namespace, resource_cluster, cursor.

Filter	Type	Required	Accepted values	Description
`resource`	string	No	Non-empty string	Non-empty resource name or FQDN; exactly one of resource and resource_id is required.
`resource_id`	string	No	Non-empty string	Non-empty stable graph or provider id; cannot be combined with resource or name qualifiers.
`resource_type`	string	No	Non-empty string	Non-empty name-only qualifier; requires resource and sets exact selection.
`resource_namespace`	string	No	Non-empty string	Non-empty name-only qualifier; requires resource and sets exact selection.
`resource_cluster`	string	No	Non-empty string	Non-empty name-only qualifier; requires resource and sets exact selection.
`cursor`	string	No	Non-empty string	Non-empty opaque seek cursor bound to the subject and perspective of the previous exposure page.

Public exposure by name

Resolve one name or FQDN and select the traversal perspective from that subject.

$ annie graph query "SELECT * FROM exposure WHERE resource = api.example.com"

Public exposure by stable id

Bypass name resolution with one stable graph or provider identity.

$ annie graph query "SELECT * FROM exposure WHERE resource_id = 'cf://accounts/a/zones/z/hostnames/api.example.com'"

Qualified exact public exposure

Use name-only qualifiers to force exact typed subject selection.

$ annie graph query "SELECT * FROM exposure WHERE resource = checkout AND resource_type = K8S_SERVICE AND resource_namespace = payments"

tenancy

Find workloads co-located with a resource on the same node. Result intent: tenancy Aliases: colocation, colocated, neighbors Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Workload, pod, or node name.

Noisy neighbors

Inspect resources sharing a node with the target.

$ annie graph query "SELECT * FROM tenancy WHERE resource = checkout LIMIT 20"

sharedconfig

Find workloads coupled through shared configuration. Result intent: sharedconfig Aliases: shared_config, configsiblings, config_siblings, configcoupled Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Workload or configuration resource name.

Shared configuration

Find workloads sharing configuration with the target.

$ annie graph query "SELECT * FROM sharedconfig WHERE resource = checkout LIMIT 20"

path

Find the shortest infrastructure or operational path between two resources; both scopes include reviewed Cloudflare traffic edges. Result intent: path Aliases: paths Modifiers: None

Filter	Type	Required	Accepted values	Description
`from`	string	No	Any string	Starting resource name. Required unless from_id is supplied.
`from_exact`	string	No	Any string	Set true for exact-name matching instead of legacy fuzzy resolution.
`from_id`	string	No	Any string	Exact starting hashedID or anyshiftID.
`from_type`	string	No	Any string	Exact starting resource label, such as K8S_DEPLOYMENT.
`from_namespace`	string	No	Any string	Exact starting Kubernetes namespace.
`from_cluster`	string	No	Any string	Exact starting cluster name.
`to`	string	No	Any string	Destination resource name. Required unless to_id is supplied.
`to_exact`	string	No	Any string	Set true for exact-name matching instead of legacy fuzzy resolution.
`to_id`	string	No	Any string	Exact destination hashedID or anyshiftID.
`to_type`	string	No	Any string	Exact destination resource label, such as TEMPO_DATASTORE.
`to_namespace`	string	No	Any string	Exact destination Kubernetes namespace.
`to_cluster`	string	No	Any string	Exact destination cluster name.
`scope`	enum	No	`infrastructure` `operational`	Relationships available to the path traversal. Defaults to infrastructure.

Shortest path

Each endpoint requires a name or id. Typed selectors resolve same-named resources deterministically.

$ annie graph query "SELECT * FROM path WHERE from = checkout-api AND from_type = K8S_DEPLOYMENT AND to = postgresql AND to_type = TEMPO_DATASTORE AND scope = operational"

cascade

Trace an incident correlation group in propagation order. Result intent: cascade Aliases: cascades Modifiers: None

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`id`	string	No	Any string	Correlation identifier.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Cascade by target

At least one of target or id is required; since bounds target resolution.

$ annie graph query "SELECT * FROM cascade WHERE target = checkout AND since = 2h"

Cascade by correlation id

Trace one exact correlation group.

$ annie graph query "SELECT * FROM cascade WHERE id = incident-123"

alert_impact

Find monitors and SLOs affected by a resource failure. Result intent: alertimpact Aliases: alertimpact Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Infrastructure resource name.

Alert impact

Map an infrastructure resource to affected observability objects.

$ annie graph query "SELECT * FROM alert_impact WHERE resource = checkout"

monitor

Resolve a monitor to the infrastructure it observes. Result intent: monitor Aliases: monitors Modifiers: None

Filter	Type	Required	Accepted values	Description
`target`	string	Yes	Any string	Monitor name or fragment.

Monitor infrastructure

Map one monitor to its service, workload, and node.

$ annie graph query "SELECT * FROM monitor WHERE target = checkout-latency"

datastore

Inspect datastore dependencies or rank widely used datastores. Result intent: datastore Aliases: datastores Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service or datastore name.
`source`	enum	No	`auto` `datadog` `tempo` `dynatrace`	APM dependency source. Defaults to auto.

Rank datastores

Omit target to rank datastore fan-in.

$ annie graph query "SELECT * FROM datastore LIMIT 10"

Datastore dependencies

Inspect services connected to one datastore or datastores used by one service.

$ annie graph query "SELECT * FROM datastore WHERE target = checkout-postgres"

flow

Inspect stream producers and consumers or rank busy streams. Result intent: flow Aliases: flows, stream Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service, topic, queue, or stream name.
`source`	enum	No	`auto` `datadog` `tempo` `dynatrace`	APM dependency source. Defaults to auto.

Stream dependencies

Inspect producers and consumers for a stream.

$ annie graph query "SELECT * FROM flow WHERE target = checkout-events"

external_dep

Inspect external dependencies or rank high-fan-in external hosts. Result intent: externaldep Aliases: externaldep, external Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service or external dependency name.
`source`	enum	No	`auto` `datadog` `tempo` `dynatrace`	APM dependency source. Defaults to auto.

External dependencies

Inspect services depending on one external host.

$ annie graph query "SELECT * FROM external_dep WHERE target = payments.example.com"

alerts

List normalized operational alerts while retaining legacy Datadog firing-monitor fields. Result intent: alerts Aliases: alert, firing Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Legacy Datadog service or workload name.
`provider`	enum	No	`pagerduty` (aliases: `pd`) `datadog` (aliases: `dd`) `grafana` `victoria` `dynatrace` `newrelic` (aliases: `new_relic`) `incidentio` (aliases: `incident_io`)	Operational evidence provider.
`status`	enum	No	`firing` (aliases: `open`, `triggered`) `recovered` (aliases: `resolved`) `suppressed` `unknown` `all`	Canonical alert state. Defaults to firing.
`severity`	enum	No	`critical` `warning` `info` `unknown`	Canonical alert severity.
`service_id`	string	No	Any string	Exact stable identity of a canonical graph service.
`service`	string	No	Any string	Exact canonical graph service name.
`service_type`	string	No	Any string	Exact canonical graph service label.
`service_namespace`	string	No	Any string	Exact canonical service namespace.
`service_cluster`	string	No	Any string	Exact canonical service cluster.
`provider_service_id`	string	No	Any string	Exact provider-native service identifier.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.
`from`	string	No	Any string	Absolute RFC3339 lower time bound.
`to`	string	No	Any string	Absolute RFC3339 upper time bound.
`at`	string	No	Any string	Absolute RFC3339 point in time, or now.
`cursor`	string	No	Any string	Opaque keyset cursor returned by a previous page.

Current alerts

List firing operational alerts; legacy Datadog fields remain additive siblings.

$ annie graph query "SELECT * FROM alerts WHERE status = firing LIMIT 20"

response_incidents

List provider-neutral response incidents that coordinate alert handling. Result intent: responseincidents Aliases: response_incident Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`provider`	enum	No	`pagerduty` (aliases: `pd`) `datadog` (aliases: `dd`) `grafana` `victoria` `dynatrace` `newrelic` (aliases: `new_relic`) `incidentio` (aliases: `incident_io`)	Operational evidence provider.
`status`	enum	No	`active` `open` (aliases: `triggered`) `acknowledged` (aliases: `acked`) `resolved` (aliases: `closed`) `unknown` `all`	Canonical response-incident state. Defaults to open and acknowledged.
`service_id`	string	No	Any string	Exact stable identity of a canonical graph service.
`service`	string	No	Any string	Exact canonical graph service name.
`service_type`	string	No	Any string	Exact canonical graph service label.
`service_namespace`	string	No	Any string	Exact canonical service namespace.
`service_cluster`	string	No	Any string	Exact canonical service cluster.
`provider_service_id`	string	No	Any string	Exact provider-native service identifier.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.
`from`	string	No	Any string	Absolute RFC3339 lower time bound.
`to`	string	No	Any string	Absolute RFC3339 upper time bound.
`at`	string	No	Any string	Absolute RFC3339 point in time, or now.
`cursor`	string	No	Any string	Opaque keyset cursor returned by a previous page.
`responder`	string	No	Any string	Exact display name, canonical person ID or email, or provider user ID.
`urgency`	string	No	Any string	Provider urgency value; preserved as provider-specific evidence.

Active response incidents

List open or acknowledged incidents from stored graph evidence.

$ annie graph query "SELECT * FROM response_incidents WHERE provider = pagerduty LIMIT 50"

oncall

List effective on-call responsibility for a point in time or bounded window. Result intent: oncall Aliases: on_call, oncalls Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`provider`	enum	No	`pagerduty` (aliases: `pd`) `datadog` (aliases: `dd`) `grafana` `victoria` `dynatrace` `newrelic` (aliases: `new_relic`) `incidentio` (aliases: `incident_io`)	Operational evidence provider.
`status`	enum	No	`scheduled` `active` `ended` `all`	Canonical on-call window state.
`service_id`	string	No	Any string	Exact stable identity of a canonical graph service.
`service`	string	No	Any string	Exact canonical graph service name.
`service_type`	string	No	Any string	Exact canonical graph service label.
`service_namespace`	string	No	Any string	Exact canonical service namespace.
`service_cluster`	string	No	Any string	Exact canonical service cluster.
`provider_service_id`	string	No	Any string	Exact provider-native service identifier.
`from`	string	No	Any string	Absolute RFC3339 lower time bound.
`to`	string	No	Any string	Absolute RFC3339 upper time bound.
`at`	string	No	Any string	Absolute RFC3339 point in time, or now.
`cursor`	string	No	Any string	Opaque keyset cursor returned by a previous page.
`person`	string	No	Any string	Exact source identity or canonical person identity.
`schedule`	string	No	Any string	Exact provider schedule identifier.

Current on-call

List effective on-call windows at the selected point in time.

$ annie graph query "SELECT * FROM oncall WHERE at = now LIMIT 50"

incident_context

Group stored incident, alert, service, on-call, responder, and reviewed history hops without live provider calls. Result intent: incidentcontext Aliases: incidentcontext Modifiers: LIMIT Selector: exactly one of id, target; non-empty: id, target.

Filter	Type	Required	Accepted values	Description
`id`	string	No	Non-empty string	Exact provider incident ID or Anyshift incident ID.
`target`	string	No	Non-empty string	Exact canonical resource name, Anyshift ID, hashed ID, or provider service identity.
`provider`	enum	No	`pagerduty` (aliases: `pd`) `datadog` (aliases: `dd`) `grafana` `victoria` `dynatrace` `newrelic` (aliases: `new_relic`) `incidentio` (aliases: `incident_io`)	Operational evidence provider.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Incident context by provider id

Exactly one of id or target is required. History uses stored similar incidents and reviewed resolution evidence.

$ annie graph query "SELECT * FROM incident_context WHERE id = Q2Q5QBE019PJM5 LIMIT 10"

Incident context by mapped service

Resolve the latest stored incident that AFFECTS a PagerDuty service with RESOLVES_TO the named resource.

$ annie graph query "SELECT * FROM incident_context WHERE target = checkout AND since = 30d LIMIT 10"

alert_noise

Rank flapping or stuck monitors. Result intent: alertnoise Aliases: alertnoise, noise, flapping, noisy Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Monitor or service name.
`kind`	enum	No	`flapping` (aliases: `flap`) `stuck`	Noise pattern.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Flapping alerts

Rank recently flapping monitors.

$ annie graph query "SELECT * FROM alert_noise WHERE kind = flapping AND since = 1d LIMIT 10"

calls

Inspect APM service callers, callees, and HTTP route evidence or rank call-graph fan-in. Result intent: calls Aliases: call, callgraph Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service name.
`source`	enum	No	`auto` `datadog` `tempo` `dynatrace`	APM dependency source. Defaults to auto.

Service calls

Inspect callers, callees, and available templated HTTP operations for one service.

$ annie graph query "SELECT * FROM calls WHERE target = checkout"

servicetree

Expand a service’s downstream services, datastores, and external dependencies. Result intent: servicetree Aliases: service_tree, footprint Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Root service name.
`source`	enum	No	`auto` `datadog` `tempo` `dynatrace`	APM dependency source. Defaults to auto.

Service tree

Expand the downstream footprint of one service.

$ annie graph query "SELECT * FROM servicetree WHERE target = checkout LIMIT 50"

alert_cause

Join a firing service or workload to recent Kubernetes changes. Result intent: alertcause Aliases: alertcause, rootcause Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	Yes	Any string	Service or workload name.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Alert cause

Find recent infrastructure changes behind a firing target.

$ annie graph query "SELECT * FROM alert_cause WHERE target = checkout AND since = 2h LIMIT 20"

slo

Inspect one SLO or rank breaching and at-risk SLOs. Result intent: slo Aliases: slos Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	SLO name or fragment.

SLO health

Inspect one SLO by name.

$ annie graph query "SELECT * FROM slo WHERE target = 'checkout availability'"

alertrules

Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory. Result intent: alertrules Aliases: alert_rules, grafana, victoria Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`subject`	enum	No	`coverage` `inventory` (aliases: `inventories`) `target` (aliases: `targets`)	Alert-rule view. Defaults to coverage.
`namespace`	string	No	Any string	Namespace scope for coverage or inventory.
`target`	string	No	Any string	Service or workload name. Required when subject is target.

Alert-rule coverage

Find services or workloads without alert rules.

$ annie graph query "SELECT * FROM alertrules WHERE subject = coverage AND namespace = commerce LIMIT 20"

Rules for a target

Target subject requires target.

$ annie graph query "SELECT * FROM alertrules WHERE subject = target AND target = checkout"

iac

Inspect Terraform code-to-state-to-cloud provenance and linkage coverage. Result intent: iac Aliases: terraform, iac_provenance Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`resource`	string	No	Any string	Terraform address or Terraform, state, or cloud graph identifier.
`status`	enum	No	`managed` `unlinked` `missing_cloud` (aliases: `missingcloud`, `state_only`) `ambiguous` `stale` `invalid`	IaC linkage status.
`freshness`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

IaC coverage

Summarize Terraform code-to-state-to-cloud linkage and return a bounded resource page.

$ annie graph query "SELECT * FROM iac LIMIT 50"

Resource provenance

Show one resource’s Terraform, state, and cloud evidence. Exact state/cloud identifiers select their relationship chain; a generic Terraform declaration keeps all instances.

$ annie graph query "SELECT * FROM iac WHERE resource = aws_instance.api_server"

IaC linkage gaps

List resources with one evidence-backed linkage status.

$ annie graph query "SELECT * FROM iac WHERE status = unlinked LIMIT 50"

iac_drift

Compare last-applied Terraform state with fresh observed cloud properties. Result intent: iacdrift Aliases: terraform_drift, drift Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`resource`	string	No	Any string	Terraform address or Terraform, state, or cloud graph identifier.
`status`	enum	No	`drifted` `in_sync` (aliases: `insync`, `synced`) `unknown`	Drift verdict.
`freshness`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Current IaC drift

List supported state-to-cloud differences, excluding unknown evidence by default.

$ annie graph query "SELECT * FROM iac_drift WHERE status = drifted LIMIT 50"

Resource drift

Evaluate one Terraform resource using its state and cloud evidence.

$ annie graph query "SELECT * FROM iac_drift WHERE resource = aws_instance.api_server"

gitops

Inspect GitOps drift, unmanaged workloads, or resource ownership. Result intent: gitops Aliases: argocd, gitops_drift, argocd_drift Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`subject`	enum	No	`drift` (aliases: `drifted`) `unmanaged` `owner` (aliases: `ownership`)	GitOps view. Defaults to drift.
`namespace`	string	No	Any string	Namespace scope for drift or unmanaged views.
`resource`	string	No	Any string	Workload name. Required when subject is owner.

GitOps drift

List drifted applications, optionally scoped to a namespace.

$ annie graph query "SELECT * FROM gitops WHERE subject = drift AND namespace = commerce LIMIT 20"

Resource owner

Owner subject requires resource.

$ annie graph query "SELECT * FROM gitops WHERE subject = owner AND resource = checkout"

image

Inspect image usage, workload containers, or container hygiene gaps. Result intent: image Aliases: images, containers Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Image, service, or workload name.
`workload`	string	No	Any string	Workload whose container resources should be inspected.
`digest`	string	No	Any string	Exact running image digest (sha256, repository digest, or runtime image ID).
`kind`	enum	No	`nomemlimit` (aliases: `no_mem_limit`, `nomemorylimit`) `nocpurequest` (aliases: `no_cpu_request`) `skew` (aliases: `versionskew`, `version_skew`)	Container hygiene scan.
`namespace`	string	No	Any string	Namespace scope for a hygiene scan.

Runtime digest usage

Find live containers and owning workloads running an exact image digest.

$ annie graph query "SELECT * FROM image WHERE digest = 'sha256:776129790f01a675bb6e98447c2a28d43a07144d5410691823dbf9a21d256b1e' LIMIT 50"

Image usage

Inspect who runs an image or what image a target runs.

$ annie graph query "SELECT * FROM image WHERE target = checkout"

Container hygiene

Kind selects a hygiene scan and namespace optionally scopes it.

$ annie graph query "SELECT * FROM image WHERE kind = nomemlimit AND namespace = commerce LIMIT 20"

netpol

Inspect NetworkPolicy coverage, policies, or east-west reach. Result intent: netpol Aliases: netpols, networkpolicy, segmentation, defaultallow Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`mode`	enum	No	`uncovered` (aliases: `coverage`, `default_allow`, `defaultallow`) `policy` (aliases: `policies`) `segmentation` (aliases: `segment`)	Network policy view. Defaults to uncovered.
`namespace`	string	No	Any string	Namespace scope for uncovered or policy views.
`target`	string	No	Any string	Workload or policy name. Required for segmentation.

NetworkPolicy gaps

Find default-allow namespaces.

$ annie graph query "SELECT * FROM netpol WHERE mode = uncovered LIMIT 20"

East-west reach

Segmentation mode requires target.

$ annie graph query "SELECT * FROM netpol WHERE mode = segmentation AND target = checkout"

priority

Inspect scheduling priority gaps, the class ladder, or one target’s priority. Result intent: priority Aliases: priorityclass, preemption, nopriority Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`nopriority` (aliases: `unprioritized`, `none`) `ladder` (aliases: `classes`, `class`)	Priority view.
`namespace`	string	No	Any string	Namespace scope for missing-priority checks.
`target`	string	No	Any string	Workload or pod name whose priority should be inspected.

Missing priority classes

Find workloads without a priority class.

$ annie graph query "SELECT * FROM priority WHERE kind = nopriority AND namespace = commerce LIMIT 20"

Target priority

Inspect the priority class for one workload or pod.

$ annie graph query "SELECT * FROM priority WHERE target = checkout"

storage

Inspect workload storage and find orphaned or unclaimed volumes. Result intent: storage Aliases: volumes, pv, pvc, storageclass Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`mode`	enum	No	`footprint` (aliases: `workload`) `orphanpv` (aliases: `orphanpvs`, `orphaned`, `orphan`) `unclaimedpvc` (aliases: `unclaimedpvcs`, `unclaimed`) `byclass` (aliases: `class`, `storageclass`)	Storage view. Defaults to footprint.
`workload`	string	No	Any string	Workload or pod name. Required in footprint mode.
`resource`	string	No	Any string	Alias for workload in footprint mode.
`class`	string	No	Any string	StorageClass filter for orphanpv or byclass mode.
`namespace`	string	No	Any string	Namespace scope for unclaimedpvc mode.

Workload storage

Footprint mode requires workload or resource.

$ annie graph query "SELECT * FROM storage WHERE workload = checkout"

Unclaimed PVCs

Find unclaimed claims, optionally scoped to a namespace.

$ annie graph query "SELECT * FROM storage WHERE mode = unclaimedpvc AND namespace = commerce LIMIT 20"

pdb

Find workloads without PodDisruptionBudgets or inspect one workload or PDB. Result intent: pdb Aliases: pdbs, unprotected, disruption Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Workload or PDB name.
`workload`	string	No	Any string	Workload name.
`pdb`	string	No	Any string	PodDisruptionBudget name.

PDB coverage gaps

Omit filters to list workloads without PDB protection.

$ annie graph query "SELECT * FROM pdb LIMIT 20"

Target PDB coverage

Inspect one workload or PDB by target, workload, or pdb.

$ annie graph query "SELECT * FROM pdb WHERE workload = checkout"

scaling

Find workloads without HPAs, list autoscaled workloads, or inspect one target. Result intent: scaling Aliases: hpa, hpas, autoscaling, autoscalers Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`mode`	enum	No	`nohpa` (aliases: `no_hpa`, `unscaled`, `fixed`, `coverage`) `autoscaled` (aliases: `hpa`, `scaled`) `target`	Autoscaling view. Defaults to nohpa.
`namespace`	string	No	Any string	Namespace scope for nohpa or autoscaled views.
`target`	string	No	Any string	Workload or HPA name. Required in target mode.

Autoscaling gaps

Find workloads without HPAs.

$ annie graph query "SELECT * FROM scaling WHERE mode = nohpa AND namespace = commerce LIMIT 20"

Target autoscaling

Target mode requires target.

$ annie graph query "SELECT * FROM scaling WHERE target = checkout"

topology

Build a typed service topology at a selected level. Result intent: topology Aliases: diagram, c4 Modifiers: None

Filter	Type	Required	Accepted values	Description
`service`	string	Yes	Any string	Service or workload name.
`level`	enum	No	`context` `container` `component` `dynamic`	Topology level. Defaults to container.
`source`	enum	No	`auto` `datadog` `tempo` `dynatrace` `configuration`	Topology evidence source. Defaults to auto-discovered APM evidence.
`endpoint`	string	No	Any string	Explicit endpoint alias used to prove a configured dependency.
`dependency`	string	No	Any string	Catalog service name represented by the endpoint alias.

Service topology

Service is required; level selects the topology depth.

$ annie graph query "SELECT * FROM topology WHERE service = checkout AND level = context"

Use the catalog programmatically

The OpenAPI document exposes this catalog under the root x-anyshift-query-language extension. Tooling can read that versioned object to generate completion, validation, documentation, or custom query builders without duplicating the language by hand. For typed TypeScript helpers, see Graph SDK Capabilities. For raw query execution and error handling, see the Graph SDK guide.

​Discover queries from Annie CLI

​Syntax

​Query targets

​resolve

​Resolve resources

​resource_details

​Exact resource details

​events

​Recent resource events

​cloud_events

​Recent cloud changes

​cloud_resources

​Current cloud inventory

​delivery_events

​Recent delivery activity

​provenance

​Release provenance

​ownership

​Observed code ownership

​graph_coverage

​Graph source coverage

​resources

​Resource inventory

​operational_impact

​Potential operational impact

​connections

​Direct connections

​hotspots

​Resource hotspots

​correlations

​Correlation by target

​Correlation by id

​incidents

​Incident by target

​Incident by correlation id

​failures

​Recent failures

​deployments

​Recent deployments

​audit

​RBAC audit

​nodes

​Node activity

​deploy_impact

​Deployment impact

​common_cause

​Shared failure causes

​blast_radius

​Resource blast radius

​spof

​Shared service accounts

​orphans

​Orphaned roles

​coverage

​Monitoring gaps

​access

​Subject reach

​Privileged identities

​exposure

​Public exposure by name

​Public exposure by stable id

​Qualified exact public exposure

​tenancy

​Noisy neighbors

​sharedconfig

​Shared configuration

​path

​Shortest path

​cascade

​Cascade by target

​Cascade by correlation id

​alert_impact

​Alert impact

​monitor

​Monitor infrastructure

​datastore

​Rank datastores

​Datastore dependencies

​flow

​Stream dependencies