Graph Query Language - Starter Kit

The Anyshift Graph Query Language gives you deterministic, read-only access to infrastructure graph data. Use it when you know the operation you need and want the same query to produce the same typed result in a terminal, script, CI job, or application. This page is generated from the versioned query catalog published in the Graph API OpenAPI contract. The same catalog is embedded in Annie CLI and published with the Graph SDK.

Discover queries from Annie CLI

You do not need to memorize table or filter names. Annie CLI can inspect its embedded catalog without authentication, a selected project, or network access:

$ annie graph query --list
$ annie graph query --describe spof

The second command explains that spof accepts a kind filter, lists serviceaccount as an accepted value, and prints a copy-pasteable query. See the Annie CLI guide for authentication, project selection, and output modes.

Syntax

SELECT <*|count(*)> FROM <table> [WHERE k = v [AND ...]] [LIMIT n] [OFFSET n]

Selectors: *, count(*). Accepted selector aliases: count(1). Values may be bare words or single- or double-quoted strings. Filters use equality and can be combined with AND. A target only accepts the filters and enum values documented below. LIMIT and OFFSET are listed per target because not every result supports both modifiers.

Query targets

Target	Purpose	Filters	Modifiers
`resolve`	Resolve a resource name or fragment to ranked current graph resources.	`term`	`LIMIT`
`events`	Read the infrastructure change-event timeline.	`type`, `target`, `namespace`, `noise`, `since`	`LIMIT`, `OFFSET`
`resources`	Count and sample current resources of one graph resource type.	`type`	`LIMIT`, `OFFSET`
`connections`	Inspect direct upstream and downstream relationships for a resource.	`resource`	`LIMIT`
`hotspots`	Rank noisy resources, namespaces, alert rules, or alerting workloads.	`type`, `by`, `namespace`, `noise`, `since`	`LIMIT`
`incidents`	Reconstruct a correlated incident around a target or correlation identifier.	`target`, `id`, `type`	None
`failures`	Read recent failure-class infrastructure events.	`target`, `namespace`, `since`	`LIMIT`, `OFFSET`
`deployments`	Read recent workload deployments and image changes.	`target`, `namespace`, `since`	`LIMIT`, `OFFSET`
`audit`	Read configuration, identity, and infrastructure audit events.	`target`, `namespace`, `type`, `since`	`LIMIT`, `OFFSET`
`nodes`	Read node lifecycle and capacity events.	`target`, `since`	`LIMIT`, `OFFSET`
`deploy_impact`	Join recent deployments to the failures that followed them.	`target`, `since`	`LIMIT`
`common_cause`	Find shared infrastructure or dependencies behind recent failures.	`namespace`, `since`	`LIMIT`
`blast_radius`	Calculate the transitive workloads, pods, and services affected by a resource.	`resource`	`LIMIT`
`spof`	Rank highly shared ConfigMaps, service accounts, or nodes by fan-in.	`kind`, `namespace`	`LIMIT`
`orphans`	Find unused or dangling Kubernetes resources.	`kind`, `namespace`	`LIMIT`
`coverage`	Find service, monitor, or metrics coverage gaps.	`kind`, `namespace`	`LIMIT`
`access`	Inspect RBAC reach or rank over-privileged service accounts.	`resource`, `mode`	`LIMIT`
`exposure`	Trace public ingress exposure to or from a resource.	`resource`	`LIMIT`
`tenancy`	Find workloads co-located with a resource on the same node.	`resource`	`LIMIT`
`sharedconfig`	Find workloads coupled through shared configuration.	`resource`	`LIMIT`
`path`	Find the shortest infrastructure or operational path between two resources.	`from`, `from_exact`, `from_id`, `from_type`, `from_namespace`, `from_cluster`, `to`, `to_exact`, `to_id`, `to_type`, `to_namespace`, `to_cluster`, `scope`	None
`cascade`	Trace an incident correlation group in propagation order.	`target`, `id`	None
`alert_impact`	Find monitors and SLOs affected by a resource failure.	`resource`	`LIMIT`
`monitor`	Resolve a monitor to the infrastructure it observes.	`target`	None
`datastore`	Inspect datastore dependencies or rank widely used datastores.	`target`, `source`	`LIMIT`
`flow`	Inspect stream producers and consumers or rank busy streams.	`target`, `source`	`LIMIT`
`external_dep`	Inspect external dependencies or rank high-fan-in external hosts.	`target`, `source`	`LIMIT`
`alerts`	List currently firing monitors, optionally scoped to a service.	`target`	`LIMIT`
`alert_noise`	Rank flapping or stuck monitors.	`target`, `kind`, `since`	`LIMIT`
`calls`	Inspect service callers and callees or rank call-graph fan-in.	`target`, `source`	`LIMIT`
`servicetree`	Expand a service’s downstream services, datastores, and external dependencies.	`target`, `source`	`LIMIT`
`alert_cause`	Join a firing service or workload to recent Kubernetes changes.	`target`, `since`	`LIMIT`
`slo`	Inspect one SLO or rank breaching and at-risk SLOs.	`target`	`LIMIT`
`alertrules`	Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory.	`subject`, `namespace`, `target`	`LIMIT`
`gitops`	Inspect GitOps drift, unmanaged workloads, or resource ownership.	`subject`, `namespace`, `resource`	`LIMIT`
`image`	Inspect image usage, workload containers, or container hygiene gaps.	`target`, `workload`, `kind`, `namespace`	`LIMIT`
`netpol`	Inspect NetworkPolicy coverage, policies, or east-west reach.	`mode`, `namespace`, `target`	`LIMIT`
`priority`	Inspect scheduling priority gaps, the class ladder, or one target’s priority.	`kind`, `namespace`, `target`	`LIMIT`
`storage`	Inspect workload storage and find orphaned or unclaimed volumes.	`mode`, `workload`, `resource`, `class`, `namespace`	`LIMIT`
`pdb`	Find workloads without PodDisruptionBudgets or inspect one workload or PDB.	`target`, `workload`, `pdb`	`LIMIT`
`scaling`	Find workloads without HPAs, list autoscaled workloads, or inspect one target.	`mode`, `namespace`, `target`	`LIMIT`
`topology`	Build a typed service topology at a selected level.	`service`, `level`, `source`	None

resolve

Resolve a resource name or fragment to ranked current graph resources. Result intent: resolve
Aliases: search
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`term`	string	Yes	Any string	Resource name or fragment to resolve.

Resolve resources

Return ranked candidates for a resource name or fragment.

$ annie graph query 'SELECT * FROM resolve WHERE term = checkout LIMIT 10'

events

Read the infrastructure change-event timeline. Result intent: events
Aliases: event
Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`type`	string	No	Any string	Event type or type fragment, such as oom or scaling.
`target`	string	No	Any string	Resource name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`noise`	enum	No	`signal` (aliases: `false`, `exclude`) `all` (aliases: `true`, `include`)	Whether to include noisy events.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Recent resource events

Read recent events for a resource inside a time window.

$ annie graph query 'SELECT * FROM events WHERE target = checkout AND since = 2h LIMIT 20'

resources

Count and sample current resources of one graph resource type. Result intent: inventory
Aliases: resource, inventory
Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`type`	string	Yes	Any string	Graph resource type, such as service or deployment.

Resource inventory

Return the inventory for one resource type.

$ annie graph query 'SELECT * FROM resources WHERE type = deployment LIMIT 50'

connections

Inspect direct upstream and downstream relationships for a resource. Result intent: connections
Aliases: connection, deps
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Resource name or identifier.

Direct connections

Return the resource and its direct graph neighbors.

$ annie graph query 'SELECT * FROM connections WHERE resource = checkout LIMIT 50'

hotspots

Rank noisy resources, namespaces, alert rules, or alerting workloads. Result intent: hotspots
Aliases: hotspot
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`type`	string	No	Any string	Event type or type fragment.
`by`	enum	No	`resource` (aliases: `resources`) `namespace` (aliases: `namespaces`, `ns`) `alertrule` (aliases: `alertrules`, `rule`) `alertworkload` (aliases: `alertworkloads`, `workload`)	Ranking dimension.
`namespace`	string	No	Any string	Kubernetes namespace scope.
`noise`	enum	No	`signal` (aliases: `false`, `exclude`) `all` (aliases: `true`, `include`)	Whether to include noisy events.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Resource hotspots

Rank resources by recent event activity.

$ annie graph query 'SELECT * FROM hotspots WHERE by = resource AND since = 24h LIMIT 10'

incidents

Reconstruct a correlated incident around a target or correlation identifier. Result intent: incident
Aliases: incident
Modifiers: None

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`id`	string	No	Any string	Correlation identifier.
`type`	string	No	Any string	Optional event type filter.

Incident by target

At least one of target or id is required.

$ annie graph query 'SELECT * FROM incidents WHERE target = checkout'

Incident by correlation id

Load one exact correlation group.

$ annie graph query 'SELECT * FROM incidents WHERE id = incident-123'

failures

Read recent failure-class infrastructure events. Result intent: failures
Aliases: None
Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Recent failures

Read failures for a target, namespace, or the whole project.

$ annie graph query 'SELECT * FROM failures WHERE namespace = commerce AND since = 2h LIMIT 20'

deployments

Read recent workload deployments and image changes. Result intent: deployments
Aliases: deployment, rollouts
Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Workload name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Recent deployments

Read deployments for a target, namespace, or the whole project.

$ annie graph query 'SELECT * FROM deployments WHERE namespace = commerce AND since = 24h LIMIT 20'

audit

Read configuration, identity, and infrastructure audit events. Result intent: audit
Aliases: changes
Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`namespace`	string	No	Any string	Kubernetes namespace.
`type`	string	No	Any string	Audit event type or fragment, such as rbac.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

RBAC audit

Read recent RBAC-related changes.

$ annie graph query 'SELECT * FROM audit WHERE type = rbac AND since = 24h LIMIT 20'

nodes

Read node lifecycle and capacity events. Result intent: nodes
Aliases: node
Modifiers: LIMIT, OFFSET

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Node name or fragment.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Node activity

Read recent node events.

$ annie graph query 'SELECT * FROM nodes WHERE since = 6h LIMIT 20'

deploy_impact

Join recent deployments to the failures that followed them. Result intent: deployimpact
Aliases: impact, risky
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Workload name or fragment.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Deployment impact

Rank recent deployment fallout or inspect one workload.

$ annie graph query 'SELECT * FROM deploy_impact WHERE target = checkout AND since = 24h LIMIT 10'

common_cause

Find shared infrastructure or dependencies behind recent failures. Result intent: commoncause
Aliases: commoncause, cause
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`namespace`	string	No	Any string	Kubernetes namespace scope.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Shared failure causes

Intersect recent failures by node, workload, datastore, and external dependency.

$ annie graph query 'SELECT * FROM common_cause WHERE namespace = commerce AND since = 2h LIMIT 10'

blast_radius

Calculate the transitive workloads, pods, and services affected by a resource. Result intent: blast
Aliases: blast
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Starting resource name or identifier.

Resource blast radius

Walk impact outward from one resource.

$ annie graph query 'SELECT * FROM blast_radius WHERE resource = shared-runtime-sa LIMIT 100'

spof

Rank highly shared ConfigMaps, service accounts, or nodes by fan-in. Result intent: spof
Aliases: spofs
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`configmap` (aliases: `configmaps`, `cm`) `serviceaccount` (aliases: `serviceaccounts`, `sa`) `node` (aliases: `nodes`)	Resource kind to rank. Defaults to configmap.
`namespace`	string	No	Any string	Kubernetes namespace scope.

Shared service accounts

Rank service accounts by dependent workloads and pods.

$ annie graph query 'SELECT * FROM spof WHERE kind = serviceaccount LIMIT 10'

orphans

Find unused or dangling Kubernetes resources. Result intent: orphans
Aliases: orphan, unused, dangling
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`configmap` (aliases: `configmaps`, `cm`) `serviceaccount` (aliases: `serviceaccounts`, `sa`) `role` (aliases: `roles`) `replicaset` (aliases: `replicasets`, `rs`)	Resource kind to inspect. Defaults to configmap.
`namespace`	string	No	Any string	Kubernetes namespace scope.

Orphaned roles

Find roles with no observed consumers.

$ annie graph query 'SELECT * FROM orphans WHERE kind = role AND namespace = commerce LIMIT 20'

coverage

Find service, monitor, or metrics coverage gaps. Result intent: coverage
Aliases: blindspots, unmonitored, uncovered
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`service` (aliases: `services`, `workload`, `workloads`) `monitor` (aliases: `monitors`) `metrics` (aliases: `metric`)	Coverage dimension. Defaults to service.
`namespace`	string	No	Any string	Kubernetes namespace scope.

Monitoring gaps

Find unmonitored services in one namespace.

$ annie graph query 'SELECT * FROM coverage WHERE kind = service AND namespace = commerce LIMIT 20'

access

Inspect RBAC reach or rank over-privileged service accounts. Result intent: access
Aliases: rbac, permissions
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	No	Any string	Subject or role name in reach mode; optional namespace scope in privileged mode.
`mode`	enum	No	`reach` `privileged`	Access analysis mode. Defaults to reach.

Subject reach

Reach mode requires resource.

$ annie graph query 'SELECT * FROM access WHERE resource = ci-deployer'

Privileged identities

Privileged mode can optionally scope resource to a namespace.

$ annie graph query 'SELECT * FROM access WHERE mode = privileged LIMIT 10'

exposure

Trace public ingress exposure to or from a resource. Result intent: exposure
Aliases: exposed, attack_surface
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Ingress, service, or workload name.

Public exposure

Trace how a resource is publicly exposed.

$ annie graph query 'SELECT * FROM exposure WHERE resource = checkout'

tenancy

Find workloads co-located with a resource on the same node. Result intent: tenancy
Aliases: colocation, colocated, neighbors
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Workload, pod, or node name.

Noisy neighbors

Inspect resources sharing a node with the target.

$ annie graph query 'SELECT * FROM tenancy WHERE resource = checkout LIMIT 20'

sharedconfig

Find workloads coupled through shared configuration. Result intent: sharedconfig
Aliases: shared_config, configsiblings, config_siblings, configcoupled
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Workload or configuration resource name.

Shared configuration

Find workloads sharing configuration with the target.

$ annie graph query 'SELECT * FROM sharedconfig WHERE resource = checkout LIMIT 20'

path

Find the shortest infrastructure or operational path between two resources. Result intent: path
Aliases: paths
Modifiers: None

Filter	Type	Required	Accepted values	Description
`from`	string	No	Any string	Starting resource name. Required unless from_id is supplied.
`from_exact`	string	No	Any string	Set true for exact-name matching instead of legacy fuzzy resolution.
`from_id`	string	No	Any string	Exact starting hashedID or anyshiftID.
`from_type`	string	No	Any string	Exact starting resource label, such as K8S_DEPLOYMENT.
`from_namespace`	string	No	Any string	Exact starting Kubernetes namespace.
`from_cluster`	string	No	Any string	Exact starting cluster name.
`to`	string	No	Any string	Destination resource name. Required unless to_id is supplied.
`to_exact`	string	No	Any string	Set true for exact-name matching instead of legacy fuzzy resolution.
`to_id`	string	No	Any string	Exact destination hashedID or anyshiftID.
`to_type`	string	No	Any string	Exact destination resource label, such as TEMPO_DATASTORE.
`to_namespace`	string	No	Any string	Exact destination Kubernetes namespace.
`to_cluster`	string	No	Any string	Exact destination cluster name.
`scope`	enum	No	`infrastructure` `operational`	Relationships available to the path traversal. Defaults to infrastructure.

Shortest path

Each endpoint requires a name or id. Typed selectors resolve same-named resources deterministically.

$ annie graph query 'SELECT * FROM path WHERE from = checkout-api AND from_type = K8S_DEPLOYMENT AND to = postgresql AND to_type = TEMPO_DATASTORE AND scope = operational'

cascade

Trace an incident correlation group in propagation order. Result intent: cascade
Aliases: cascades
Modifiers: None

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Resource name or fragment.
`id`	string	No	Any string	Correlation identifier.

Cascade by target

At least one of target or id is required.

$ annie graph query 'SELECT * FROM cascade WHERE target = checkout'

Cascade by correlation id

Trace one exact correlation group.

$ annie graph query 'SELECT * FROM cascade WHERE id = incident-123'

alert_impact

Find monitors and SLOs affected by a resource failure. Result intent: alertimpact
Aliases: alertimpact
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`resource`	string	Yes	Any string	Infrastructure resource name.

Alert impact

Map an infrastructure resource to affected observability objects.

$ annie graph query 'SELECT * FROM alert_impact WHERE resource = checkout'

monitor

Resolve a monitor to the infrastructure it observes. Result intent: monitor
Aliases: monitors
Modifiers: None

Filter	Type	Required	Accepted values	Description
`target`	string	Yes	Any string	Monitor name or fragment.

Monitor infrastructure

Map one monitor to its service, workload, and node.

$ annie graph query 'SELECT * FROM monitor WHERE target = checkout-latency'

datastore

Inspect datastore dependencies or rank widely used datastores. Result intent: datastore
Aliases: datastores
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service or datastore name.
`source`	enum	No	`auto` `datadog` `tempo`	APM dependency source. Defaults to auto.

Rank datastores

Omit target to rank datastore fan-in.

$ annie graph query 'SELECT * FROM datastore LIMIT 10'

Datastore dependencies

Inspect services connected to one datastore or datastores used by one service.

$ annie graph query 'SELECT * FROM datastore WHERE target = checkout-postgres'

flow

Inspect stream producers and consumers or rank busy streams. Result intent: flow
Aliases: flows, stream
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service, topic, queue, or stream name.
`source`	enum	No	`auto` `datadog` `tempo`	APM dependency source. Defaults to auto.

Stream dependencies

Inspect producers and consumers for a stream.

$ annie graph query 'SELECT * FROM flow WHERE target = checkout-events'

external_dep

Inspect external dependencies or rank high-fan-in external hosts. Result intent: externaldep
Aliases: externaldep, external
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service or external dependency name.
`source`	enum	No	`auto` `datadog` `tempo`	APM dependency source. Defaults to auto.

External dependencies

Inspect services depending on one external host.

$ annie graph query 'SELECT * FROM external_dep WHERE target = payments.example.com'

alerts

List currently firing monitors, optionally scoped to a service. Result intent: alerts
Aliases: alert, firing
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service or workload name.

Current alerts

List firing monitors for the project or one target.

$ annie graph query 'SELECT * FROM alerts WHERE target = checkout LIMIT 20'

alert_noise

Rank flapping or stuck monitors. Result intent: alertnoise
Aliases: alertnoise, noise, flapping, noisy
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Monitor or service name.
`kind`	enum	No	`flapping` (aliases: `flap`) `stuck`	Noise pattern.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Flapping alerts

Rank recently flapping monitors.

$ annie graph query 'SELECT * FROM alert_noise WHERE kind = flapping AND since = 1d LIMIT 10'

calls

Inspect service callers and callees or rank call-graph fan-in. Result intent: calls
Aliases: call, callgraph
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Service name.
`source`	enum	No	`auto` `datadog` `tempo`	APM dependency source. Defaults to auto.

Service calls

Inspect callers and callees for one service.

$ annie graph query 'SELECT * FROM calls WHERE target = checkout'

servicetree

Expand a service’s downstream services, datastores, and external dependencies. Result intent: servicetree
Aliases: service_tree, footprint
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Root service name.
`source`	enum	No	`auto` `datadog` `tempo`	APM dependency source. Defaults to auto.

Service tree

Expand the downstream footprint of one service.

$ annie graph query 'SELECT * FROM servicetree WHERE target = checkout LIMIT 50'

alert_cause

Join a firing service or workload to recent Kubernetes changes. Result intent: alertcause
Aliases: alertcause, rootcause
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	Yes	Any string	Service or workload name.
`since`	duration	No	Any string	Relative lookback such as 30m, 2h, 1d, or today.

Alert cause

Find recent infrastructure changes behind a firing target.

$ annie graph query 'SELECT * FROM alert_cause WHERE target = checkout AND since = 2h LIMIT 20'

slo

Inspect one SLO or rank breaching and at-risk SLOs. Result intent: slo
Aliases: slos
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	SLO name or fragment.

SLO health

Inspect one SLO by name.

$ annie graph query 'SELECT * FROM slo WHERE target = 'checkout availability''

alertrules

Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory. Result intent: alertrules
Aliases: alert_rules, grafana, victoria
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`subject`	enum	No	`coverage` `inventory` (aliases: `inventories`) `target` (aliases: `targets`)	Alert-rule view. Defaults to coverage.
`namespace`	string	No	Any string	Namespace scope for coverage or inventory.
`target`	string	No	Any string	Service or workload name. Required when subject is target.

Alert-rule coverage

Find services or workloads without alert rules.

$ annie graph query 'SELECT * FROM alertrules WHERE subject = coverage AND namespace = commerce LIMIT 20'

Rules for a target

Target subject requires target.

$ annie graph query 'SELECT * FROM alertrules WHERE subject = target AND target = checkout'

gitops

Inspect GitOps drift, unmanaged workloads, or resource ownership. Result intent: gitops
Aliases: argocd, drift
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`subject`	enum	No	`drift` (aliases: `drifted`) `unmanaged` `owner` (aliases: `ownership`)	GitOps view. Defaults to drift.
`namespace`	string	No	Any string	Namespace scope for drift or unmanaged views.
`resource`	string	No	Any string	Workload name. Required when subject is owner.

GitOps drift

List drifted applications, optionally scoped to a namespace.

$ annie graph query 'SELECT * FROM gitops WHERE subject = drift AND namespace = commerce LIMIT 20'

Resource owner

Owner subject requires resource.

$ annie graph query 'SELECT * FROM gitops WHERE subject = owner AND resource = checkout'

image

Inspect image usage, workload containers, or container hygiene gaps. Result intent: image
Aliases: images, containers
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Image, service, or workload name.
`workload`	string	No	Any string	Workload whose container resources should be inspected.
`kind`	enum	No	`nomemlimit` (aliases: `no_mem_limit`, `nomemorylimit`) `nocpurequest` (aliases: `no_cpu_request`) `skew` (aliases: `versionskew`, `version_skew`)	Container hygiene scan.
`namespace`	string	No	Any string	Namespace scope for a hygiene scan.

Image usage

Inspect who runs an image or what image a target runs.

$ annie graph query 'SELECT * FROM image WHERE target = checkout'

Container hygiene

Kind selects a hygiene scan and namespace optionally scopes it.

$ annie graph query 'SELECT * FROM image WHERE kind = nomemlimit AND namespace = commerce LIMIT 20'

netpol

Inspect NetworkPolicy coverage, policies, or east-west reach. Result intent: netpol
Aliases: netpols, networkpolicy, segmentation, defaultallow
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`mode`	enum	No	`uncovered` (aliases: `coverage`, `default_allow`, `defaultallow`) `policy` (aliases: `policies`) `segmentation` (aliases: `segment`)	Network policy view. Defaults to uncovered.
`namespace`	string	No	Any string	Namespace scope for uncovered or policy views.
`target`	string	No	Any string	Workload or policy name. Required for segmentation.

NetworkPolicy gaps

Find default-allow namespaces.

$ annie graph query 'SELECT * FROM netpol WHERE mode = uncovered LIMIT 20'

East-west reach

Segmentation mode requires target.

$ annie graph query 'SELECT * FROM netpol WHERE mode = segmentation AND target = checkout'

priority

Inspect scheduling priority gaps, the class ladder, or one target’s priority. Result intent: priority
Aliases: priorityclass, preemption, nopriority
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`kind`	enum	No	`nopriority` (aliases: `unprioritized`, `none`) `ladder` (aliases: `classes`, `class`)	Priority view.
`namespace`	string	No	Any string	Namespace scope for missing-priority checks.
`target`	string	No	Any string	Workload or pod name whose priority should be inspected.

Missing priority classes

Find workloads without a priority class.

$ annie graph query 'SELECT * FROM priority WHERE kind = nopriority AND namespace = commerce LIMIT 20'

Target priority

Inspect the priority class for one workload or pod.

$ annie graph query 'SELECT * FROM priority WHERE target = checkout'

storage

Inspect workload storage and find orphaned or unclaimed volumes. Result intent: storage
Aliases: volumes, pv, pvc, storageclass
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`mode`	enum	No	`footprint` (aliases: `workload`) `orphanpv` (aliases: `orphanpvs`, `orphaned`, `orphan`) `unclaimedpvc` (aliases: `unclaimedpvcs`, `unclaimed`) `byclass` (aliases: `class`, `storageclass`)	Storage view. Defaults to footprint.
`workload`	string	No	Any string	Workload or pod name. Required in footprint mode.
`resource`	string	No	Any string	Alias for workload in footprint mode.
`class`	string	No	Any string	StorageClass filter for orphanpv or byclass mode.
`namespace`	string	No	Any string	Namespace scope for unclaimedpvc mode.

Workload storage

Footprint mode requires workload or resource.

$ annie graph query 'SELECT * FROM storage WHERE workload = checkout'

Unclaimed PVCs

Find unclaimed claims, optionally scoped to a namespace.

$ annie graph query 'SELECT * FROM storage WHERE mode = unclaimedpvc AND namespace = commerce LIMIT 20'

pdb

Find workloads without PodDisruptionBudgets or inspect one workload or PDB. Result intent: pdb
Aliases: pdbs, unprotected, disruption
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`target`	string	No	Any string	Workload or PDB name.
`workload`	string	No	Any string	Workload name.
`pdb`	string	No	Any string	PodDisruptionBudget name.

PDB coverage gaps

Omit filters to list workloads without PDB protection.

$ annie graph query 'SELECT * FROM pdb LIMIT 20'

Target PDB coverage

Inspect one workload or PDB by target, workload, or pdb.

$ annie graph query 'SELECT * FROM pdb WHERE workload = checkout'

scaling

Find workloads without HPAs, list autoscaled workloads, or inspect one target. Result intent: scaling
Aliases: hpa, hpas, autoscaling, autoscalers
Modifiers: LIMIT

Filter	Type	Required	Accepted values	Description
`mode`	enum	No	`nohpa` (aliases: `no_hpa`, `unscaled`, `fixed`, `coverage`) `autoscaled` (aliases: `hpa`, `scaled`) `target`	Autoscaling view. Defaults to nohpa.
`namespace`	string	No	Any string	Namespace scope for nohpa or autoscaled views.
`target`	string	No	Any string	Workload or HPA name. Required in target mode.

Autoscaling gaps

Find workloads without HPAs.

$ annie graph query 'SELECT * FROM scaling WHERE mode = nohpa AND namespace = commerce LIMIT 20'

Target autoscaling

Target mode requires target.

$ annie graph query 'SELECT * FROM scaling WHERE target = checkout'

topology

Build a typed service topology at a selected level. Result intent: topology
Aliases: diagram, c4
Modifiers: None

Filter	Type	Required	Accepted values	Description
`service`	string	Yes	Any string	Service or workload name.
`level`	enum	No	`context` `container` `component` `dynamic`	Topology level. Defaults to container.
`source`	enum	No	`auto` `datadog` `tempo`	APM dependency source. Defaults to auto.

Service topology

Service is required; level selects the topology depth.

$ annie graph query 'SELECT * FROM topology WHERE service = checkout AND level = context'

Use the catalog programmatically

The OpenAPI document exposes this catalog under the root x-anyshift-query-language extension. Tooling can read that versioned object to generate completion, validation, documentation, or custom query builders without duplicating the language by hand. For typed TypeScript helpers, see Graph SDK Capabilities. For raw query execution and error handling, see the Graph SDK guide.

​Discover queries from Annie CLI

​Syntax

​Query targets

​resolve

​Resolve resources

​events

​Recent resource events

​resources

​Resource inventory

​connections

​Direct connections

​hotspots

​Resource hotspots

​incidents

​Incident by target

​Incident by correlation id

​failures

​Recent failures

​deployments

​Recent deployments

​audit

​RBAC audit

​nodes

​Node activity

​deploy_impact

​Deployment impact

​common_cause

​Shared failure causes

​blast_radius

​Resource blast radius

​spof

​Shared service accounts

​orphans

​Orphaned roles

​coverage

​Monitoring gaps

​access

​Subject reach

​Privileged identities

​exposure

​Public exposure

​tenancy

​Noisy neighbors

​sharedconfig

​Shared configuration

​path

​Shortest path

​cascade

​Cascade by target

​Cascade by correlation id

​alert_impact

​Alert impact

​monitor

​Monitor infrastructure

​datastore

​Rank datastores

​Datastore dependencies

​flow

​Stream dependencies

​external_dep

​External dependencies

​alerts

​Current alerts

​alert_noise

​Flapping alerts

​calls

​Service calls

​servicetree

​Service tree

​alert_cause

​Alert cause

​slo

​SLO health

​alertrules

​Alert-rule coverage

​Rules for a target

​gitops

​GitOps drift

​Resource owner

​image