> ## Documentation Index > Fetch the complete documentation index at: https://docs.anyshift.io/llms.txt > Use this file to discover all available pages before exploring further. # Graph Query Language > Complete reference for deterministic Anyshift graph queries, including every target, filter, accepted value, alias, and query form. The Anyshift Graph Query Language gives you deterministic, read-only access to infrastructure graph data. Use it when you know the operation you need and want the same query to produce the same typed result in a terminal, script, CI job, or application. This page is generated from the versioned query catalog published in the [Graph API OpenAPI contract](https://graph.anyshift.io/v1/openapi.json). The same catalog is embedded in Annie CLI and published with the [Graph SDK](https://github.com/anyshift-io/anyshift-graph-sdk/blob/main/QUERY_LANGUAGE.md). ## Discover queries from Annie CLI You do not need to memorize table or filter names. Annie CLI can inspect its embedded catalog without authentication, a selected project, or network access: ```console theme={null} $ annie graph query --list $ annie graph query --describe spof ``` The second command explains that `spof` accepts a `kind` filter, lists `serviceaccount` as an accepted value, and prints a copy-pasteable query. See the [Annie CLI guide](/pages/product/integration/cli#deterministic-infrastructure-graph-queries) for authentication, project selection, and output modes. ## Syntax ```sql theme={null} SELECT <*|count(*)> FROM [WHERE k = v [AND ...]] [LIMIT n] [OFFSET n] ``` Selectors: `*`, `count(*)`. Accepted selector aliases: `count(1)`. Values may be bare words or single- or double-quoted strings. Filters use equality and can be combined with `AND`. A target only accepts the filters and enum values documented below. `LIMIT` and `OFFSET` are listed per target because not every result supports both modifiers. ## Query targets | Target | Purpose | Filters | Modifiers | | --------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | | [`resolve`](#resolve) | Resolve a resource name or fragment to ranked current graph resources. | `term` | `LIMIT` | | [`events`](#events) | Read the infrastructure change-event timeline. | `type`, `target`, `namespace`, `noise`, `since` | `LIMIT`, `OFFSET` | | [`resources`](#resources) | Count and sample current resources of one graph resource type. | `type` | `LIMIT`, `OFFSET` | | [`connections`](#connections) | Inspect direct upstream and downstream relationships for a resource. | `resource` | `LIMIT` | | [`hotspots`](#hotspots) | Rank noisy resources, namespaces, alert rules, or alerting workloads. | `type`, `by`, `namespace`, `noise`, `since` | `LIMIT` | | [`incidents`](#incidents) | Reconstruct a correlated incident around a target or correlation identifier. | `target`, `id`, `type` | None | | [`failures`](#failures) | Read recent failure-class infrastructure events. | `target`, `namespace`, `since` | `LIMIT`, `OFFSET` | | [`deployments`](#deployments) | Read recent workload deployments and image changes. | `target`, `namespace`, `since` | `LIMIT`, `OFFSET` | | [`audit`](#audit) | Read configuration, identity, and infrastructure audit events. | `target`, `namespace`, `type`, `since` | `LIMIT`, `OFFSET` | | [`nodes`](#nodes) | Read node lifecycle and capacity events. | `target`, `since` | `LIMIT`, `OFFSET` | | [`deploy_impact`](#deploy-impact) | Join recent deployments to the failures that followed them. | `target`, `since` | `LIMIT` | | [`common_cause`](#common-cause) | Find shared infrastructure or dependencies behind recent failures. | `namespace`, `since` | `LIMIT` | | [`blast_radius`](#blast-radius) | Calculate the transitive workloads, pods, and services affected by a resource. | `resource` | `LIMIT` | | [`spof`](#spof) | Rank highly shared ConfigMaps, service accounts, or nodes by fan-in. | `kind`, `namespace` | `LIMIT` | | [`orphans`](#orphans) | Find unused or dangling Kubernetes resources. | `kind`, `namespace` | `LIMIT` | | [`coverage`](#coverage) | Find service, monitor, or metrics coverage gaps. | `kind`, `namespace` | `LIMIT` | | [`access`](#access) | Inspect RBAC reach or rank over-privileged service accounts. | `resource`, `mode` | `LIMIT` | | [`exposure`](#exposure) | Trace public ingress exposure to or from a resource. | `resource` | `LIMIT` | | [`tenancy`](#tenancy) | Find workloads co-located with a resource on the same node. | `resource` | `LIMIT` | | [`sharedconfig`](#sharedconfig) | Find workloads coupled through shared configuration. | `resource` | `LIMIT` | | [`path`](#path) | Find the shortest infrastructure or operational path between two resources. | `from`, `from_exact`, `from_id`, `from_type`, `from_namespace`, `from_cluster`, `to`, `to_exact`, `to_id`, `to_type`, `to_namespace`, `to_cluster`, `scope` | None | | [`cascade`](#cascade) | Trace an incident correlation group in propagation order. | `target`, `id` | None | | [`alert_impact`](#alert-impact) | Find monitors and SLOs affected by a resource failure. | `resource` | `LIMIT` | | [`monitor`](#monitor) | Resolve a monitor to the infrastructure it observes. | `target` | None | | [`datastore`](#datastore) | Inspect datastore dependencies or rank widely used datastores. | `target`, `source` | `LIMIT` | | [`flow`](#flow) | Inspect stream producers and consumers or rank busy streams. | `target`, `source` | `LIMIT` | | [`external_dep`](#external-dep) | Inspect external dependencies or rank high-fan-in external hosts. | `target`, `source` | `LIMIT` | | [`alerts`](#alerts) | List currently firing monitors, optionally scoped to a service. | `target` | `LIMIT` | | [`alert_noise`](#alert-noise) | Rank flapping or stuck monitors. | `target`, `kind`, `since` | `LIMIT` | | [`calls`](#calls) | Inspect service callers and callees or rank call-graph fan-in. | `target`, `source` | `LIMIT` | | [`servicetree`](#servicetree) | Expand a service's downstream services, datastores, and external dependencies. | `target`, `source` | `LIMIT` | | [`alert_cause`](#alert-cause) | Join a firing service or workload to recent Kubernetes changes. | `target`, `since` | `LIMIT` | | [`slo`](#slo) | Inspect one SLO or rank breaching and at-risk SLOs. | `target` | `LIMIT` | | [`alertrules`](#alertrules) | Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory. | `subject`, `namespace`, `target` | `LIMIT` | | [`gitops`](#gitops) | Inspect GitOps drift, unmanaged workloads, or resource ownership. | `subject`, `namespace`, `resource` | `LIMIT` | | [`image`](#image) | Inspect image usage, workload containers, or container hygiene gaps. | `target`, `workload`, `kind`, `namespace` | `LIMIT` | | [`netpol`](#netpol) | Inspect NetworkPolicy coverage, policies, or east-west reach. | `mode`, `namespace`, `target` | `LIMIT` | | [`priority`](#priority) | Inspect scheduling priority gaps, the class ladder, or one target's priority. | `kind`, `namespace`, `target` | `LIMIT` | | [`storage`](#storage) | Inspect workload storage and find orphaned or unclaimed volumes. | `mode`, `workload`, `resource`, `class`, `namespace` | `LIMIT` | | [`pdb`](#pdb) | Find workloads without PodDisruptionBudgets or inspect one workload or PDB. | `target`, `workload`, `pdb` | `LIMIT` | | [`scaling`](#scaling) | Find workloads without HPAs, list autoscaled workloads, or inspect one target. | `mode`, `namespace`, `target` | `LIMIT` | | [`topology`](#topology) | Build a typed service topology at a selected level. | `service`, `level`, `source` | None | ## resolve Resolve a resource name or fragment to ranked current graph resources. Result intent: `resolve`\ Aliases: `search`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ------ | ------ | -------- | --------------- | ------------------------------------- | | `term` | string | Yes | Any string | Resource name or fragment to resolve. | ### Resolve resources Return ranked candidates for a resource name or fragment. ```console theme={null} $ annie graph query 'SELECT * FROM resolve WHERE term = checkout LIMIT 10' ``` ## events Read the infrastructure change-event timeline. Result intent: `events`\ Aliases: `event`\ Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | ------------------------------------------------------------------------------ | ---------------------------------------------------- | | `type` | string | No | Any string | Event type or type fragment, such as oom or scaling. | | `target` | string | No | Any string | Resource name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `noise` | enum | No | `signal` (aliases: `false`, `exclude`)
`all` (aliases: `true`, `include`) | Whether to include noisy events. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Recent resource events Read recent events for a resource inside a time window. ```console theme={null} $ annie graph query 'SELECT * FROM events WHERE target = checkout AND since = 2h LIMIT 20' ``` ## resources Count and sample current resources of one graph resource type. Result intent: `inventory`\ Aliases: `resource`, `inventory`\ Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ------ | ------ | -------- | --------------- | --------------------------------------------------- | | `type` | string | Yes | Any string | Graph resource type, such as service or deployment. | ### Resource inventory Return the inventory for one resource type. ```console theme={null} $ annie graph query 'SELECT * FROM resources WHERE type = deployment LIMIT 50' ``` ## connections Inspect direct upstream and downstream relationships for a resource. Result intent: `connections`\ Aliases: `connection`, `deps`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------- | | `resource` | string | Yes | Any string | Resource name or identifier. | ### Direct connections Return the resource and its direct graph neighbors. ```console theme={null} $ annie graph query 'SELECT * FROM connections WHERE resource = checkout LIMIT 50' ``` ## hotspots Rank noisy resources, namespaces, alert rules, or alerting workloads. Result intent: `hotspots`\ Aliases: `hotspot`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | `type` | string | No | Any string | Event type or type fragment. | | `by` | enum | No | `resource` (aliases: `resources`)
`namespace` (aliases: `namespaces`, `ns`)
`alertrule` (aliases: `alertrules`, `rule`)
`alertworkload` (aliases: `alertworkloads`, `workload`) | Ranking dimension. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | | `noise` | enum | No | `signal` (aliases: `false`, `exclude`)
`all` (aliases: `true`, `include`) | Whether to include noisy events. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Resource hotspots Rank resources by recent event activity. ```console theme={null} $ annie graph query 'SELECT * FROM hotspots WHERE by = resource AND since = 24h LIMIT 10' ``` ## incidents Reconstruct a correlated incident around a target or correlation identifier. Result intent: `incident`\ Aliases: `incident`\ Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | --------------------------- | | `target` | string | No | Any string | Resource name or fragment. | | `id` | string | No | Any string | Correlation identifier. | | `type` | string | No | Any string | Optional event type filter. | ### Incident by target At least one of target or id is required. ```console theme={null} $ annie graph query 'SELECT * FROM incidents WHERE target = checkout' ``` ### Incident by correlation id Load one exact correlation group. ```console theme={null} $ annie graph query 'SELECT * FROM incidents WHERE id = incident-123' ``` ## failures Read recent failure-class infrastructure events. Result intent: `failures`\ Aliases: None\ Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Resource name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Recent failures Read failures for a target, namespace, or the whole project. ```console theme={null} $ annie graph query 'SELECT * FROM failures WHERE namespace = commerce AND since = 2h LIMIT 20' ``` ## deployments Read recent workload deployments and image changes. Result intent: `deployments`\ Aliases: `deployment`, `rollouts`\ Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Workload name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Recent deployments Read deployments for a target, namespace, or the whole project. ```console theme={null} $ annie graph query 'SELECT * FROM deployments WHERE namespace = commerce AND since = 24h LIMIT 20' ``` ## audit Read configuration, identity, and infrastructure audit events. Result intent: `audit`\ Aliases: `changes`\ Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Resource name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `type` | string | No | Any string | Audit event type or fragment, such as rbac. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### RBAC audit Read recent RBAC-related changes. ```console theme={null} $ annie graph query 'SELECT * FROM audit WHERE type = rbac AND since = 24h LIMIT 20' ``` ## nodes Read node lifecycle and capacity events. Result intent: `nodes`\ Aliases: `node`\ Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Node name or fragment. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Node activity Read recent node events. ```console theme={null} $ annie graph query 'SELECT * FROM nodes WHERE since = 6h LIMIT 20' ``` ## deploy\_impact Join recent deployments to the failures that followed them. Result intent: `deployimpact`\ Aliases: `impact`, `risky`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Workload name or fragment. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Deployment impact Rank recent deployment fallout or inspect one workload. ```console theme={null} $ annie graph query 'SELECT * FROM deploy_impact WHERE target = checkout AND since = 24h LIMIT 10' ``` ## common\_cause Find shared infrastructure or dependencies behind recent failures. Result intent: `commoncause`\ Aliases: `commoncause`, `cause`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `namespace` | string | No | Any string | Kubernetes namespace scope. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Shared failure causes Intersect recent failures by node, workload, datastore, and external dependency. ```console theme={null} $ annie graph query 'SELECT * FROM common_cause WHERE namespace = commerce AND since = 2h LIMIT 10' ``` ## blast\_radius Calculate the transitive workloads, pods, and services affected by a resource. Result intent: `blast`\ Aliases: `blast`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ------------------------------------- | | `resource` | string | Yes | Any string | Starting resource name or identifier. | ### Resource blast radius Walk impact outward from one resource. ```console theme={null} $ annie graph query 'SELECT * FROM blast_radius WHERE resource = shared-runtime-sa LIMIT 100' ``` ## spof Rank highly shared ConfigMaps, service accounts, or nodes by fan-in. Result intent: `spof`\ Aliases: `spofs`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- | | `kind` | enum | No | `configmap` (aliases: `configmaps`, `cm`)
`serviceaccount` (aliases: `serviceaccounts`, `sa`)
`node` (aliases: `nodes`) | Resource kind to rank. Defaults to configmap. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | ### Shared service accounts Rank service accounts by dependent workloads and pods. ```console theme={null} $ annie graph query 'SELECT * FROM spof WHERE kind = serviceaccount LIMIT 10' ``` ## orphans Find unused or dangling Kubernetes resources. Result intent: `orphans`\ Aliases: `orphan`, `unused`, `dangling`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | `kind` | enum | No | `configmap` (aliases: `configmaps`, `cm`)
`serviceaccount` (aliases: `serviceaccounts`, `sa`)
`role` (aliases: `roles`)
`replicaset` (aliases: `replicasets`, `rs`) | Resource kind to inspect. Defaults to configmap. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | ### Orphaned roles Find roles with no observed consumers. ```console theme={null} $ annie graph query 'SELECT * FROM orphans WHERE kind = role AND namespace = commerce LIMIT 20' ``` ## coverage Find service, monitor, or metrics coverage gaps. Result intent: `coverage`\ Aliases: `blindspots`, `unmonitored`, `uncovered`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | | `kind` | enum | No | `service` (aliases: `services`, `workload`, `workloads`)
`monitor` (aliases: `monitors`)
`metrics` (aliases: `metric`) | Coverage dimension. Defaults to service. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | ### Monitoring gaps Find unmonitored services in one namespace. ```console theme={null} $ annie graph query 'SELECT * FROM coverage WHERE kind = service AND namespace = commerce LIMIT 20' ``` ## access Inspect RBAC reach or rank over-privileged service accounts. Result intent: `access`\ Aliases: `rbac`, `permissions`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | ------------------------- | -------------------------------------------------------------------------------- | | `resource` | string | No | Any string | Subject or role name in reach mode; optional namespace scope in privileged mode. | | `mode` | enum | No | `reach`
`privileged` | Access analysis mode. Defaults to reach. | ### Subject reach Reach mode requires resource. ```console theme={null} $ annie graph query 'SELECT * FROM access WHERE resource = ci-deployer' ``` ### Privileged identities Privileged mode can optionally scope resource to a namespace. ```console theme={null} $ annie graph query 'SELECT * FROM access WHERE mode = privileged LIMIT 10' ``` ## exposure Trace public ingress exposure to or from a resource. Result intent: `exposure`\ Aliases: `exposed`, `attack_surface`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ----------------------------------- | | `resource` | string | Yes | Any string | Ingress, service, or workload name. | ### Public exposure Trace how a resource is publicly exposed. ```console theme={null} $ annie graph query 'SELECT * FROM exposure WHERE resource = checkout' ``` ## tenancy Find workloads co-located with a resource on the same node. Result intent: `tenancy`\ Aliases: `colocation`, `colocated`, `neighbors`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------- | | `resource` | string | Yes | Any string | Workload, pod, or node name. | ### Noisy neighbors Inspect resources sharing a node with the target. ```console theme={null} $ annie graph query 'SELECT * FROM tenancy WHERE resource = checkout LIMIT 20' ``` ## sharedconfig Find workloads coupled through shared configuration. Result intent: `sharedconfig`\ Aliases: `shared_config`, `configsiblings`, `config_siblings`, `configcoupled`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------------------- | | `resource` | string | Yes | Any string | Workload or configuration resource name. | ### Shared configuration Find workloads sharing configuration with the target. ```console theme={null} $ annie graph query 'SELECT * FROM sharedconfig WHERE resource = checkout LIMIT 20' ``` ## path Find the shortest infrastructure or operational path between two resources. Result intent: `path`\ Aliases: `paths`\ Modifiers: None | Filter | Type | Required | Accepted values | Description | | ---------------- | ------ | -------- | ----------------------------------- | -------------------------------------------------------------------------- | | `from` | string | No | Any string | Starting resource name. Required unless from\_id is supplied. | | `from_exact` | string | No | Any string | Set true for exact-name matching instead of legacy fuzzy resolution. | | `from_id` | string | No | Any string | Exact starting hashedID or anyshiftID. | | `from_type` | string | No | Any string | Exact starting resource label, such as K8S\_DEPLOYMENT. | | `from_namespace` | string | No | Any string | Exact starting Kubernetes namespace. | | `from_cluster` | string | No | Any string | Exact starting cluster name. | | `to` | string | No | Any string | Destination resource name. Required unless to\_id is supplied. | | `to_exact` | string | No | Any string | Set true for exact-name matching instead of legacy fuzzy resolution. | | `to_id` | string | No | Any string | Exact destination hashedID or anyshiftID. | | `to_type` | string | No | Any string | Exact destination resource label, such as TEMPO\_DATASTORE. | | `to_namespace` | string | No | Any string | Exact destination Kubernetes namespace. | | `to_cluster` | string | No | Any string | Exact destination cluster name. | | `scope` | enum | No | `infrastructure`
`operational` | Relationships available to the path traversal. Defaults to infrastructure. | ### Shortest path Each endpoint requires a name or id. Typed selectors resolve same-named resources deterministically. ```console theme={null} $ annie graph query 'SELECT * FROM path WHERE from = checkout-api AND from_type = K8S_DEPLOYMENT AND to = postgresql AND to_type = TEMPO_DATASTORE AND scope = operational' ``` ## cascade Trace an incident correlation group in propagation order. Result intent: `cascade`\ Aliases: `cascades`\ Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | -------------------------- | | `target` | string | No | Any string | Resource name or fragment. | | `id` | string | No | Any string | Correlation identifier. | ### Cascade by target At least one of target or id is required. ```console theme={null} $ annie graph query 'SELECT * FROM cascade WHERE target = checkout' ``` ### Cascade by correlation id Trace one exact correlation group. ```console theme={null} $ annie graph query 'SELECT * FROM cascade WHERE id = incident-123' ``` ## alert\_impact Find monitors and SLOs affected by a resource failure. Result intent: `alertimpact`\ Aliases: `alertimpact`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ----------------------------- | | `resource` | string | Yes | Any string | Infrastructure resource name. | ### Alert impact Map an infrastructure resource to affected observability objects. ```console theme={null} $ annie graph query 'SELECT * FROM alert_impact WHERE resource = checkout' ``` ## monitor Resolve a monitor to the infrastructure it observes. Result intent: `monitor`\ Aliases: `monitors`\ Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | ------------------------- | | `target` | string | Yes | Any string | Monitor name or fragment. | ### Monitor infrastructure Map one monitor to its service, workload, and node. ```console theme={null} $ annie graph query 'SELECT * FROM monitor WHERE target = checkout-latency' ``` ## datastore Inspect datastore dependencies or rank widely used datastores. Result intent: `datastore`\ Aliases: `datastores`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | ---------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service or datastore name. | | `source` | enum | No | `auto`
`datadog`
`tempo` | APM dependency source. Defaults to auto. | ### Rank datastores Omit target to rank datastore fan-in. ```console theme={null} $ annie graph query 'SELECT * FROM datastore LIMIT 10' ``` ### Datastore dependencies Inspect services connected to one datastore or datastores used by one service. ```console theme={null} $ annie graph query 'SELECT * FROM datastore WHERE target = checkout-postgres' ``` ## flow Inspect stream producers and consumers or rank busy streams. Result intent: `flow`\ Aliases: `flows`, `stream`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | ---------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service, topic, queue, or stream name. | | `source` | enum | No | `auto`
`datadog`
`tempo` | APM dependency source. Defaults to auto. | ### Stream dependencies Inspect producers and consumers for a stream. ```console theme={null} $ annie graph query 'SELECT * FROM flow WHERE target = checkout-events' ``` ## external\_dep Inspect external dependencies or rank high-fan-in external hosts. Result intent: `externaldep`\ Aliases: `externaldep`, `external`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | ---------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service or external dependency name. | | `source` | enum | No | `auto`
`datadog`
`tempo` | APM dependency source. Defaults to auto. | ### External dependencies Inspect services depending on one external host. ```console theme={null} $ annie graph query 'SELECT * FROM external_dep WHERE target = payments.example.com' ``` ## alerts List currently firing monitors, optionally scoped to a service. Result intent: `alerts`\ Aliases: `alert`, `firing`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | ------------------------- | | `target` | string | No | Any string | Service or workload name. | ### Current alerts List firing monitors for the project or one target. ```console theme={null} $ annie graph query 'SELECT * FROM alerts WHERE target = checkout LIMIT 20' ``` ## alert\_noise Rank flapping or stuck monitors. Result intent: `alertnoise`\ Aliases: `alertnoise`, `noise`, `flapping`, `noisy`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | ----------------------------------------- | ------------------------------------------------ | | `target` | string | No | Any string | Monitor or service name. | | `kind` | enum | No | `flapping` (aliases: `flap`)
`stuck` | Noise pattern. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Flapping alerts Rank recently flapping monitors. ```console theme={null} $ annie graph query 'SELECT * FROM alert_noise WHERE kind = flapping AND since = 1d LIMIT 10' ``` ## calls Inspect service callers and callees or rank call-graph fan-in. Result intent: `calls`\ Aliases: `call`, `callgraph`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | ---------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service name. | | `source` | enum | No | `auto`
`datadog`
`tempo` | APM dependency source. Defaults to auto. | ### Service calls Inspect callers and callees for one service. ```console theme={null} $ annie graph query 'SELECT * FROM calls WHERE target = checkout' ``` ## servicetree Expand a service's downstream services, datastores, and external dependencies. Result intent: `servicetree`\ Aliases: `service_tree`, `footprint`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | ---------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Root service name. | | `source` | enum | No | `auto`
`datadog`
`tempo` | APM dependency source. Defaults to auto. | ### Service tree Expand the downstream footprint of one service. ```console theme={null} $ annie graph query 'SELECT * FROM servicetree WHERE target = checkout LIMIT 50' ``` ## alert\_cause Join a firing service or workload to recent Kubernetes changes. Result intent: `alertcause`\ Aliases: `alertcause`, `rootcause`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | Yes | Any string | Service or workload name. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Alert cause Find recent infrastructure changes behind a firing target. ```console theme={null} $ annie graph query 'SELECT * FROM alert_cause WHERE target = checkout AND since = 2h LIMIT 20' ``` ## slo Inspect one SLO or rank breaching and at-risk SLOs. Result intent: `slo`\ Aliases: `slos`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | --------------------- | | `target` | string | No | Any string | SLO name or fragment. | ### SLO health Inspect one SLO by name. ```console theme={null} $ annie graph query 'SELECT * FROM slo WHERE target = 'checkout availability'' ``` ## alertrules Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory. Result intent: `alertrules`\ Aliases: `alert_rules`, `grafana`, `victoria`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | `subject` | enum | No | `coverage`
`inventory` (aliases: `inventories`)
`target` (aliases: `targets`) | Alert-rule view. Defaults to coverage. | | `namespace` | string | No | Any string | Namespace scope for coverage or inventory. | | `target` | string | No | Any string | Service or workload name. Required when subject is target. | ### Alert-rule coverage Find services or workloads without alert rules. ```console theme={null} $ annie graph query 'SELECT * FROM alertrules WHERE subject = coverage AND namespace = commerce LIMIT 20' ``` ### Rules for a target Target subject requires target. ```console theme={null} $ annie graph query 'SELECT * FROM alertrules WHERE subject = target AND target = checkout' ``` ## gitops Inspect GitOps drift, unmanaged workloads, or resource ownership. Result intent: `gitops`\ Aliases: `argocd`, `drift`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | | `subject` | enum | No | `drift` (aliases: `drifted`)
`unmanaged`
`owner` (aliases: `ownership`) | GitOps view. Defaults to drift. | | `namespace` | string | No | Any string | Namespace scope for drift or unmanaged views. | | `resource` | string | No | Any string | Workload name. Required when subject is owner. | ### GitOps drift List drifted applications, optionally scoped to a namespace. ```console theme={null} $ annie graph query 'SELECT * FROM gitops WHERE subject = drift AND namespace = commerce LIMIT 20' ``` ### Resource owner Owner subject requires resource. ```console theme={null} $ annie graph query 'SELECT * FROM gitops WHERE subject = owner AND resource = checkout' ``` ## image Inspect image usage, workload containers, or container hygiene gaps. Result intent: `image`\ Aliases: `images`, `containers`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------- | | `target` | string | No | Any string | Image, service, or workload name. | | `workload` | string | No | Any string | Workload whose container resources should be inspected. | | `kind` | enum | No | `nomemlimit` (aliases: `no_mem_limit`, `nomemorylimit`)
`nocpurequest` (aliases: `no_cpu_request`)
`skew` (aliases: `versionskew`, `version_skew`) | Container hygiene scan. | | `namespace` | string | No | Any string | Namespace scope for a hygiene scan. | ### Image usage Inspect who runs an image or what image a target runs. ```console theme={null} $ annie graph query 'SELECT * FROM image WHERE target = checkout' ``` ### Container hygiene Kind selects a hygiene scan and namespace optionally scopes it. ```console theme={null} $ annie graph query 'SELECT * FROM image WHERE kind = nomemlimit AND namespace = commerce LIMIT 20' ``` ## netpol Inspect NetworkPolicy coverage, policies, or east-west reach. Result intent: `netpol`\ Aliases: `netpols`, `networkpolicy`, `segmentation`, `defaultallow`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `mode` | enum | No | `uncovered` (aliases: `coverage`, `default_allow`, `defaultallow`)
`policy` (aliases: `policies`)
`segmentation` (aliases: `segment`) | Network policy view. Defaults to uncovered. | | `namespace` | string | No | Any string | Namespace scope for uncovered or policy views. | | `target` | string | No | Any string | Workload or policy name. Required for segmentation. | ### NetworkPolicy gaps Find default-allow namespaces. ```console theme={null} $ annie graph query 'SELECT * FROM netpol WHERE mode = uncovered LIMIT 20' ``` ### East-west reach Segmentation mode requires target. ```console theme={null} $ annie graph query 'SELECT * FROM netpol WHERE mode = segmentation AND target = checkout' ``` ## priority Inspect scheduling priority gaps, the class ladder, or one target's priority. Result intent: `priority`\ Aliases: `priorityclass`, `preemption`, `nopriority`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------- | | `kind` | enum | No | `nopriority` (aliases: `unprioritized`, `none`)
`ladder` (aliases: `classes`, `class`) | Priority view. | | `namespace` | string | No | Any string | Namespace scope for missing-priority checks. | | `target` | string | No | Any string | Workload or pod name whose priority should be inspected. | ### Missing priority classes Find workloads without a priority class. ```console theme={null} $ annie graph query 'SELECT * FROM priority WHERE kind = nopriority AND namespace = commerce LIMIT 20' ``` ### Target priority Inspect the priority class for one workload or pod. ```console theme={null} $ annie graph query 'SELECT * FROM priority WHERE target = checkout' ``` ## storage Inspect workload storage and find orphaned or unclaimed volumes. Result intent: `storage`\ Aliases: `volumes`, `pv`, `pvc`, `storageclass`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------- | | `mode` | enum | No | `footprint` (aliases: `workload`)
`orphanpv` (aliases: `orphanpvs`, `orphaned`, `orphan`)
`unclaimedpvc` (aliases: `unclaimedpvcs`, `unclaimed`)
`byclass` (aliases: `class`, `storageclass`) | Storage view. Defaults to footprint. | | `workload` | string | No | Any string | Workload or pod name. Required in footprint mode. | | `resource` | string | No | Any string | Alias for workload in footprint mode. | | `class` | string | No | Any string | StorageClass filter for orphanpv or byclass mode. | | `namespace` | string | No | Any string | Namespace scope for unclaimedpvc mode. | ### Workload storage Footprint mode requires workload or resource. ```console theme={null} $ annie graph query 'SELECT * FROM storage WHERE workload = checkout' ``` ### Unclaimed PVCs Find unclaimed claims, optionally scoped to a namespace. ```console theme={null} $ annie graph query 'SELECT * FROM storage WHERE mode = unclaimedpvc AND namespace = commerce LIMIT 20' ``` ## pdb Find workloads without PodDisruptionBudgets or inspect one workload or PDB. Result intent: `pdb`\ Aliases: `pdbs`, `unprotected`, `disruption`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ------------------------- | | `target` | string | No | Any string | Workload or PDB name. | | `workload` | string | No | Any string | Workload name. | | `pdb` | string | No | Any string | PodDisruptionBudget name. | ### PDB coverage gaps Omit filters to list workloads without PDB protection. ```console theme={null} $ annie graph query 'SELECT * FROM pdb LIMIT 20' ``` ### Target PDB coverage Inspect one workload or PDB by target, workload, or pdb. ```console theme={null} $ annie graph query 'SELECT * FROM pdb WHERE workload = checkout' ``` ## scaling Find workloads without HPAs, list autoscaled workloads, or inspect one target. Result intent: `scaling`\ Aliases: `hpa`, `hpas`, `autoscaling`, `autoscalers`\ Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ----------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | | `mode` | enum | No | `nohpa` (aliases: `no_hpa`, `unscaled`, `fixed`, `coverage`)
`autoscaled` (aliases: `hpa`, `scaled`)
`target` | Autoscaling view. Defaults to nohpa. | | `namespace` | string | No | Any string | Namespace scope for nohpa or autoscaled views. | | `target` | string | No | Any string | Workload or HPA name. Required in target mode. | ### Autoscaling gaps Find workloads without HPAs. ```console theme={null} $ annie graph query 'SELECT * FROM scaling WHERE mode = nohpa AND namespace = commerce LIMIT 20' ``` ### Target autoscaling Target mode requires target. ```console theme={null} $ annie graph query 'SELECT * FROM scaling WHERE target = checkout' ``` ## topology Build a typed service topology at a selected level. Result intent: `topology`\ Aliases: `diagram`, `c4`\ Modifiers: None | Filter | Type | Required | Accepted values | Description | | --------- | ------ | -------- | ---------------------------------------------------------- | ---------------------------------------- | | `service` | string | Yes | Any string | Service or workload name. | | `level` | enum | No | `context`
`container`
`component`
`dynamic` | Topology level. Defaults to container. | | `source` | enum | No | `auto`
`datadog`
`tempo` | APM dependency source. Defaults to auto. | ### Service topology Service is required; level selects the topology depth. ```console theme={null} $ annie graph query 'SELECT * FROM topology WHERE service = checkout AND level = context' ``` ## Use the catalog programmatically The OpenAPI document exposes this catalog under the root `x-anyshift-query-language` extension. Tooling can read that versioned object to generate completion, validation, documentation, or custom query builders without duplicating the language by hand. For typed TypeScript helpers, see [Graph SDK Capabilities](/pages/product/integration/sdk_capabilities). For raw query execution and error handling, see the [Graph SDK guide](/pages/product/integration/sdk#raw-sql).