> ## Documentation Index > Fetch the complete documentation index at: https://docs.anyshift.io/llms.txt > Use this file to discover all available pages before exploring further. # Graph Query Language > Complete reference for deterministic Anyshift graph queries, including every target, filter, accepted value, alias, and query form. The Anyshift Graph Query Language gives you deterministic, read-only access to infrastructure graph data. Use it when you know the operation you need and want the same query to produce the same typed result in a terminal, script, CI job, or application. This page is generated from the versioned query catalog published in the [Graph API OpenAPI contract](https://graph.anyshift.io/v1/openapi.json). The same catalog is embedded in Annie CLI and published with the [Graph SDK](https://github.com/anyshift-io/anyshift-graph-sdk/blob/main/QUERY_LANGUAGE.md). ## Discover queries from Annie CLI You do not need to memorize table or filter names. Annie CLI can inspect its embedded catalog without authentication, a selected project, or network access: ```console theme={null} $ annie graph query --list $ annie graph query --describe spof ``` The second command explains that `spof` accepts a `kind` filter, lists `serviceaccount` as an accepted value, and prints a copy-pasteable query. See the [Annie CLI guide](/pages/product/integration/cli#deterministic-infrastructure-graph-queries) for authentication, project selection, and output modes. ## Syntax ```sql theme={null} SELECT <*|count(*)> FROM [WHERE k = v [AND ...]] [LIMIT n] [OFFSET n] ``` Selectors: `*`, `count(*)`. Accepted selector aliases: `count(1)`. Values may be bare words or single- or double-quoted strings. Filters use equality and can be combined with `AND`. A target only accepts the filters and enum values documented below. `LIMIT` and `OFFSET` are listed per target because not every result supports both modifiers. ## Query targets | Target | Purpose | Filters | Modifiers | | ------------------------------------------- | ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | | [`resolve`](#resolve) | Resolve a resource name or fragment to ranked current graph resources. | `term` | `LIMIT` | | [`events`](#events) | Read the infrastructure change-event timeline. | `type`, `target`, `namespace`, `noise`, `since` | `LIMIT`, `OFFSET` | | [`cloud_events`](#cloud-events) | Read evidence-backed AWS, Azure, and GCP change events without parsing summaries. | `provider`, `scope`, `region`, `category`, `type`, `resource`, `actor`, `correlation`, `operation`, `stats`, `noise`, `diff`, `since`, `cursor` | `LIMIT` | | [`cloud_resources`](#cloud-resources) | Inspect current or recently deleted AWS, Azure, and GCP resources with freshness and provenance. | `provider`, `scope`, `region`, `type`, `resource`, `lifecycle`, `provenance`, `freshness`, `max_age`, `cursor` | `LIMIT` | | [`delivery_events`](#delivery-events) | Read commit, CI, release, and deployment evidence from the delivery graph. | `stage`, `type`, `resource`, `actor`, `source`, `since`, `cursor` | `LIMIT` | | [`provenance`](#provenance) | Trace a resource to stored release, commit, and actor evidence. | `resource` | `LIMIT` | | [`ownership`](#ownership) | Resolve observed GitHub user or team code ownership and contact identities. | `resource` | `LIMIT` | | [`graph_coverage`](#graph-coverage) | Inspect current node, relationship, bridge, and event evidence by graph source. | `source` | None | | [`resources`](#resources) | Count and sample current resources of one graph resource type. | `type` | `LIMIT`, `OFFSET` | | [`operational_impact`](#operational-impact) | Find potential operational impact through reviewed directional graph relationships. | `resource`, `depth` | `LIMIT`, `OFFSET` | | [`connections`](#connections) | Inspect direct upstream and downstream relationships for a resource. | `resource` | `LIMIT` | | [`hotspots`](#hotspots) | Rank noisy resources, namespaces, alert rules, or alerting workloads. | `type`, `by`, `namespace`, `noise`, `since` | `LIMIT` | | [`incidents`](#incidents) | Reconstruct a correlated incident around a target or correlation identifier. | `target`, `id`, `type`, `since` | None | | [`failures`](#failures) | Read recent failure-class infrastructure events. | `target`, `namespace`, `since` | `LIMIT`, `OFFSET` | | [`deployments`](#deployments) | Read recent workload deployments and image changes. | `target`, `namespace`, `since` | `LIMIT`, `OFFSET` | | [`audit`](#audit) | Read configuration, identity, and infrastructure audit events. | `target`, `namespace`, `type`, `since` | `LIMIT`, `OFFSET` | | [`nodes`](#nodes) | Read node lifecycle and capacity events. | `target`, `since` | `LIMIT`, `OFFSET` | | [`deploy_impact`](#deploy-impact) | Join recent deployments to the failures that followed them. | `target`, `since` | `LIMIT` | | [`common_cause`](#common-cause) | Find shared infrastructure or dependencies behind recent failures. | `namespace`, `since` | `LIMIT` | | [`blast_radius`](#blast-radius) | Calculate the transitive workloads, pods, and services affected by a resource. | `resource` | `LIMIT` | | [`spof`](#spof) | Rank highly shared ConfigMaps, service accounts, or nodes by fan-in. | `kind`, `namespace` | `LIMIT` | | [`orphans`](#orphans) | Find unused or dangling Kubernetes resources. | `kind`, `namespace` | `LIMIT` | | [`coverage`](#coverage) | Find service, monitor, or metrics coverage gaps. | `kind`, `namespace` | `LIMIT` | | [`access`](#access) | Inspect RBAC reach or rank over-privileged service accounts. | `resource`, `mode` | `LIMIT` | | [`exposure`](#exposure) | Trace bidirectional stored public-exposure routes and attached controls for one resource. | `resource`, `resource_id`, `resource_type`, `resource_namespace`, `resource_cluster`, `cursor` | `LIMIT` | | [`tenancy`](#tenancy) | Find workloads co-located with a resource on the same node. | `resource` | `LIMIT` | | [`sharedconfig`](#sharedconfig) | Find workloads coupled through shared configuration. | `resource` | `LIMIT` | | [`path`](#path) | Find the shortest infrastructure or operational path between two resources. | `from`, `from_exact`, `from_id`, `from_type`, `from_namespace`, `from_cluster`, `to`, `to_exact`, `to_id`, `to_type`, `to_namespace`, `to_cluster`, `scope` | None | | [`cascade`](#cascade) | Trace an incident correlation group in propagation order. | `target`, `id`, `since` | None | | [`alert_impact`](#alert-impact) | Find monitors and SLOs affected by a resource failure. | `resource` | `LIMIT` | | [`monitor`](#monitor) | Resolve a monitor to the infrastructure it observes. | `target` | None | | [`datastore`](#datastore) | Inspect datastore dependencies or rank widely used datastores. | `target`, `source` | `LIMIT` | | [`flow`](#flow) | Inspect stream producers and consumers or rank busy streams. | `target`, `source` | `LIMIT` | | [`external_dep`](#external-dep) | Inspect external dependencies or rank high-fan-in external hosts. | `target`, `source` | `LIMIT` | | [`alerts`](#alerts) | List currently firing monitors, optionally scoped to a service. | `target` | `LIMIT` | | [`alert_noise`](#alert-noise) | Rank flapping or stuck monitors. | `target`, `kind`, `since` | `LIMIT` | | [`calls`](#calls) | Inspect APM service callers, callees, and HTTP route evidence or rank call-graph fan-in. | `target`, `source` | `LIMIT` | | [`servicetree`](#servicetree) | Expand a service's downstream services, datastores, and external dependencies. | `target`, `source` | `LIMIT` | | [`alert_cause`](#alert-cause) | Join a firing service or workload to recent Kubernetes changes. | `target`, `since` | `LIMIT` | | [`slo`](#slo) | Inspect one SLO or rank breaching and at-risk SLOs. | `target` | `LIMIT` | | [`alertrules`](#alertrules) | Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory. | `subject`, `namespace`, `target` | `LIMIT` | | [`iac`](#iac) | Inspect Terraform code-to-state-to-cloud provenance and linkage coverage. | `resource`, `status`, `freshness` | `LIMIT`, `OFFSET` | | [`iac_drift`](#iac-drift) | Compare last-applied Terraform state with fresh observed cloud properties. | `resource`, `status`, `freshness` | `LIMIT`, `OFFSET` | | [`gitops`](#gitops) | Inspect GitOps drift, unmanaged workloads, or resource ownership. | `subject`, `namespace`, `resource` | `LIMIT` | | [`image`](#image) | Inspect image usage, workload containers, or container hygiene gaps. | `target`, `workload`, `digest`, `kind`, `namespace` | `LIMIT` | | [`netpol`](#netpol) | Inspect NetworkPolicy coverage, policies, or east-west reach. | `mode`, `namespace`, `target` | `LIMIT` | | [`priority`](#priority) | Inspect scheduling priority gaps, the class ladder, or one target's priority. | `kind`, `namespace`, `target` | `LIMIT` | | [`storage`](#storage) | Inspect workload storage and find orphaned or unclaimed volumes. | `mode`, `workload`, `resource`, `class`, `namespace` | `LIMIT` | | [`pdb`](#pdb) | Find workloads without PodDisruptionBudgets or inspect one workload or PDB. | `target`, `workload`, `pdb` | `LIMIT` | | [`scaling`](#scaling) | Find workloads without HPAs, list autoscaled workloads, or inspect one target. | `mode`, `namespace`, `target` | `LIMIT` | | [`topology`](#topology) | Build a typed service topology at a selected level. | `service`, `level`, `source`, `endpoint`, `dependency` | None | ## resolve Resolve a resource name or fragment to ranked current graph resources. Result intent: `resolve` Aliases: `search` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ------ | ------ | -------- | --------------- | ------------------------------------- | | `term` | string | Yes | Any string | Resource name or fragment to resolve. | ### Resolve resources Return ranked candidates for a resource name or fragment. ```console theme={null} $ annie graph query "SELECT * FROM resolve WHERE term = checkout LIMIT 10" ``` ## events Read the infrastructure change-event timeline. Result intent: `events` Aliases: `event` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | ------------------------------------------------------------------------------ | ---------------------------------------------------- | | `type` | string | No | Any string | Event type or type fragment, such as oom or scaling. | | `target` | string | No | Any string | Resource name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `noise` | enum | No | `signal` (aliases: `false`, `exclude`)
`all` (aliases: `true`, `include`) | Whether to include noisy events. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Recent resource events Read recent events for a resource inside a time window. ```console theme={null} $ annie graph query "SELECT * FROM events WHERE target = checkout AND since = 2h LIMIT 20" ``` ## cloud\_events Read evidence-backed AWS, Azure, and GCP change events without parsing summaries. Result intent: `cloudevents` Aliases: `cloudevents`, `cloud_event` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ------------- | -------- | -------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `provider` | enum | No | `aws`
`azure`
`gcp` | Cloud provider. | | `scope` | string | No | Any string | Provider scope: AWS account, Azure subscription, or GCP project. | | `region` | string | No | Any string | Cloud region or location. | | `category` | enum | No | `security`
`identity`
`lifecycle`
`configuration`
`capacity`
`backup`
`other` | Normalized cloud-change category. | | `type` | string | No | Any string | Exact normalized event type. Underscores are preserved. | | `resource` | string | No | Any string | Exact ARN, ARM ID, graph id, or unambiguous resource name. | | `actor` | string | No | Any string | Actor identity, name, or graph id. | | `correlation` | string | No | Any string | Anyshift event-story correlation id. | | `operation` | string | No | Any string | Provider-native operation id. | | `stats` | enum | No | `exact`
`none` | Whether to calculate exact full-window totals and event-type counts. Omission preserves `exact`; use `none` for bounded page browsing. | | `noise` | enum | No | `signal` (aliases: `false`, `exclude`)
`all` (aliases: `true`, `include`, `raw`) | Whether to include high-noise evidence. | | `diff` | enum | No | `false` (aliases: `no`, `none`)
`true` (aliases: `yes`, `include`) | Whether to include sanitized before/after values. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | | `cursor` | string | No | Any string | Opaque seek cursor returned by the previous page. | ### Recent cloud changes Read a bounded provider-neutral cloud-change timeline. ```console theme={null} $ annie graph query "SELECT * FROM cloud_events WHERE provider = aws AND category = security AND since = 24h LIMIT 50" ``` Exact statistics can scan the complete matching window independently of the page limit. For a bounded first page, add `stats = none`; the response sets `total` to `null`, leaves `byType` empty, and reports `statistics.mode = "none"`. Omitting `stats` or selecting `stats = exact` preserves the exact total and event-type breakdown. ## cloud\_resources Inspect current or recently deleted AWS, Azure, and GCP resources with freshness and provenance. Result intent: `cloudresources` Aliases: `cloudresources`, `cloud_inventory` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ------------ | -------- | -------- | ------------------------------------------ | -------------------------------------------------------------------- | | `provider` | enum | No | `aws`
`azure`
`gcp` | Cloud provider. | | `scope` | string | No | Any string | Provider scope: AWS account, Azure subscription, or GCP project. | | `region` | string | No | Any string | Cloud region or location. | | `type` | string | No | Any string | Provider resource type, such as EC2\_INSTANCE or COMPUTE\_INSTANCES. | | `resource` | string | No | Any string | Exact native id, graph id, or unambiguous resource name. | | `lifecycle` | enum | No | `alive`
`deleted`
`all` | Resource lifecycle. Defaults to alive. | | `provenance` | enum | No | `managed`
`configured`
`unknown` | IaC provenance status. | | `freshness` | enum | No | `fresh`
`stale`
`unknown` | Freshness verdict relative to max\_age. | | `max_age` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | | `cursor` | string | No | Any string | Opaque seek cursor returned by the previous page. | ### Current cloud inventory List provider resources with explicit freshness and provenance evidence. ```console theme={null} $ annie graph query "SELECT * FROM cloud_resources WHERE provider = aws AND type = EC2_INSTANCE LIMIT 50" ``` ## delivery\_events Read commit, CI, release, and deployment evidence from the delivery graph. Result intent: `deliveryevents` Aliases: `deliveryevents`, `delivery` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | -------- | -------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | `stage` | enum | No | `commit`
`ci` (aliases: `pipeline`)
`release`
`deploy` (aliases: `deployment`) | Delivery stage. | | `type` | string | No | Any string | Exact event type, such as event\_release or argocd\_synced. | | `resource` | string | No | Any string | Exact graph id or unambiguous target name. | | `actor` | string | No | Any string | Actor identity, name, or graph id. | | `source` | string | No | Any string | Persisted event source. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | | `cursor` | string | No | Any string | Opaque seek cursor returned by the previous page. | ### Recent delivery activity Read a bounded software-delivery timeline without inferring missing actors or commits. ```console theme={null} $ annie graph query "SELECT * FROM delivery_events WHERE stage = release AND since = 7d LIMIT 50" ``` ## provenance Trace a resource to stored release, commit, and actor evidence. Result intent: `provenance` Aliases: `release_provenance`, `delivery_provenance` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------------------------------------- | | `resource` | string | Yes | Any string | Resource, repository, release, image, or service to trace. | ### Release provenance Return only stored release-to-commit-to-actor evidence. ```console theme={null} $ annie graph query "SELECT * FROM provenance WHERE resource = checkout LIMIT 20" ``` ## ownership Resolve observed GitHub user or team code ownership and contact identities. Result intent: `ownership` Aliases: `owners`, `code_ownership` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | -------------------------------------------------------- | | `resource` | string | Yes | Any string | Repository or resource whose observed owner is required. | ### Observed code ownership Return OWNS\_CODE evidence and any linked people; missing edges remain unknown. ```console theme={null} $ annie graph query "SELECT * FROM ownership WHERE resource = anyshift-io/checkout LIMIT 20" ``` ## graph\_coverage Inspect current node, relationship, bridge, and event evidence by graph source. Result intent: `graphcoverage` Aliases: `graphcoverage`, `source_coverage` Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | ---- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | | `source` | enum | No | `kubernetes` (aliases: `k8s`)
`cloud`
`github` (aliases: `scm`)
`datadog`
`tempo`
`dynatrace`
`victoria`
`grafana` | Source universe. | ### Graph source coverage Report only observed graph evidence; absent does not imply configuration state. ```console theme={null} $ annie graph query "SELECT * FROM graph_coverage" ``` ## resources Count and sample current resources of one graph resource type. Result intent: `inventory` Aliases: `resource`, `inventory` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ------ | ------ | -------- | --------------- | --------------------------------------------------- | | `type` | string | Yes | Any string | Graph resource type, such as service or deployment. | ### Resource inventory Return the inventory for one resource type. ```console theme={null} $ annie graph query "SELECT * FROM resources WHERE type = deployment LIMIT 50" ``` ## operational\_impact Find potential operational impact through reviewed directional graph relationships. Result intent: `impact` Aliases: `potential_impact` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ---------- | ------- | -------- | --------------- | ----------------------------------------------------- | | `resource` | string | Yes | Any string | Root resource whose potential impact to evaluate. | | `depth` | integer | No | Any string | Maximum propagation depth from 1 to 3. Defaults to 2. | ### Potential operational impact Return resources reachable through reviewed operational impact relationships. ```console theme={null} $ annie graph query "SELECT * FROM operational_impact WHERE resource = checkout-db AND depth = 2 LIMIT 50" ``` ## connections Inspect direct upstream and downstream relationships for a resource. Result intent: `connections` Aliases: `connection`, `deps` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------- | | `resource` | string | Yes | Any string | Resource name or identifier. | ### Direct connections Return the resource and its direct graph neighbors. ```console theme={null} $ annie graph query "SELECT * FROM connections WHERE resource = checkout LIMIT 50" ``` ## hotspots Rank noisy resources, namespaces, alert rules, or alerting workloads. Result intent: `hotspots` Aliases: `hotspot` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | `type` | string | No | Any string | Event type or type fragment. | | `by` | enum | No | `resource` (aliases: `resources`)
`namespace` (aliases: `namespaces`, `ns`)
`alertrule` (aliases: `alertrules`, `rule`)
`alertworkload` (aliases: `alertworkloads`, `workload`) | Ranking dimension. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | | `noise` | enum | No | `signal` (aliases: `false`, `exclude`)
`all` (aliases: `true`, `include`) | Whether to include noisy events. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Resource hotspots Rank resources by recent event activity. ```console theme={null} $ annie graph query "SELECT * FROM hotspots WHERE by = resource AND since = 24h LIMIT 10" ``` ## incidents Reconstruct a correlated incident around a target or correlation identifier. Result intent: `incident` Aliases: `incident` Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Resource name or fragment. | | `id` | string | No | Any string | Correlation identifier. | | `type` | string | No | Any string | Optional event type filter. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Incident by target At least one of target or id is required; since bounds target resolution. ```console theme={null} $ annie graph query "SELECT * FROM incidents WHERE target = checkout AND since = 2h" ``` ### Incident by correlation id Load one exact correlation group. ```console theme={null} $ annie graph query "SELECT * FROM incidents WHERE id = incident-123" ``` ## failures Read recent failure-class infrastructure events. Result intent: `failures` Aliases: None Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Resource name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Recent failures Read failures for a target, namespace, or the whole project. ```console theme={null} $ annie graph query "SELECT * FROM failures WHERE namespace = commerce AND since = 2h LIMIT 20" ``` ## deployments Read recent workload deployments and image changes. Result intent: `deployments` Aliases: `deployment`, `rollouts` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Workload name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Recent deployments Read deployments for a target, namespace, or the whole project. ```console theme={null} $ annie graph query "SELECT * FROM deployments WHERE namespace = commerce AND since = 24h LIMIT 20" ``` ## audit Read configuration, identity, and infrastructure audit events. Result intent: `audit` Aliases: `changes` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Resource name or fragment. | | `namespace` | string | No | Any string | Kubernetes namespace. | | `type` | string | No | Any string | Audit event type or fragment, such as rbac. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### RBAC audit Read recent RBAC-related changes. ```console theme={null} $ annie graph query "SELECT * FROM audit WHERE type = rbac AND since = 24h LIMIT 20" ``` ## nodes Read node lifecycle and capacity events. Result intent: `nodes` Aliases: `node` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Node name or fragment. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Node activity Read recent node events. ```console theme={null} $ annie graph query "SELECT * FROM nodes WHERE since = 6h LIMIT 20" ``` ## deploy\_impact Join recent deployments to the failures that followed them. Result intent: `deployimpact` Aliases: `impact`, `risky` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Workload name or fragment. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Deployment impact Rank recent deployment fallout or inspect one workload. ```console theme={null} $ annie graph query "SELECT * FROM deploy_impact WHERE target = checkout AND since = 24h LIMIT 10" ``` ## common\_cause Find shared infrastructure or dependencies behind recent failures. Result intent: `commoncause` Aliases: `commoncause`, `cause` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------- | ------------------------------------------------ | | `namespace` | string | No | Any string | Kubernetes namespace scope. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Shared failure causes Intersect recent failures by node, workload, datastore, and external dependency. ```console theme={null} $ annie graph query "SELECT * FROM common_cause WHERE namespace = commerce AND since = 2h LIMIT 10" ``` ## blast\_radius Calculate the transitive workloads, pods, and services affected by a resource. Result intent: `blast` Aliases: `blast` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ------------------------------------- | | `resource` | string | Yes | Any string | Starting resource name or identifier. | ### Resource blast radius Walk impact outward from one resource. ```console theme={null} $ annie graph query "SELECT * FROM blast_radius WHERE resource = shared-runtime-sa LIMIT 100" ``` ## spof Rank highly shared ConfigMaps, service accounts, or nodes by fan-in. Result intent: `spof` Aliases: `spofs` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- | | `kind` | enum | No | `configmap` (aliases: `configmaps`, `cm`)
`serviceaccount` (aliases: `serviceaccounts`, `sa`)
`node` (aliases: `nodes`) | Resource kind to rank. Defaults to configmap. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | ### Shared service accounts Rank service accounts by dependent workloads and pods. ```console theme={null} $ annie graph query "SELECT * FROM spof WHERE kind = serviceaccount LIMIT 10" ``` ## orphans Find unused or dangling Kubernetes resources. Result intent: `orphans` Aliases: `orphan`, `unused`, `dangling` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | `kind` | enum | No | `configmap` (aliases: `configmaps`, `cm`)
`serviceaccount` (aliases: `serviceaccounts`, `sa`)
`role` (aliases: `roles`)
`replicaset` (aliases: `replicasets`, `rs`) | Resource kind to inspect. Defaults to configmap. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | ### Orphaned roles Find roles with no observed consumers. ```console theme={null} $ annie graph query "SELECT * FROM orphans WHERE kind = role AND namespace = commerce LIMIT 20" ``` ## coverage Find service, monitor, or metrics coverage gaps. Result intent: `coverage` Aliases: `blindspots`, `unmonitored`, `uncovered` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | | `kind` | enum | No | `service` (aliases: `services`, `workload`, `workloads`)
`monitor` (aliases: `monitors`)
`metrics` (aliases: `metric`) | Coverage dimension. Defaults to service. | | `namespace` | string | No | Any string | Kubernetes namespace scope. | ### Monitoring gaps Find unmonitored services in one namespace. ```console theme={null} $ annie graph query "SELECT * FROM coverage WHERE kind = service AND namespace = commerce LIMIT 20" ``` ## access Inspect RBAC reach or rank over-privileged service accounts. Result intent: `access` Aliases: `rbac`, `permissions` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | ------------------------- | -------------------------------------------------------------------------------- | | `resource` | string | No | Any string | Subject or role name in reach mode; optional namespace scope in privileged mode. | | `mode` | enum | No | `reach`
`privileged` | Access analysis mode. Defaults to reach. | ### Subject reach Reach mode requires resource. ```console theme={null} $ annie graph query "SELECT * FROM access WHERE resource = ci-deployer" ``` ### Privileged identities Privileged mode can optionally scope resource to a namespace. ```console theme={null} $ annie graph query "SELECT * FROM access WHERE mode = privileged LIMIT 10" ``` ## exposure Trace bidirectional stored public-exposure routes and attached controls for one resource. Result intent: `exposure` Aliases: `exposed`, `attack_surface` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------------------- | ------ | -------- | --------------- | ------------------------------------------------------------------------------------------------ | | `resource` | string | No | Any string | Non-empty resource name or FQDN; exactly one of resource and resource\_id is required. | | `resource_id` | string | No | Any string | Non-empty stable graph or provider id; cannot be combined with resource or name qualifiers. | | `resource_type` | string | No | Any string | Non-empty name-only qualifier; requires resource and sets exact selection. | | `resource_namespace` | string | No | Any string | Non-empty name-only qualifier; requires resource and sets exact selection. | | `resource_cluster` | string | No | Any string | Non-empty name-only qualifier; requires resource and sets exact selection. | | `cursor` | string | No | Any string | Non-empty opaque seek cursor bound to the subject and perspective of the previous exposure page. | ### Public exposure by name Resolve one name or FQDN and select the traversal perspective from that subject. ```console theme={null} $ annie graph query "SELECT * FROM exposure WHERE resource = api.example.com" ``` ### Public exposure by stable id Bypass name resolution with one stable graph or provider identity. ```console theme={null} $ annie graph query "SELECT * FROM exposure WHERE resource_id = 'cf://accounts/a/zones/z/hostnames/api.example.com'" ``` ### Qualified exact public exposure Use name-only qualifiers to force exact typed subject selection. ```console theme={null} $ annie graph query "SELECT * FROM exposure WHERE resource = checkout AND resource_type = K8S_SERVICE AND resource_namespace = payments" ``` ## tenancy Find workloads co-located with a resource on the same node. Result intent: `tenancy` Aliases: `colocation`, `colocated`, `neighbors` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------- | | `resource` | string | Yes | Any string | Workload, pod, or node name. | ### Noisy neighbors Inspect resources sharing a node with the target. ```console theme={null} $ annie graph query "SELECT * FROM tenancy WHERE resource = checkout LIMIT 20" ``` ## sharedconfig Find workloads coupled through shared configuration. Result intent: `sharedconfig` Aliases: `shared_config`, `configsiblings`, `config_siblings`, `configcoupled` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ---------------------------------------- | | `resource` | string | Yes | Any string | Workload or configuration resource name. | ### Shared configuration Find workloads sharing configuration with the target. ```console theme={null} $ annie graph query "SELECT * FROM sharedconfig WHERE resource = checkout LIMIT 20" ``` ## path Find the shortest infrastructure or operational path between two resources. Result intent: `path` Aliases: `paths` Modifiers: None | Filter | Type | Required | Accepted values | Description | | ---------------- | ------ | -------- | ----------------------------------- | -------------------------------------------------------------------------- | | `from` | string | No | Any string | Starting resource name. Required unless from\_id is supplied. | | `from_exact` | string | No | Any string | Set true for exact-name matching instead of legacy fuzzy resolution. | | `from_id` | string | No | Any string | Exact starting hashedID or anyshiftID. | | `from_type` | string | No | Any string | Exact starting resource label, such as K8S\_DEPLOYMENT. | | `from_namespace` | string | No | Any string | Exact starting Kubernetes namespace. | | `from_cluster` | string | No | Any string | Exact starting cluster name. | | `to` | string | No | Any string | Destination resource name. Required unless to\_id is supplied. | | `to_exact` | string | No | Any string | Set true for exact-name matching instead of legacy fuzzy resolution. | | `to_id` | string | No | Any string | Exact destination hashedID or anyshiftID. | | `to_type` | string | No | Any string | Exact destination resource label, such as TEMPO\_DATASTORE. | | `to_namespace` | string | No | Any string | Exact destination Kubernetes namespace. | | `to_cluster` | string | No | Any string | Exact destination cluster name. | | `scope` | enum | No | `infrastructure`
`operational` | Relationships available to the path traversal. Defaults to infrastructure. | ### Shortest path Each endpoint requires a name or id. Typed selectors resolve same-named resources deterministically. ```console theme={null} $ annie graph query "SELECT * FROM path WHERE from = checkout-api AND from_type = K8S_DEPLOYMENT AND to = postgresql AND to_type = TEMPO_DATASTORE AND scope = operational" ``` ## cascade Trace an incident correlation group in propagation order. Result intent: `cascade` Aliases: `cascades` Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | No | Any string | Resource name or fragment. | | `id` | string | No | Any string | Correlation identifier. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Cascade by target At least one of target or id is required; since bounds target resolution. ```console theme={null} $ annie graph query "SELECT * FROM cascade WHERE target = checkout AND since = 2h" ``` ### Cascade by correlation id Trace one exact correlation group. ```console theme={null} $ annie graph query "SELECT * FROM cascade WHERE id = incident-123" ``` ## alert\_impact Find monitors and SLOs affected by a resource failure. Result intent: `alertimpact` Aliases: `alertimpact` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ----------------------------- | | `resource` | string | Yes | Any string | Infrastructure resource name. | ### Alert impact Map an infrastructure resource to affected observability objects. ```console theme={null} $ annie graph query "SELECT * FROM alert_impact WHERE resource = checkout" ``` ## monitor Resolve a monitor to the infrastructure it observes. Result intent: `monitor` Aliases: `monitors` Modifiers: None | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | ------------------------- | | `target` | string | Yes | Any string | Monitor name or fragment. | ### Monitor infrastructure Map one monitor to its service, workload, and node. ```console theme={null} $ annie graph query "SELECT * FROM monitor WHERE target = checkout-latency" ``` ## datastore Inspect datastore dependencies or rank widely used datastores. Result intent: `datastore` Aliases: `datastores` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------------------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service or datastore name. | | `source` | enum | No | `auto`
`datadog`
`tempo`
`dynatrace` | APM dependency source. Defaults to auto. | ### Rank datastores Omit target to rank datastore fan-in. ```console theme={null} $ annie graph query "SELECT * FROM datastore LIMIT 10" ``` ### Datastore dependencies Inspect services connected to one datastore or datastores used by one service. ```console theme={null} $ annie graph query "SELECT * FROM datastore WHERE target = checkout-postgres" ``` ## flow Inspect stream producers and consumers or rank busy streams. Result intent: `flow` Aliases: `flows`, `stream` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------------------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service, topic, queue, or stream name. | | `source` | enum | No | `auto`
`datadog`
`tempo`
`dynatrace` | APM dependency source. Defaults to auto. | ### Stream dependencies Inspect producers and consumers for a stream. ```console theme={null} $ annie graph query "SELECT * FROM flow WHERE target = checkout-events" ``` ## external\_dep Inspect external dependencies or rank high-fan-in external hosts. Result intent: `externaldep` Aliases: `externaldep`, `external` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------------------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service or external dependency name. | | `source` | enum | No | `auto`
`datadog`
`tempo`
`dynatrace` | APM dependency source. Defaults to auto. | ### External dependencies Inspect services depending on one external host. ```console theme={null} $ annie graph query "SELECT * FROM external_dep WHERE target = payments.example.com" ``` ## alerts List currently firing monitors, optionally scoped to a service. Result intent: `alerts` Aliases: `alert`, `firing` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | ------------------------- | | `target` | string | No | Any string | Service or workload name. | ### Current alerts List firing monitors for the project or one target. ```console theme={null} $ annie graph query "SELECT * FROM alerts WHERE target = checkout LIMIT 20" ``` ## alert\_noise Rank flapping or stuck monitors. Result intent: `alertnoise` Aliases: `alertnoise`, `noise`, `flapping`, `noisy` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | ----------------------------------------- | ------------------------------------------------ | | `target` | string | No | Any string | Monitor or service name. | | `kind` | enum | No | `flapping` (aliases: `flap`)
`stuck` | Noise pattern. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Flapping alerts Rank recently flapping monitors. ```console theme={null} $ annie graph query "SELECT * FROM alert_noise WHERE kind = flapping AND since = 1d LIMIT 10" ``` ## calls Inspect APM service callers, callees, and HTTP route evidence or rank call-graph fan-in. Result intent: `calls` Aliases: `call`, `callgraph` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------------------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Service name. | | `source` | enum | No | `auto`
`datadog`
`tempo`
`dynatrace` | APM dependency source. Defaults to auto. | ### Service calls Inspect callers, callees, and available templated HTTP operations for one service. ```console theme={null} $ annie graph query "SELECT * FROM calls WHERE target = checkout" ``` ## servicetree Expand a service's downstream services, datastores, and external dependencies. Result intent: `servicetree` Aliases: `service_tree`, `footprint` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------------------------------------------- | ---------------------------------------- | | `target` | string | No | Any string | Root service name. | | `source` | enum | No | `auto`
`datadog`
`tempo`
`dynatrace` | APM dependency source. Defaults to auto. | ### Service tree Expand the downstream footprint of one service. ```console theme={null} $ annie graph query "SELECT * FROM servicetree WHERE target = checkout LIMIT 50" ``` ## alert\_cause Join a firing service or workload to recent Kubernetes changes. Result intent: `alertcause` Aliases: `alertcause`, `rootcause` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | -------- | -------- | --------------- | ------------------------------------------------ | | `target` | string | Yes | Any string | Service or workload name. | | `since` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Alert cause Find recent infrastructure changes behind a firing target. ```console theme={null} $ annie graph query "SELECT * FROM alert_cause WHERE target = checkout AND since = 2h LIMIT 20" ``` ## slo Inspect one SLO or rank breaching and at-risk SLOs. Result intent: `slo` Aliases: `slos` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | -------- | ------ | -------- | --------------- | --------------------- | | `target` | string | No | Any string | SLO name or fragment. | ### SLO health Inspect one SLO by name. ```console theme={null} $ annie graph query "SELECT * FROM slo WHERE target = 'checkout availability'" ``` ## alertrules Inspect Grafana and VictoriaMetrics alert-rule coverage and inventory. Result intent: `alertrules` Aliases: `alert_rules`, `grafana`, `victoria` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | `subject` | enum | No | `coverage`
`inventory` (aliases: `inventories`)
`target` (aliases: `targets`) | Alert-rule view. Defaults to coverage. | | `namespace` | string | No | Any string | Namespace scope for coverage or inventory. | | `target` | string | No | Any string | Service or workload name. Required when subject is target. | ### Alert-rule coverage Find services or workloads without alert rules. ```console theme={null} $ annie graph query "SELECT * FROM alertrules WHERE subject = coverage AND namespace = commerce LIMIT 20" ``` ### Rules for a target Target subject requires target. ```console theme={null} $ annie graph query "SELECT * FROM alertrules WHERE subject = target AND target = checkout" ``` ## iac Inspect Terraform code-to-state-to-cloud provenance and linkage coverage. Result intent: `iac` Aliases: `terraform`, `iac_provenance` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | `resource` | string | No | Any string | Terraform address or Terraform, state, or cloud graph identifier. | | `status` | enum | No | `managed`
`unlinked`
`missing_cloud` (aliases: `missingcloud`, `state_only`)
`ambiguous`
`stale`
`invalid` | IaC linkage status. | | `freshness` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### IaC coverage Summarize Terraform code-to-state-to-cloud linkage and return a bounded resource page. ```console theme={null} $ annie graph query "SELECT * FROM iac LIMIT 50" ``` ### Resource provenance Show one resource's Terraform, state, and cloud evidence. Exact state/cloud identifiers select their relationship chain; a generic Terraform declaration keeps all instances. ```console theme={null} $ annie graph query "SELECT * FROM iac WHERE resource = aws_instance.api_server" ``` ### IaC linkage gaps List resources with one evidence-backed linkage status. ```console theme={null} $ annie graph query "SELECT * FROM iac WHERE status = unlinked LIMIT 50" ``` ## iac\_drift Compare last-applied Terraform state with fresh observed cloud properties. Result intent: `iacdrift` Aliases: `terraform_drift`, `drift` Modifiers: `LIMIT`, `OFFSET` | Filter | Type | Required | Accepted values | Description | | ----------- | -------- | -------- | --------------------------------------------------------------------- | ----------------------------------------------------------------- | | `resource` | string | No | Any string | Terraform address or Terraform, state, or cloud graph identifier. | | `status` | enum | No | `drifted`
`in_sync` (aliases: `insync`, `synced`)
`unknown` | Drift verdict. | | `freshness` | duration | No | Any string | Relative lookback such as 30m, 2h, 1d, or today. | ### Current IaC drift List supported state-to-cloud differences, excluding unknown evidence by default. ```console theme={null} $ annie graph query "SELECT * FROM iac_drift WHERE status = drifted LIMIT 50" ``` ### Resource drift Evaluate one Terraform resource using its state and cloud evidence. ```console theme={null} $ annie graph query "SELECT * FROM iac_drift WHERE resource = aws_instance.api_server" ``` ## gitops Inspect GitOps drift, unmanaged workloads, or resource ownership. Result intent: `gitops` Aliases: `argocd`, `gitops_drift`, `argocd_drift` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | | `subject` | enum | No | `drift` (aliases: `drifted`)
`unmanaged`
`owner` (aliases: `ownership`) | GitOps view. Defaults to drift. | | `namespace` | string | No | Any string | Namespace scope for drift or unmanaged views. | | `resource` | string | No | Any string | Workload name. Required when subject is owner. | ### GitOps drift List drifted applications, optionally scoped to a namespace. ```console theme={null} $ annie graph query "SELECT * FROM gitops WHERE subject = drift AND namespace = commerce LIMIT 20" ``` ### Resource owner Owner subject requires resource. ```console theme={null} $ annie graph query "SELECT * FROM gitops WHERE subject = owner AND resource = checkout" ``` ## image Inspect image usage, workload containers, or container hygiene gaps. Result intent: `image` Aliases: `images`, `containers` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- | | `target` | string | No | Any string | Image, service, or workload name. | | `workload` | string | No | Any string | Workload whose container resources should be inspected. | | `digest` | string | No | Any string | Exact running image digest (sha256, repository digest, or runtime image ID). | | `kind` | enum | No | `nomemlimit` (aliases: `no_mem_limit`, `nomemorylimit`)
`nocpurequest` (aliases: `no_cpu_request`)
`skew` (aliases: `versionskew`, `version_skew`) | Container hygiene scan. | | `namespace` | string | No | Any string | Namespace scope for a hygiene scan. | ### Runtime digest usage Find live containers and owning workloads running an exact image digest. ```console theme={null} $ annie graph query "SELECT * FROM image WHERE digest = 'sha256:776129790f01a675bb6e98447c2a28d43a07144d5410691823dbf9a21d256b1e' LIMIT 50" ``` ### Image usage Inspect who runs an image or what image a target runs. ```console theme={null} $ annie graph query "SELECT * FROM image WHERE target = checkout" ``` ### Container hygiene Kind selects a hygiene scan and namespace optionally scopes it. ```console theme={null} $ annie graph query "SELECT * FROM image WHERE kind = nomemlimit AND namespace = commerce LIMIT 20" ``` ## netpol Inspect NetworkPolicy coverage, policies, or east-west reach. Result intent: `netpol` Aliases: `netpols`, `networkpolicy`, `segmentation`, `defaultallow` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `mode` | enum | No | `uncovered` (aliases: `coverage`, `default_allow`, `defaultallow`)
`policy` (aliases: `policies`)
`segmentation` (aliases: `segment`) | Network policy view. Defaults to uncovered. | | `namespace` | string | No | Any string | Namespace scope for uncovered or policy views. | | `target` | string | No | Any string | Workload or policy name. Required for segmentation. | ### NetworkPolicy gaps Find default-allow namespaces. ```console theme={null} $ annie graph query "SELECT * FROM netpol WHERE mode = uncovered LIMIT 20" ``` ### East-west reach Segmentation mode requires target. ```console theme={null} $ annie graph query "SELECT * FROM netpol WHERE mode = segmentation AND target = checkout" ``` ## priority Inspect scheduling priority gaps, the class ladder, or one target's priority. Result intent: `priority` Aliases: `priorityclass`, `preemption`, `nopriority` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------- | | `kind` | enum | No | `nopriority` (aliases: `unprioritized`, `none`)
`ladder` (aliases: `classes`, `class`) | Priority view. | | `namespace` | string | No | Any string | Namespace scope for missing-priority checks. | | `target` | string | No | Any string | Workload or pod name whose priority should be inspected. | ### Missing priority classes Find workloads without a priority class. ```console theme={null} $ annie graph query "SELECT * FROM priority WHERE kind = nopriority AND namespace = commerce LIMIT 20" ``` ### Target priority Inspect the priority class for one workload or pod. ```console theme={null} $ annie graph query "SELECT * FROM priority WHERE target = checkout" ``` ## storage Inspect workload storage and find orphaned or unclaimed volumes. Result intent: `storage` Aliases: `volumes`, `pv`, `pvc`, `storageclass` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------- | | `mode` | enum | No | `footprint` (aliases: `workload`)
`orphanpv` (aliases: `orphanpvs`, `orphaned`, `orphan`)
`unclaimedpvc` (aliases: `unclaimedpvcs`, `unclaimed`)
`byclass` (aliases: `class`, `storageclass`) | Storage view. Defaults to footprint. | | `workload` | string | No | Any string | Workload or pod name. Required in footprint mode. | | `resource` | string | No | Any string | Alias for workload in footprint mode. | | `class` | string | No | Any string | StorageClass filter for orphanpv or byclass mode. | | `namespace` | string | No | Any string | Namespace scope for unclaimedpvc mode. | ### Workload storage Footprint mode requires workload or resource. ```console theme={null} $ annie graph query "SELECT * FROM storage WHERE workload = checkout" ``` ### Unclaimed PVCs Find unclaimed claims, optionally scoped to a namespace. ```console theme={null} $ annie graph query "SELECT * FROM storage WHERE mode = unclaimedpvc AND namespace = commerce LIMIT 20" ``` ## pdb Find workloads without PodDisruptionBudgets or inspect one workload or PDB. Result intent: `pdb` Aliases: `pdbs`, `unprotected`, `disruption` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ---------- | ------ | -------- | --------------- | ------------------------- | | `target` | string | No | Any string | Workload or PDB name. | | `workload` | string | No | Any string | Workload name. | | `pdb` | string | No | Any string | PodDisruptionBudget name. | ### PDB coverage gaps Omit filters to list workloads without PDB protection. ```console theme={null} $ annie graph query "SELECT * FROM pdb LIMIT 20" ``` ### Target PDB coverage Inspect one workload or PDB by target, workload, or pdb. ```console theme={null} $ annie graph query "SELECT * FROM pdb WHERE workload = checkout" ``` ## scaling Find workloads without HPAs, list autoscaled workloads, or inspect one target. Result intent: `scaling` Aliases: `hpa`, `hpas`, `autoscaling`, `autoscalers` Modifiers: `LIMIT` | Filter | Type | Required | Accepted values | Description | | ----------- | ------ | -------- | ----------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | | `mode` | enum | No | `nohpa` (aliases: `no_hpa`, `unscaled`, `fixed`, `coverage`)
`autoscaled` (aliases: `hpa`, `scaled`)
`target` | Autoscaling view. Defaults to nohpa. | | `namespace` | string | No | Any string | Namespace scope for nohpa or autoscaled views. | | `target` | string | No | Any string | Workload or HPA name. Required in target mode. | ### Autoscaling gaps Find workloads without HPAs. ```console theme={null} $ annie graph query "SELECT * FROM scaling WHERE mode = nohpa AND namespace = commerce LIMIT 20" ``` ### Target autoscaling Target mode requires target. ```console theme={null} $ annie graph query "SELECT * FROM scaling WHERE target = checkout" ``` ## topology Build a typed service topology at a selected level. Result intent: `topology` Aliases: `diagram`, `c4` Modifiers: None | Filter | Type | Required | Accepted values | Description | | ------------ | ------ | -------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------- | | `service` | string | Yes | Any string | Service or workload name. | | `level` | enum | No | `context`
`container`
`component`
`dynamic` | Topology level. Defaults to container. | | `source` | enum | No | `auto`
`datadog`
`tempo`
`dynatrace`
`configuration` | Topology evidence source. Defaults to auto-discovered APM evidence. | | `endpoint` | string | No | Any string | Explicit endpoint alias used to prove a configured dependency. | | `dependency` | string | No | Any string | Catalog service name represented by the endpoint alias. | ### Service topology Service is required; level selects the topology depth. ```console theme={null} $ annie graph query "SELECT * FROM topology WHERE service = checkout AND level = context" ``` ## Use the catalog programmatically The OpenAPI document exposes this catalog under the root `x-anyshift-query-language` extension. Tooling can read that versioned object to generate completion, validation, documentation, or custom query builders without duplicating the language by hand. For typed TypeScript helpers, see [Graph SDK Capabilities](/pages/product/integration/sdk_capabilities). For raw query execution and error handling, see the [Graph SDK guide](/pages/product/integration/sdk#raw-sql).