SDK capabilities

The Graph SDK is a programmable interface to Anyshift’s infrastructure graph. Use it when you need graph answers inside automation, dashboards, CI checks, incident workflows, deployment gates, or developer tools. For the exhaustive source-of-truth matrix, see CAPABILITIES.md in the SDK repository.

Resource Discovery

Goal	SDK helper	Use it for
Resolve a resource name	`graph.resolve({ term })`	Rank current resources matching a name or fragment before opening a drill-down.

graph.resolve() returns the resolve intent with typed candidates containing resource identity, type, namespace, and cluster context. Use the selected candidate’s stable id with resource-scoped helpers such as graph.connections(), graph.path(), or graph.blast(). If a fuzzy helper selector remains ambiguous, the SDK throws BadQueryError with selectionCode: "ambiguous_resource" and the bounded retry candidates instead of choosing one silently.

Dependency and Impact Analysis

Goal	SDK helper	Use it for
Find direct neighbors	`graph.connections()`	Show what is directly connected to a service, workload, node, config, or dependency.
Compute blast radius	`graph.blast()`	Estimate what is affected if a resource changes or fails.
Trace a path	`graph.path()`	Explain how two resources are connected.
Expand a service footprint	`graph.serviceTree()`	Build a downstream dependency tree for service reviews or incident prep.
Explain shared failure causes	`graph.commonCause()`	Find shared nodes or workloads behind recent failures.
Check deployment fallout	`graph.deployImpact()`	Rank risky recent deploys or inspect one workload’s rollout impact.

For dependencies derived from APM data, pass source: "auto" | "datadog" | "tempo" to graph.serviceTree(). Typed graph.path() selectors can connect an exact Kubernetes workload to a Tempo service or datastore with scope: "operational". The equivalent terminal workflows are documented in the Annie CLI guide.

Timelines and Change Feeds

Goal	SDK helper	Use it for
Read recent graph events	`graph.events()`	Pull recent changes for a namespace, resource, event type, or time window.
Read cloud-provider changes	`graph.cloudEvents({ provider, operation })`	Filter AWS, Azure, or GCP evidence by exact provider operation while preserving Anyshift story correlation, source, status, and sanitized diffs.
Inspect cloud inventory	`graph.cloudResources({ provider })`	Read current or retained resources with lifecycle, observation freshness, and stored IaC provenance.
Find noisy resources	`graph.hotspots()`	Rank noisy resources, namespaces, alert rules, or alerting workloads.
Read failure events	`graph.failures()`	Feed failure timelines into automation or reports.
Read deployment events	`graph.deployments()`	Track rollouts and deployment activity.
Read audit activity	`graph.audit()`	Inspect config, identity, or infrastructure changes.
Trace incident cascades	`graph.cascade()`	Follow a correlated incident from trigger to impacted resources.

For GCP activity, operation is the provider-native identifier and is distinct from the Anyshift correlation ID returned on each event. Missing status, freshness, or provenance evidence stays unknown; the SDK does not convert it into success, stale, or unmanaged.

Topology and Diagrams

Goal	SDK helper	Use it for
Build service topology	`graph.topology()`	Get typed graph nodes and edges for a service neighborhood.
Render Mermaid	`toMermaid()`	Embed topology diagrams in PRs, incident reports, runbooks, or dashboards.

Topology supports context, container, component, and dynamic levels plus source: "auto" | "datadog" | "tempo". Dynamic topology renders as a sequence diagram; the other levels render as flowcharts.

Kubernetes Safety and Hygiene

Goal	SDK helper	Use it for
Find single points of failure	`graph.spof()`	Rank highly shared ConfigMaps, service accounts, or nodes.
Find orphaned resources	`graph.orphans()`	Detect unused ConfigMaps, service accounts, roles, or ReplicaSets.
Check PDB coverage	`graph.pdb()`	Find workloads that are unsafe during voluntary disruptions.
Check autoscaler coverage	`graph.scaling()`	Find workloads without HPAs or inspect what an HPA scales.
Check scheduling priority	`graph.priority()`	Find workloads without priority classes or inspect the preemption ladder.
Inspect persistent storage	`graph.storage()`	Trace PVC/PV/StorageClass usage and find orphaned or unclaimed storage.
Inspect image usage	`graph.image()`	Find who runs an image, inspect a workload’s images, or run container hygiene scans.

Security and Exposure

Goal	SDK helper	Use it for
Inspect RBAC reach	`graph.access()`	Understand what a subject can do or who can reach a role.
Find over-privileged identities	`graph.access({ mode: "privileged" })`	Rank service accounts with broad or risky grants.
Inspect NetworkPolicy coverage	`graph.netpol()`	Detect default-allow namespaces, inspect policies, or model east-west reach.
Inspect public exposure	`graph.exposure()`	Map ingresses to services/workloads or find which ingress exposes a resource.

Observability and Alerting

Goal	SDK helper	Use it for
Find monitoring gaps	`graph.coverage()`	Find workloads missing Datadog presence, monitors, or metrics shipping.
Map alert impact	`graph.alertImpact()`	Find which monitors and SLOs would fire if a resource is impacted.
Map monitors to infrastructure	`graph.monitor()`	Resolve a monitor to the service, workload, and node it watches.
Read active alerts	`graph.alerts()`	Pull currently firing Datadog monitors, optionally scoped to a service.
Find noisy alerts	`graph.alertNoise()`	Rank flapping or stuck monitors.
Explain alert cause	`graph.alertCause()`	Link a firing service to recent Kubernetes changes.
Inspect SLO health	`graph.slo()`	Rank breaching or at-risk SLOs, or inspect one named SLO.
Inspect Grafana/Victoria rules	`graph.alertRules()`	Find alert-rule coverage gaps, inventory rules, or inspect one target’s rules.

Service Dependencies and Ownership

Goal	SDK helper	Use it for
Inspect datastore dependencies	`graph.datastore()`	Find services using a datastore, or rank heavily used datastores.
Inspect stream dependencies	`graph.flow()`	Find producers and consumers for topics or streams.
Inspect external dependencies	`graph.externalDep()`	Find services depending on an external host.
Inspect service calls	`graph.calls()`	Find callers and callees for a service, or rank high-traffic services.
Inspect GitOps drift	`graph.gitops()`	Find drifted ArgoCD apps, unmanaged workloads, or a workload’s owning app and repository.

graph.datastore(), graph.flow(), graph.externalDep(), and graph.calls() also accept source: "auto" | "datadog" | "tempo". Tempo mode reads services, calls, datastores, messaging destinations, external endpoints, and Kubernetes identity bridges derived from Grafana Tempo traces. It does not expose individual trace or span search.

Choosing the Right Entry Point

Use typed helpers when you need deterministic automation. Use graph.query() when you want to compose a precise query from the documented targets and filters. Use graph.ask() when the caller has a natural-language question and can accept server-side routing.

For full helper parameter details and underlying intent names, use the SDK repository’s CAPABILITIES.md. For raw Graph Query Language syntax, use the complete query reference.

Get Started

Product

Manage

Resource Discovery

Dependency and Impact Analysis

Timelines and Change Feeds

Topology and Diagrams

Kubernetes Safety and Hygiene

Security and Exposure

Observability and Alerting

Service Dependencies and Ownership

Choosing the Right Entry Point

​Resource Discovery

​Dependency and Impact Analysis

​Timelines and Change Feeds

​Topology and Diagrams

​Kubernetes Safety and Hygiene

​Security and Exposure

​Observability and Alerting

​Service Dependencies and Ownership

​Choosing the Right Entry Point

Resource Discovery

Dependency and Impact Analysis

Timelines and Change Feeds

Topology and Diagrams

Kubernetes Safety and Hygiene

Security and Exposure

Observability and Alerting

Service Dependencies and Ownership

Choosing the Right Entry Point