Skip to main content
POST
cURL

Authorizations

X-API-KEY
string
header
required

API key authentication. Get your API key from the Formal console.

Body

application/json
query
string

Primary filter: Quickwit query string defining the log universe

startTimestamp
string

Unix-second timestamps (strings), matching the logs RPCs.

Minimum string length: 1
endTimestamp
string
Minimum string length: 1
topNHumans
integer<int32>

Per-layer top-N limits (backend selects top N by log volume or triggered policies)

topNAgents
integer<int32>
topNMachines
integer<int32>
topNResources
integer<int32>
identityTypes
string[]

Which identity types to include (human, agent, machine)

includeConnectors
boolean

Whether to include the connector layer (if false, backend synthesizes direct identity→resource edges by joining through connectors)

sortMode
enum<string>

Sort mode: "volume" (default) or "violations" (triggered policies first)

Available options:
,
volume,
violations
focusNodeId
string

Optional: focus on a specific node — returns all connected nodes regardless of top-N

Response

Success

graph
graph · object
summary
summary · object