> ## Documentation Index > Fetch the complete documentation index at: https://docs.formal.ai/llms.txt > Use this file to discover all available pages before exploring further. # GetAccessGraph > Access graph: richer multi-layer graph with top-N, summaries, and layer controls ## OpenAPI ````yaml /docs/api/openapi/graph_openapi.json post /core.v1.GraphService/GetAccessGraph openapi: 3.1.0 info: title: core.v1.GraphService version: 0.0.1 servers: - url: https://api.joinformal.com description: Production API security: [] tags: - name: core.v1.GraphService paths: /core.v1.GraphService/GetAccessGraph: post: tags: - core.v1.GraphService summary: GetAccessGraph description: >- Access graph: richer multi-layer graph with top-N, summaries, and layer controls operationId: core.v1.GraphService.GetAccessGraph requestBody: content: application/json: schema: $ref: '#/components/schemas/core.v1.GetAccessGraphRequest' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/core.v1.GetAccessGraphResponse' '400': description: Bad Request - Invalid request parameters or body content: application/json: schema: type: object properties: code: type: string example: invalid_request message: type: string example: Invalid request parameters details: type: object '401': description: Unauthorized - Missing or invalid authentication content: application/json: schema: type: object properties: code: type: string example: unauthorized message: type: string example: Authentication required '403': description: Forbidden - Insufficient permissions content: application/json: schema: type: object properties: code: type: string example: forbidden message: type: string example: Insufficient permissions to perform this action '404': description: Not Found - Resource does not exist content: application/json: schema: type: object properties: code: type: string example: not_found message: type: string example: Resource not found '500': description: Internal Server Error - An error occurred processing the request content: application/json: schema: type: object properties: code: type: string example: internal_error message: type: string example: An internal error occurred security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: cURL source: >- curl -X POST "https://api.joinformal.com/core.v1.GraphService/GetAccessGraph" \ -H "X-API-KEY: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "example": "value" }' - lang: javascript label: JavaScript (fetch) source: >- fetch("https://api.joinformal.com/core.v1.GraphService/GetAccessGraph", { method: "POST", headers: { "X-API-KEY": "YOUR_API_KEY", "Content-Type": "application/json" }, body: JSON.stringify({ example: "value" }) }) .then(response => response.json()) .then(data => console.log(data)) .catch(error => console.error(error)); - lang: python label: Python source: >- import requests url = "https://api.joinformal.com/core.v1.GraphService/GetAccessGraph" headers = { "X-API-KEY": "YOUR_API_KEY", "Content-Type": "application/json" } data = { "example": "value" } response = requests.post(url, headers=headers, json=data) print(response.json()) - lang: go label: Go source: |- package main import ( "bytes" "encoding/json" "fmt" "io" "net/http" ) func main() { url := "https://api.joinformal.com/core.v1.GraphService/GetAccessGraph" body := map[string]string{ "example": "value", } jsonData, _ := json.Marshal(body) req, _ := http.NewRequest("POST", url, bytes.NewBuffer(jsonData)) req.Header.Set("X-API-KEY", "YOUR_API_KEY") req.Header.Set("Content-Type", "application/json") client := &http.Client{} resp, err := client.Do(req) if err != nil { panic(err) } defer resp.Body.Close() responseBody, _ := io.ReadAll(resp.Body) fmt.Println(string(responseBody)) } components: schemas: core.v1.GetAccessGraphRequest: type: object properties: query: type: string title: query description: 'Primary filter: Quickwit query string defining the log universe' startTimestamp: type: string title: start_timestamp minLength: 1 description: Unix-second timestamps (strings), matching the logs RPCs. endTimestamp: type: string title: end_timestamp minLength: 1 topNHumans: type: integer title: top_n_humans format: int32 description: >- Per-layer top-N limits (backend selects top N by log volume or triggered policies) topNAgents: type: integer title: top_n_agents format: int32 topNMachines: type: integer title: top_n_machines format: int32 topNResources: type: integer title: top_n_resources format: int32 identityTypes: type: array items: type: string title: identity_types description: Which identity types to include (human, agent, machine) includeConnectors: type: boolean title: include_connectors description: >- Whether to include the connector layer (if false, backend synthesizes direct identity→resource edges by joining through connectors) sortMode: type: string title: sort_mode enum: - '' - volume - violations description: >- Sort mode: "volume" (default) or "violations" (triggered policies first) focusNodeId: type: string title: focus_node_id description: >- Optional: focus on a specific node — returns all connected nodes regardless of top-N title: GetAccessGraphRequest additionalProperties: false core.v1.GetAccessGraphResponse: type: object properties: graph: $ref: '#/components/schemas/core.v1.AccessGraph' title: graph summary: $ref: '#/components/schemas/core.v1.AccessGraphSummary' title: summary title: GetAccessGraphResponse additionalProperties: false core.v1.AccessGraph: type: object properties: nodes: type: array items: $ref: '#/components/schemas/core.v1.AccessGraphNode' title: nodes edges: type: array items: $ref: '#/components/schemas/core.v1.AccessGraphEdge' title: edges title: AccessGraph additionalProperties: false core.v1.AccessGraphSummary: type: object properties: totalLogs: type: - integer - string title: total_logs format: int64 totalTriggeredPolicies: type: - integer - string title: total_triggered_policies format: int64 policyBreakdown: $ref: '#/components/schemas/core.v1.AccessGraphPolicyBreakdown' title: policy_breakdown humans: $ref: '#/components/schemas/core.v1.AccessGraphLayerSummary' title: humans agents: $ref: '#/components/schemas/core.v1.AccessGraphLayerSummary' title: agents machines: $ref: '#/components/schemas/core.v1.AccessGraphLayerSummary' title: machines connectors: $ref: '#/components/schemas/core.v1.AccessGraphLayerSummary' title: connectors resources: $ref: '#/components/schemas/core.v1.AccessGraphLayerSummary' title: resources title: AccessGraphSummary additionalProperties: false core.v1.AccessGraphNode: type: object properties: id: type: string title: id minLength: 1 connector: $ref: '#/components/schemas/core.v1.AccessGraphConnectorNode' title: connector description: One of the discriminated union fields - use exactly one identity: $ref: '#/components/schemas/core.v1.AccessGraphIdentityNode' title: identity description: One of the discriminated union fields - use exactly one resource: $ref: '#/components/schemas/core.v1.AccessGraphResourceNode' title: resource description: One of the discriminated union fields - use exactly one title: AccessGraphNode additionalProperties: false description: >- Exactly one of these fields is required: connector or identity or resource. core.v1.AccessGraphEdge: type: object properties: id: type: string title: id minLength: 1 sourceId: type: string title: source_id minLength: 1 targetId: type: string title: target_id minLength: 1 logCount: type: - integer - string title: log_count format: int64 triggeredPolicyCount: type: - integer - string title: triggered_policy_count format: int64 policyBreakdown: $ref: '#/components/schemas/core.v1.AccessGraphPolicyBreakdown' title: policy_breakdown lastActivity: $ref: '#/components/schemas/google.protobuf.Timestamp' title: last_activity title: AccessGraphEdge additionalProperties: false description: 'Edge: a connection between two nodes with log count and policy stats.' core.v1.AccessGraphPolicyBreakdown: type: object properties: mask: type: - integer - string title: mask format: int64 filter: type: - integer - string title: filter format: int64 block: type: - integer - string title: block format: int64 title: AccessGraphPolicyBreakdown additionalProperties: false description: Breakdown of triggered policy actions by category. core.v1.AccessGraphLayerSummary: type: object properties: total: type: - integer - string title: total format: int64 logs: type: - integer - string title: logs format: int64 triggeredPolicies: type: - integer - string title: triggered_policies format: int64 title: AccessGraphLayerSummary additionalProperties: false core.v1.AccessGraphConnectorNode: type: object properties: name: type: string title: name spaceId: type: string title: space_id spaceName: type: string title: space_name totalLogs: type: - integer - string title: total_logs format: int64 triggeredPolicyCount: type: - integer - string title: triggered_policy_count format: int64 policyBreakdown: $ref: '#/components/schemas/core.v1.AccessGraphPolicyBreakdown' title: policy_breakdown title: AccessGraphConnectorNode additionalProperties: false description: >- Connector: middleware proxy. No technology field — connectors are just named proxies. core.v1.AccessGraphIdentityNode: type: object properties: name: type: string title: name email: type: string title: email kind: type: string title: kind description: '"human", "agent", or "machine"' idpProvider: type: string title: idp_provider totalLogs: type: - integer - string title: total_logs format: int64 totalSessions: type: - integer - string title: total_sessions format: int64 triggeredPolicyCount: type: - integer - string title: triggered_policy_count format: int64 policyBreakdown: $ref: '#/components/schemas/core.v1.AccessGraphPolicyBreakdown' title: policy_breakdown title: AccessGraphIdentityNode additionalProperties: false description: >- Identity: human, agent, or machine. Metadata enriched from control plane DB. core.v1.AccessGraphResourceNode: type: object properties: name: type: string title: name technology: type: string title: technology connectorId: type: string title: connector_id connectorName: type: string title: connector_name spaceId: type: string title: space_id spaceName: type: string title: space_name totalLogs: type: - integer - string title: total_logs format: int64 sensitiveFieldCount: type: - integer - string title: sensitive_field_count format: int64 triggeredPolicyCount: type: - integer - string title: triggered_policy_count format: int64 policyBreakdown: $ref: '#/components/schemas/core.v1.AccessGraphPolicyBreakdown' title: policy_breakdown title: AccessGraphResourceNode additionalProperties: false description: 'Resource: downstream data store. Technology icon comes from this field.' google.protobuf.Timestamp: type: string examples: - '2023-01-15T01:30:15.01Z' - '2024-12-25T12:00:00Z' format: date-time description: >- A Timestamp represents a point in time independent of any time zone or local calendar, encoded as a count of seconds and fractions of seconds at nanosecond resolution. The count is relative to an epoch at UTC midnight on January 1, 1970, in the proleptic Gregorian calendar which extends the Gregorian calendar backwards to year one. All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap second table is needed for interpretation, using a [24-hour linear smear](https://developers.google.com/time/smear). The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By restricting to that range, we ensure that we can convert to and from [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings. # Examples Example 1: Compute Timestamp from POSIX `time()`. Timestamp timestamp; timestamp.set_seconds(time(NULL)); timestamp.set_nanos(0); Example 2: Compute Timestamp from POSIX `gettimeofday()`. struct timeval tv; gettimeofday(&tv, NULL); Timestamp timestamp; timestamp.set_seconds(tv.tv_sec); timestamp.set_nanos(tv.tv_usec * 1000); Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`. FILETIME ft; GetSystemTimeAsFileTime(&ft); UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime; // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z. Timestamp timestamp; timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL)); timestamp.set_nanos((INT32) ((ticks % 10000000) * 100)); Example 4: Compute Timestamp from Java `System.currentTimeMillis()`. long millis = System.currentTimeMillis(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000) .setNanos((int) ((millis % 1000) * 1000000)).build(); Example 5: Compute Timestamp from Java `Instant.now()`. Instant now = Instant.now(); Timestamp timestamp = Timestamp.newBuilder().setSeconds(now.getEpochSecond()) .setNanos(now.getNano()).build(); Example 6: Compute Timestamp from current time in Python. timestamp = Timestamp() timestamp.GetCurrentTime() # JSON Mapping In JSON format, the Timestamp type is encoded as a string in the [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where {year} is always expressed using four digits while {month}, {day}, {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution), are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone is required. A proto3 JSON serializer should always use UTC (as indicated by "Z") when printing the Timestamp type and a proto3 JSON parser should be able to accept both UTC and other timezones (as indicated by an offset). For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past 01:30 UTC on January 15, 2017. In JavaScript, one can convert a Date object to this format using the standard [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString) method. In Python, a standard `datetime.datetime` object can be converted to this format using [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use the Joda Time's [`ISODateTimeFormat.dateTime()`]( http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime() ) to obtain a formatter capable of generating timestamps in this format. securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-KEY description: API key authentication. Get your API key from the Formal console. ````