> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--cloud-security/queries/get-cloud-items.md). # getCloudItems Retrieves cloud security items including cloud resources, containers, and their security posture. ### Examples {% tabs %} {% tab title="GraphQL" %} ```graphql query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps manualCheck response } resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } isAiAsset isTrainingData modelInfo { moduleName moduleVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args } dataAccess { name where matched } probeResults { url type statusCode curl connectedAsset { name cbomId } } } offset topOffset total totalFiltered selectedPosition } } ``` #### Variables This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. ```json { "cloudItemsInput": { "limit": 100, "offset": 0, "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99", "dateRange": { "from": 1749000000000, "to": 1749900000000 }, "filters": { "apps": ["example"], "service": ["example"], "type": ["example"], "cloudProvider": ["example"], "assetName": ["example"], "accountId": ["example"], "region": ["example"], "serviceCategory": ["example"], "cluster": ["example"], "severities": ["example"], "isExposed": ["example"], "reachability": ["example"], "authentication": ["example"], "verdict": ["example"], "reachabilityResponseCode": ["example"], "imageSource": ["example"], "registryType": ["example"], "registryName": ["example"], "imageScanStatus": ["example"], "artifactIds": ["example"] }, "filterSearch": [ { "fieldName": "example", "value": ["example"] } ], "owners": ["example"], "tagIds": ["example"], "search": "example", "openItems": ["digest"], "orderBy": { "field": "example", "direction": "ASC" }, "topOffset": 42, "scrollDirection": "example", "cbomId": "example", "cbomIds": ["example"] } } ``` {% endtab %} {% tab title="cURL" %} ```shell curl -X POST \ https://api.cloud.ox.security/api/apollo-gateway \ -H 'Content-Type: application/json' \ -H 'Authorization: YOUR_API_TOKEN' \ -d '{ "query": "query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps manualCheck response } resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } isAiAsset isTrainingData modelInfo { moduleName moduleVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args } dataAccess { name where matched } probeResults { url type statusCode curl connectedAsset { name cbomId } } } offset topOffset total totalFiltered selectedPosition } }", "variables": { "cloudItemsInput": { "limit": 100, "offset": 0, "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99", "dateRange": { "from": 1749000000000, "to": 1749900000000 }, "filters": { "apps": ["example"], "service": ["example"], "type": ["example"], "cloudProvider": ["example"], "assetName": ["example"], "accountId": ["example"], "region": ["example"], "serviceCategory": ["example"], "cluster": ["example"], "severities": ["example"], "isExposed": ["example"], "reachability": ["example"], "authentication": ["example"], "verdict": ["example"], "reachabilityResponseCode": ["example"], "imageSource": ["example"], "registryType": ["example"], "registryName": ["example"], "imageScanStatus": ["example"], "artifactIds": ["example"] }, "filterSearch": [ { "fieldName": "example", "value": ["example"] } ], "owners": ["example"], "tagIds": ["example"], "search": "example", "openItems": ["digest"], "orderBy": { "field": "example", "direction": "ASC" }, "topOffset": 42, "scrollDirection": "example", "cbomId": "example", "cbomIds": ["example"] } } }' ``` {% endtab %} {% tab title="Node.js" %} ```javascript const query = 'query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps manualCheck response } resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } isAiAsset isTrainingData modelInfo { moduleName moduleVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args } dataAccess { name where matched } probeResults { url type statusCode curl connectedAsset { name cbomId } } } offset topOffset total totalFiltered selectedPosition } }'; fetch("https://api.cloud.ox.security/api/apollo-gateway", { method: "POST", headers: { "Content-Type": "application/json", "Authorization": "YOUR_API_TOKEN" }, body: JSON.stringify({ query: query, // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. variables: { cloudItemsInput: { limit: 100, offset: 0, scanId: "c9da693d-8906-4a32-93c9-2ffdb1cebb99", dateRange: { from: 1749000000000, to: 1749900000000 }, filters: { apps: ["example"], service: ["example"], type: ["example"], cloudProvider: ["example"], assetName: ["example"], accountId: ["example"], region: ["example"], serviceCategory: ["example"], cluster: ["example"], severities: ["example"], isExposed: ["example"], reachability: ["example"], authentication: ["example"], verdict: ["example"], reachabilityResponseCode: ["example"], imageSource: ["example"], registryType: ["example"], registryName: ["example"], imageScanStatus: ["example"], artifactIds: ["example"] }, filterSearch: [ { fieldName: "example", value: ["example"] } ], owners: ["example"], tagIds: ["example"], search: "example", openItems: ["digest"], orderBy: { field: "example", direction: "ASC" }, topOffset: 42, scrollDirection: "example", cbomId: "example", cbomIds: ["example"] } } }) }) .then(response => response.json()) .then(result => console.log(JSON.stringify(result, null, 2))) .catch(error => console.error('Error:', error)); ``` {% endtab %} {% tab title="Python" %} ```python import requests query = 'query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps manualCheck response } resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } isAiAsset isTrainingData modelInfo { moduleName moduleVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args } dataAccess { name where matched } probeResults { url type statusCode curl connectedAsset { name cbomId } } } offset topOffset total totalFiltered selectedPosition } }' response = requests.post( "https://api.cloud.ox.security/api/apollo-gateway", headers={ "Content-Type": "application/json", "Authorization": "YOUR_API_TOKEN" }, json={ "query": query, # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory. "variables": { "cloudItemsInput": { "limit": 100, "offset": 0, "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99", "dateRange": { "from": 1749000000000, "to": 1749900000000 }, "filters": { "apps": ["example"], "service": ["example"], "type": ["example"], "cloudProvider": ["example"], "assetName": ["example"], "accountId": ["example"], "region": ["example"], "serviceCategory": ["example"], "cluster": ["example"], "severities": ["example"], "isExposed": ["example"], "reachability": ["example"], "authentication": ["example"], "verdict": ["example"], "reachabilityResponseCode": ["example"], "imageSource": ["example"], "registryType": ["example"], "registryName": ["example"], "imageScanStatus": ["example"], "artifactIds": ["example"] }, "filterSearch": [ { "fieldName": "example", "value": ["example"] } ], "owners": ["example"], "tagIds": ["example"], "search": "example", "openItems": ["digest"], "orderBy": { "field": "example", "direction": "ASC" }, "topOffset": 42, "scrollDirection": "example", "cbomId": "example", "cbomIds": ["example"] } } } ) if response.status_code == 200: result = response.json() print(result) else: print(f"Error: {response.status_code}") print(response.text) ``` {% endtab %} {% endtabs %} ### Arguments You can use the following argument(s) to customize your `getCloudItems` query. | Argument | Description | Supported fields | | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | cloudItemsInput [`CloudItemsInput`](/api-documentation/api-reference/api--cloud-security/types/inputs/cloud-items-input.md) | Parameters for filtering and paginating cloud security items |

limit Int
offset Int
scanId String
dateRange DateRange
filters CloudItemsFilters
filterSearch \[AutoCompleteSearch]
owners \[String]
tagIds \[String]
search String
openItems \[FilterTypes]
orderBy CloudItemsOrderBy
topOffset Int
scrollDirection String
cbomId String
cbomIds \[String]

| ### Fields Return type: [`CloudItemsResponse`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-items-response.md) You can use the following field(s) to specify what information your `getCloudItems` query will return. Please note that some fields may have their own subfields. | Field | Description | Supported fields | | ------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | cloudItems [`[CloudItem]`](/api-documentation/api-reference/api--cloud-security/types/objects/cloud-item.md) | List of cloud security items found |

id String
assetName String
service String
resourceId String
cbomId String
cbomProvider String
resourceType String
resourceName String
accountId String
firstSeen String
cloudProvider String
serviceCategory String
applications \[AppInfo]
isExposed String
isPermissiveIdentity Boolean
isHighPrivilege Boolean
isSensitiveData Boolean
contextFactors \[String]
imageSource String
registryType String
registryName String
imageScanStatus String
exposurePath \[ExposurePathItem]
accountName String
subService String
region String
resourceTags JSON
authenticationRequired Boolean
reachability CloudItemReachability
resourceArn String
images \[CloudItemImage]
relatedIssues Severities
issueSeverityBreakdown \[CloudIssueSeverityBreakdown]
issuesStats IssuesStats
cluster String
link String
imageHash String
workloads \[Workload]
artifactIds \[String]
attachedIdentities CbomAttachedIdentities
compliance \[CloudItemCompliance]
usageSeries CloudUsageSeries
isAiAsset Boolean
isTrainingData Boolean
modelInfo CloudModelInfo
trainingDataInfo CloudTrainingDataInfo
tools \[CloudTool]
dataAccess \[CloudDataAccess]
probeResults \[CloudProbeResult]

| | offset `Int` | Current pagination offset | | | topOffset `Int` | Top offset for advanced pagination | | | total `Int` | Total number of cloud items available | | | totalFiltered `Int` | Total number of cloud items after applying filters | | | selectedPosition `Int` | Position of the selected item in the results | | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ox.security/api-documentation/api-reference/api--cloud-security/queries/get-cloud-items.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.