getCloudItems

Retrieves cloud security items including cloud resources, containers, and their security posture.

Examples

GraphQL

query GetCloudItems($cloudItemsInput: CloudItemsInput) {
  getCloudItems(cloudItemsInput: $cloudItemsInput) {
    cloudItems {
      id
      assetName
      service
      resourceId
      cbomId
      cbomProvider
      resourceType
      resourceName
      accountId
      firstSeen
      lastRescanAt
      lastScannedAt
      serviceKey
      rescannable
      cloudProvider
      serviceCategory
      applications {
        id
        name
        type
      }
      isExposed
      isPermissiveIdentity
      isHighPrivilege
      isSensitiveData
      contextFactors
      imageSource
      registryType
      registryName
      imageScanStatus
      exposurePath {
        type
        name
        cbomId
      }
      accountName
      subService
      region
      resourceTags
      authenticationRequired
      reachability {
        confirmed
        responseCode
        authTagValue
        conclusion
        playbook
        steps
        response
      }
      verdict
      resourceArn
      images {
        name
        hashes {
          hash
          isFromRegistry
        }
        tags
      }
      relatedIssues {
        info
        low
        medium
        high
        critical
        appox
      }
      issueSeverityBreakdown {
        name
        severities {
          info
          low
          medium
          high
          critical
          appox
        }
      }
      issuesStats {
        totalIssues
        sourceTools {
          name
          total
        }
        categories {
          name
          total
        }
        severities {
          name
          total
        }
      }
      cluster
      link
      imageHash
      workloads {
        type
        namespace
        name
        cluster
        region
        isExposed
        consoleLink
        exposurePath {
          type
          name
          cbomId
        }
      }
      artifactIds
      attachedIdentities {
        users
        groups
        servicePrincipals
        serviceAccounts
        iamPolicies
        attachedResources
        trustedBy
      }
      compliance {
        checkId
        status
        frameworks
      }
      usageSeries {
        source
        countMetric
        tokenMetric
        windowDays
        daily {
          day
          count
          tokens
          countBuckets
          tokenBuckets
        }
      }
      usageCoverage
      isAiAsset
      isTrainingData
      modelInfo {
        modelName
        modelVersion
        vendor
        family
        modelClass
        where
        matched
      }
      trainingDataInfo {
        dataType
        location
        locationType
        locationPath
        storageType
      }
      tools {
        name
        type
        target
        where
        matched
        args
        probed
        skipReason
        injectionSignals
      }
      dataAccess {
        name
        where
        matched
        target
      }
      isMcpServer
      mcpServer {
        signals {
          signal
          where
          matched
        }
        tools {
          name
          type
          description
          args
        }
      }
      mcpDescription
      aiService {
        kind
        signals {
          signal
          where
          matched
        }
        capabilities {
          name
          type
          description
          tags
          target
          exposed
        }
        description
        provider
        protocolVersion
        endpoint
        declaresAuth
      }
      probeResults {
        url
        type
        statusCode
        curl
        connectedAsset {
          name
          cbomId
        }
        verdict
      }
    }
    offset
    topOffset
    total
    totalFiltered
    selectedPosition
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "cloudItemsInput": {
    "limit": 100,
    "offset": 0,
    "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
    "dateRange": {
      "from": 1749000000000,
      "to": 1749900000000
    },
    "filters": {
      "apps": ["example"],
      "service": ["example"],
      "type": ["example"],
      "cloudProvider": ["example"],
      "assetName": ["example"],
      "accountId": ["example"],
      "region": ["example"],
      "serviceCategory": ["example"],
      "cluster": ["example"],
      "severities": ["example"],
      "isExposed": ["example"],
      "reachability": ["example"],
      "authentication": ["example"],
      "verdict": ["example"],
      "reachabilityResponseCode": ["example"],
      "imageSource": ["example"],
      "registryType": ["example"],
      "registryName": ["example"],
      "imageScanStatus": ["example"],
      "contextFactors": ["example"],
      "assetClass": ["example"],
      "artifactIds": ["example"]
    },
    "filterSearch": [
      {
        "fieldName": "example",
        "value": ["example"]
      }
    ],
    "owners": ["example"],
    "tagIds": ["example"],
    "search": "example",
    "openItems": ["digest"],
    "orderBy": {
      "field": "example",
      "direction": "ASC"
    },
    "topOffset": 42,
    "scrollDirection": "example",
    "cbomId": "example",
    "cbomIds": ["example"]
  }
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen lastRescanAt lastScannedAt serviceKey rescannable cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps response } verdict resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } usageCoverage isAiAsset isTrainingData modelInfo { modelName modelVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args probed skipReason injectionSignals } dataAccess { name where matched target } isMcpServer mcpServer { signals { signal where matched } tools { name type description args } } mcpDescription aiService { kind signals { signal where matched } capabilities { name type description tags target exposed } description provider protocolVersion endpoint declaresAuth } probeResults { url type statusCode curl connectedAsset { name cbomId } verdict } } offset topOffset total totalFiltered selectedPosition } }",
 "variables": {
    "cloudItemsInput": {
      "limit": 100,
      "offset": 0,
      "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
      "dateRange": {
        "from": 1749000000000,
        "to": 1749900000000
      },
      "filters": {
        "apps": ["example"],
        "service": ["example"],
        "type": ["example"],
        "cloudProvider": ["example"],
        "assetName": ["example"],
        "accountId": ["example"],
        "region": ["example"],
        "serviceCategory": ["example"],
        "cluster": ["example"],
        "severities": ["example"],
        "isExposed": ["example"],
        "reachability": ["example"],
        "authentication": ["example"],
        "verdict": ["example"],
        "reachabilityResponseCode": ["example"],
        "imageSource": ["example"],
        "registryType": ["example"],
        "registryName": ["example"],
        "imageScanStatus": ["example"],
        "contextFactors": ["example"],
        "assetClass": ["example"],
        "artifactIds": ["example"]
      },
      "filterSearch": [
        {
          "fieldName": "example",
          "value": ["example"]
        }
      ],
      "owners": ["example"],
      "tagIds": ["example"],
      "search": "example",
      "openItems": ["digest"],
      "orderBy": {
        "field": "example",
        "direction": "ASC"
      },
      "topOffset": 42,
      "scrollDirection": "example",
      "cbomId": "example",
      "cbomIds": ["example"]
    }
  }
}'

Node.js

const query = 'query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen lastRescanAt lastScannedAt serviceKey rescannable cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps response } verdict resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } usageCoverage isAiAsset isTrainingData modelInfo { modelName modelVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args probed skipReason injectionSignals } dataAccess { name where matched target } isMcpServer mcpServer { signals { signal where matched } tools { name type description args } } mcpDescription aiService { kind signals { signal where matched } capabilities { name type description tags target exposed } description provider protocolVersion endpoint declaresAuth } probeResults { url type statusCode curl connectedAsset { name cbomId } verdict } } offset topOffset total totalFiltered selectedPosition } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      cloudItemsInput: {
        limit: 100,
        offset: 0,
        scanId: "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
        dateRange: {
          from: 1749000000000,
          to: 1749900000000
        },
        filters: {
          apps: ["example"],
          service: ["example"],
          type: ["example"],
          cloudProvider: ["example"],
          assetName: ["example"],
          accountId: ["example"],
          region: ["example"],
          serviceCategory: ["example"],
          cluster: ["example"],
          severities: ["example"],
          isExposed: ["example"],
          reachability: ["example"],
          authentication: ["example"],
          verdict: ["example"],
          reachabilityResponseCode: ["example"],
          imageSource: ["example"],
          registryType: ["example"],
          registryName: ["example"],
          imageScanStatus: ["example"],
          contextFactors: ["example"],
          assetClass: ["example"],
          artifactIds: ["example"]
        },
        filterSearch: [
          {
            fieldName: "example",
            value: ["example"]
          }
        ],
        owners: ["example"],
        tagIds: ["example"],
        search: "example",
        openItems: ["digest"],
        orderBy: {
          field: "example",
          direction: "ASC"
        },
        topOffset: 42,
        scrollDirection: "example",
        cbomId: "example",
        cbomIds: ["example"]
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'query GetCloudItems($cloudItemsInput: CloudItemsInput) { getCloudItems(cloudItemsInput: $cloudItemsInput) { cloudItems { id assetName service resourceId cbomId cbomProvider resourceType resourceName accountId firstSeen lastRescanAt lastScannedAt serviceKey rescannable cloudProvider serviceCategory applications { id name type } isExposed isPermissiveIdentity isHighPrivilege isSensitiveData contextFactors imageSource registryType registryName imageScanStatus exposurePath { type name cbomId } accountName subService region resourceTags authenticationRequired reachability { confirmed responseCode authTagValue conclusion playbook steps response } verdict resourceArn images { name hashes { hash isFromRegistry } tags } relatedIssues { info low medium high critical appox } issueSeverityBreakdown { name severities { info low medium high critical appox } } issuesStats { totalIssues sourceTools { name total } categories { name total } severities { name total } } cluster link imageHash workloads { type namespace name cluster region isExposed consoleLink exposurePath { type name cbomId } } artifactIds attachedIdentities { users groups servicePrincipals serviceAccounts iamPolicies attachedResources trustedBy } compliance { checkId status frameworks } usageSeries { source countMetric tokenMetric windowDays daily { day count tokens countBuckets tokenBuckets } } usageCoverage isAiAsset isTrainingData modelInfo { modelName modelVersion vendor family modelClass where matched } trainingDataInfo { dataType location locationType locationPath storageType } tools { name type target where matched args probed skipReason injectionSignals } dataAccess { name where matched target } isMcpServer mcpServer { signals { signal where matched } tools { name type description args } } mcpDescription aiService { kind signals { signal where matched } capabilities { name type description tags target exposed } description provider protocolVersion endpoint declaresAuth } probeResults { url type statusCode curl connectedAsset { name cbomId } verdict } } offset topOffset total totalFiltered selectedPosition } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "cloudItemsInput": {
        "limit": 100,
        "offset": 0,
        "scanId": "c9da693d-8906-4a32-93c9-2ffdb1cebb99",
        "dateRange": {
          "from": 1749000000000,
          "to": 1749900000000
        },
        "filters": {
          "apps": ["example"],
          "service": ["example"],
          "type": ["example"],
          "cloudProvider": ["example"],
          "assetName": ["example"],
          "accountId": ["example"],
          "region": ["example"],
          "serviceCategory": ["example"],
          "cluster": ["example"],
          "severities": ["example"],
          "isExposed": ["example"],
          "reachability": ["example"],
          "authentication": ["example"],
          "verdict": ["example"],
          "reachabilityResponseCode": ["example"],
          "imageSource": ["example"],
          "registryType": ["example"],
          "registryName": ["example"],
          "imageScanStatus": ["example"],
          "contextFactors": ["example"],
          "assetClass": ["example"],
          "artifactIds": ["example"]
        },
        "filterSearch": [
          {
            "fieldName": "example",
            "value": ["example"]
          }
        ],
        "owners": ["example"],
        "tagIds": ["example"],
        "search": "example",
        "openItems": ["digest"],
        "orderBy": {
          "field": "example",
          "direction": "ASC"
        },
        "topOffset": 42,
        "scrollDirection": "example",
        "cbomId": "example",
        "cbomIds": ["example"]
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your getCloudItems query.

Argument	Description	Supported fields
cloudItemsInput CloudItemsInput	Parameters for filtering and paginating cloud security items	limit Int offset Int scanId String dateRange DateRange filters CloudItemsFilters filterSearch [AutoCompleteSearch] owners [String] tagIds [String] search String openItems [FilterTypes] orderBy CloudItemsOrderBy topOffset Int scrollDirection String cbomId String cbomIds [String]

Fields

Return type: CloudItemsResponse

You can use the following field(s) to specify what information your getCloudItems query will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
cloudItems [CloudItem]	List of cloud security items found	id String assetName String service String resourceId String cbomId String cbomProvider String resourceType String resourceName String accountId String firstSeen String lastRescanAt String lastScannedAt String serviceKey String rescannable Boolean cloudProvider String serviceCategory String applications [AppInfo] isExposed String isPermissiveIdentity Boolean isHighPrivilege Boolean isSensitiveData Boolean contextFactors [String] imageSource String registryType String registryName String imageScanStatus String exposurePath [ExposurePathItem] accountName String subService String region String resourceTags JSON authenticationRequired Boolean reachability CloudItemReachability verdict String resourceArn String images [CloudItemImage] relatedIssues Severities issueSeverityBreakdown [CloudIssueSeverityBreakdown] issuesStats IssuesStats cluster String link String imageHash String workloads [Workload] artifactIds [String] attachedIdentities CbomAttachedIdentities compliance [CloudItemCompliance] usageSeries CloudUsageSeries usageCoverage String isAiAsset Boolean isTrainingData Boolean modelInfo CloudModelInfo trainingDataInfo CloudTrainingDataInfo tools [CloudTool] dataAccess [CloudDataAccess] isMcpServer Boolean mcpServer CloudMcpServer mcpDescription String aiService CloudAiService probeResults [CloudProbeResult]
offset Int	Current pagination offset
topOffset Int	Top offset for advanced pagination
total Int	Total number of cloud items available
totalFiltered Int	Total number of cloud items after applying filters
selectedPosition Int	Position of the selected item in the results