AI Defense Activity GraphQL API types¶

Every named type reachable from a query or mutation in this schema, grouped by kind.

Jump to: Objects · Enums · Input objects · Scalars

Objects¶

`Actor`¶

Entity (typically a user) that performed an activity.

Fields¶

Field	Type	Description
`name`	`String!`	Display name of the actor.
`type`	`ActorType!`	Kind of actor.
`id`	`String!`	Public actor id: the stable actor identifier (e.g. a user SID) when resolved, otherwise an opaque temporary id derived from the actor's name and type.

`AiModel`¶

The concrete LLM model used in this activity. Null when undeterminable.

Fields¶

Field	Type	Description
`id`	`String!`	Stable model identifier from the provider API (e.g. 'gpt-4o-2024-08-06'). Empty when not reported.
`name`	`String!`	Human-readable model name (e.g. 'GPT-4o', 'Claude Sonnet'). Empty when not reported.
`version`	`String!`	Model version identifier. Empty when not reported.

`Application`¶

AI application accessed during an activity (e.g. ChatGPT, Claude, Cursor). Includes the application's stable identity and the catalog attributes available for the activity.

Fields¶

Field	Type	Description
`id`	`String!`	Stable application identifier (slug).
`name`	`String!`	`Application` display name.
`categories`	`[String!]!`	Primary application categories (functional use cases — e.g. 'general_assistant', 'code_assistant').
`trainingPolicies`	`[String!]!`	Training-data policies (e.g. 'opt_out_available', 'no_training', 'enterprise_no_training').
`compliance`	`[String!]!`	Compliance certifications (e.g. 'soc2_type2', 'gdpr_compliant').

`ApplicationProvider`¶

Company that owns/ships the AI application (e.g. OpenAI for ChatGPT, Anthropic for Claude, Cursor Inc. for Cursor). Sourced from the AI Defense provider catalog. Distinct from ModelProvider, which describes the LLM-serving org for an individual activity.

Fields¶

Field	Type	Description
`id`	`String!`	Stable provider identifier (slug).
`name`	`String!`	Provider display name (e.g. 'OpenAI', 'Anthropic').

`Device`¶

Endpoint device on which an activity was observed.

Fields¶

Field	Type	Description
`id`	`String!`	Unique device identifier.
`type`	`DeviceType!`	`Device` kind.
`platform`	`DevicePlatform!`	`Device` operating-system platform.
`name`	`String!`	`Device` display name. Empty when not resolved.

`ModelProvider`¶

Company providing the LLM used for inference in this specific activity. Distinct from ApplicationProvider: for first-party apps (ChatGPT) they coincide; for model-agnostic apps (Cursor) the activity's modelProvider may differ from the application's provider — or be null when the provider can't be determined.

Fields¶

Field	Type	Description
`name`	`String!`	Model provider name (e.g. 'OpenAI', 'Anthropic').

`PageInfo`¶

Cursor-based pagination metadata following the Relay Connections spec.

Fields¶

Field	Type	Description
`hasNextPage`	`Boolean!`	True if more results exist after the current page.
`hasPreviousPage`	`Boolean!`	True if results exist before the current page.
`startCursor`	`String`	Cursor of the first item in the current page, if any.
`endCursor`	`String`	Cursor of the last item in the current page, if any.

`SecureAIAppInventoryEntry`¶

One AI application in the tenant inventory.

Fields¶

Field	Type	Description
`id`	`ID!`	Stable AI app identifier for the grouped app.
`name`	`String!`	Human-readable AI app name (e.g. 'ChatGPT', 'Claude').
`provider`	`String!`	AI service provider/vendor (e.g. 'OpenAI', 'Anthropic').
`risk`	`RiskLevel!`	Risk classification for the app.
`trainingPolicy`	`String`	Whether this provider uses customer input data to train or improve models.
`trainsOnUserData`	`Boolean`	True when `trainingPolicies` indicates training by default (`trains_on_input` or `opt_out_available`); false for known no-training policies; null when unknown or ambiguous.
`complianceCertificates`	`[String!]!`	Compliance certifications the AI app holds.
`categories`	`[String!]!`	Functional categories describing the AI application.
`trainingPolicies`	`[String!]!`	Training policies for this provider.
`usage`	`Int64!`	Total number of `activities`/events for this app in the time window.
`uniqueUsers`	`Int64!`	Distinct users that interacted with this app in the time window.
`lastSeen`	`Time`	Most recent `activity` timestamp for this app in the time window. Null when the app has no observed `activity` in the window (catalog-only entry).
`unsanctionedCount`	`Int64!`	Number of this app's `activities` in the time window that are unsanctioned.

`SecureAIAppInventoryPage`¶

Offset/limit paginated list of inventory entries returned by Query.appInventory``.

Fields¶

Field	Type	Description
`entries`	`[SecureAIAppInventoryEntry!]!`	Entries on the current page.
`totalCount`	`Int64!`	Total number of entries matching the current filter across all pages.
`offset`	`Int64!`	Zero-based offset applied to this page after filtering and sorting.
`limit`	`Int64!`	Maximum number of entries requested for this page, after server-side capping.
`hasNextPage`	`Boolean!`	True if more results exist after the current offset/limit window.
`hasPreviousPage`	`Boolean!`	True if results exist before the current offset.

`SecureAIAppInventorySummary`¶

Aggregate counts for AI applications in the inventory window.

Fields¶

Field	Type	Description
`totalApps`	`Int64!`	Total number of AI applications observed in the window.
`criticalRisk`	`Int64!`	Apps whose Secure AI catalog risk band is CRITICAL.
`highRisk`	`Int64!`	Apps whose Secure AI catalog risk band is HIGH.
`mediumRisk`	`Int64!`	Apps whose Secure AI catalog risk band is MEDIUM.
`lowRisk`	`Int64!`	Apps whose Secure AI catalog risk band is LOW.
`infoRisk`	`Int64!`	Apps whose Secure AI catalog risk band is INFO.
`unknownRisk`	`Int64!`	Apps explicitly classified UNKNOWN. Always zero on a successful response.
`errorRisk`	`Int64!`	Apps whose Secure AI catalog risk could not be resolved.
`trainsOnData`	`Int64`	Number of AI applications known to train on user data, including apps that train by default with an opt-out available.
`unsanctionedCount`	`Int64!`	Number of apps with at least one unsanctioned (NOT_COVERED and allowed) `activity` in the window.

`SecureAIInventorySummary`¶

Combined inventory summary for apps and users.

Fields¶

Field	Type	Description
`apps`	`SecureAIAppInventorySummary!`	`Application` inventory aggregate counts.
`users`	`SecureAIUserInventorySummary!`	User inventory aggregate counts.

`SecureAIOrganizationDetails`¶

Organization-details selections captured during onboarding.

Fields¶

Field	Type	Description
`role`	`String`	The user's role in the organization.
`numberOfUsers`	`String`	User-count range bucket (e.g. 1-50, 51-200).
`aiFamiliarity`	`String`	Self-reported familiarity with AI tools (none/basic/intermediate/advanced).
`industry`	`String`	The organization's industry/sector.

`SecureAIProductIntegration`¶

Product-integration selections captured during onboarding — fields grow additively.

Fields¶

Field	Type	Description
`acknowledgedCheckKeys`	`[String!]!`	Keys of the product-integration readiness checks the user has acknowledged.
`selectedProductKeys`	`[ProductKey!]`	Products the user picked on the `Sensor` Selector onboarding step (see `ProductKey`). Null until the step has been captured; an empty list means the user visited the step without selecting anything.

`SecureAITenantOnboarding`¶

The onboarding portion of a tenant's settings: status plus captured selections.

Fields¶

Field	Type	Description
`status`	`SecureAITenantOnboardingStatus!`	Onboarding status. COMPLETED means onboarding is finished.
`selections`	`SecureAITenantOnboardingSelections`	Selections captured across the onboarding flow. Null until anything is captured.

`SecureAITenantOnboardingSelections`¶

All onboarding selections a tenant has captured. Each field is a step's typed selection and is null until that step captures input.

Fields¶

Field	Type	Description
`organizationDetails`	`SecureAIOrganizationDetails`	Organization-details selections. Null until captured.
`productIntegration`	`SecureAIProductIntegration`	Product-integration selections. Null until captured.
`passedStepKeys`	`[String!]!`	Keys of onboarding steps the user has advanced past via Continue. Grows monotonically during the flow; entries are pruned when a step's key drops from the composed flow (e.g. deselecting a sensor removes its setup step). Empty for tenants who haven't advanced any step yet.

`SecureAITenantSettings`¶

Persisted AI Defense settings for the calling tenant. Onboarding today; extended with new fields as more tenant settings land.

Fields¶

Field	Type	Description
`onboarding`	`SecureAITenantOnboarding!`	Onboarding portion of the tenant's settings.
`licenseState`	`SecureAILicenseState`	License lifecycle state, independent of onboarding progress. Null until the license is synced for this tenant.
`gracePeriodEndsAt`	`Time`	When the current grace period ends. Null when not in a grace period.
`licenseExpiryDate`	`Time`	The underlying license's expiry date. Null if not tracked/known.
`licenseType`	`String`	License type when known/retained by the sync source (e.g. TRIAL). Null if not tracked.
`licenseId`	`String`	Identifier of the license record, when known/retained by the sync source. Null if not tracked.
`refreshedAt`	`Time`	When the license details were last fetched. Null until the first successful fetch.
`renewalPending`	`Boolean!`	True when a license renewal has been detected (a genuinely different license than before) that is not acknowledged yet. False both when there is no pending renewal and when the license has never been synced for this tenant.
`createdBy`	`String!`	Opaque subject ID of the creator (server-set from the JWT, never input).
`createdByType`	`SecureAIAuditActorType!`	Audit classification of the creator, derived from auth metadata when available.
`updatedBy`	`String`	Opaque subject ID of the last editor. Null until the first update.
`updatedByType`	`SecureAIAuditActorType`	Audit classification of the last editor. Null until the first update.
`createdAt`	`Time!`	When the settings record was first created.
`updatedAt`	`Time!`	When the settings record was last updated.

`SecureAITimestamp`¶

Time interval associated with an observed activity.

Fields¶

Field	Type	Description
`startTime`	`Time!`	Inclusive start of the `activity` interval.
`endTime`	`Time!`	Inclusive end of the `activity` interval.

`SecureAIUserApp`¶

A single AI application a specific user interacted with, returned by userApps. Lightweight reference (identity, provider, risk) — one entry for each app counted in a user inventory entry's appsUsed.

Fields¶

Field	Type	Description
`id`	`ID!`	Stable AI app identifier.
`name`	`String!`	Display name of the AI app.
`provider`	`String!`	AI service provider/vendor (e.g. 'OpenAI', 'Anthropic'). Empty when unknown.
`risk`	`RiskLevel!`	Risk classification for the app.
`usage`	`Int64!`	Number of this user's `activities` with this app in the time window.
`policyViolations`	`Int64!`	Number of this user's `activities` with this app where the security infrastructure took a non-allowed action.
`notCoveredCount`	`Int64!`	Number of this user's `activities` with this app in the time window that are unsanctioned (not covered by a policy and allowed).
`firstUsed`	`Time`	First observed `activity` timestamp for this user with this app in the time window.
`lastUsed`	`Time`	Most recent `activity` timestamp for this user with this app in the time window.

`SecureAIUserAppsPage`¶

Offset/limit paginated list of one user's apps returned by Query.userApps``.

Fields¶

Field	Type	Description
`entries`	`[SecureAIUserApp!]!`	Entries on the current page.
`totalCount`	`Int64!`	Total number of apps the user used across all pages.
`offset`	`Int64!`	Zero-based offset applied to this page after sorting.
`limit`	`Int64!`	Maximum number of entries requested for this page, after server-side capping.
`hasNextPage`	`Boolean!`	True if more results exist after the current offset/limit window.
`hasPreviousPage`	`Boolean!`	True if results exist before the current offset.

`SecureAIUserInventoryEntry`¶

One user in the tenant inventory, grouped by stable actor id or, when that is missing, by actor name and type. Activities with neither an actor id nor an actor name are excluded. Shape follows the Top Users aggregation but removes trend fields — inventory is "who is using AI", not "who is trending".

Fields¶

Field	Type	Description
`id`	`String!`	Public actor id: the stable actor identifier (e.g. a user SID) when resolved, otherwise an opaque temporary id derived from the actor's name and type. Matches `ActivityFilter.actorIds`, defines the inventory row's grouping identity, and can be used to drill down into the user's `activity`.
`name`	`String!`	Most-common non-empty actor name observed for this id, typically an email address.
`risk`	`RiskLevel!`	Worst-observed full-fidelity risk classification for the user over the time window.
`appsUsed`	`Int64!`	Number of distinct AI applications used by this user in the time window. Use the `userApps` query to page the actual app breakdown for one user.
`usage`	`Int64!`	Total number of this user's `activities` in the time window.
`policyViolations`	`Int64!`	Number of `activities` where the security infrastructure took a non-allowed action against the user.
`topAppId`	`ID`	Stable id of the AI app the user interacted with most often in the time window. Null when the user has no `activity` with a usable app identifier.
`topApp`	`String`	Name of the AI app the user interacted with most often in the time window. Null when the user has no `activity` carrying a usable app participant.
`firstSeen`	`Time`	First observed `activity` timestamp for this user in the time window.
`lastSeen`	`Time`	Most recent `activity` timestamp for this user in the time window.
`unsanctionedCount`	`Int64!`	Number of this user's `activities` in the time window that are unsanctioned.

`SecureAIUserInventoryPage`¶

Offset/limit paginated list of inventory entries returned by Query.userInventory``.

Fields¶

Field	Type	Description
`entries`	`[SecureAIUserInventoryEntry!]!`	Entries on the current page.
`totalCount`	`Int64!`	Total number of entries matching the current filter across all pages.
`offset`	`Int64!`	Zero-based offset applied to this page after filtering and sorting.
`limit`	`Int64!`	Maximum number of entries requested for this page, after server-side capping.
`hasNextPage`	`Boolean!`	True if more results exist after the current offset/limit window.
`hasPreviousPage`	`Boolean!`	True if results exist before the current offset.

`SecureAIUserInventorySummary`¶

Aggregate counts for actors represented in the user inventory window. An actor is eligible when both its stable ID and display name are present, regardless of actor type, and is grouped by stable ID. Each eligible actor is counted once under its worst-observed risk level, so the six per-level counts sum to totalUsers.

Fields¶

Field	Type	Description
`totalUsers`	`Int64!`	Total number of distinct eligible actor IDs observed in the window.
`criticalRisk`	`Int64!`	Users whose worst-observed risk level is CRITICAL.
`highRisk`	`Int64!`	Users whose worst-observed risk level is HIGH.
`mediumRisk`	`Int64!`	Users whose worst-observed risk level is MEDIUM.
`lowRisk`	`Int64!`	Users whose worst-observed risk level is LOW.
`infoRisk`	`Int64!`	Users whose worst-observed risk level is INFO.
`unknownRisk`	`Int64!`	Users whose worst-observed risk level is UNKNOWN (severity undetermined).
`withViolations`	`Int64!`	Number of observed users with at least one blocked, modified, or warned `activity`.
`unsanctionedCount`	`Int64!`	Number of users with at least one unsanctioned (NOT_COVERED and allowed) `activity` in the window.

`SecureAiActivity`¶

A single observed Secure AI activity event.

Fields¶

Field	Type	Description
`id`	`ID!`	Unique `activity` identifier.
`timestamp`	`SecureAITimestamp!`	`Time` interval the `activity` covered.
`actor`	`Actor!`	`Actor` that performed the `activity`.
`application`	`Application!`	AI application accessed during the `activity` (always present, derived from the HOST participant).
`applicationProvider`	`ApplicationProvider`	Company that owns/ships the application. Null when the provider can't be determined for the `activity`.
`modelProvider`	`ModelProvider`	Company providing the LLM used in this `activity`. Null when undeterminable (e.g. Cursor).
`model`	`AiModel`	Concrete LLM model used in this `activity`. Null when undeterminable.
`sensors`	`[Sensor!]!`	Sensors that observed the `activity`.
`action`	`Action`	Enforcement action applied. Null if the source did not report one.
`policyId`	`String`	Stable identifier of the policy that produced the action. Null for older `activities` that do not record it. Use this for filtering. Use `policy` as the human-readable name.
`policy`	`String!`	Name of the policy that produced the action. Empty string when not populated.
`device`	`Device!`	Endpoint device on which the `activity` was observed.
`risk`	`RiskLevel!`	Risk classification for the `activity` (full-fidelity severity).
`appRisk`	`AppRisk!`	App-level risk signal (SAFE/CHECK_POLICY/DANGEROUS), derived from `risk`.
`additionalData`	`JSON!`	Per-`activity` enrichment signals: * `sourceAddresses` — originating IP(s) observed for the `activity`. Get-only: populated by the single-`activity` query (`Query.`activity`(id)`); the list query (`Query.`activities`) clears this field and returns an empty object to keep list responses small. Use the single-activity` query to fetch enrichment.
`aggregationCount`	`Int64!`	Number of correlated telemetry records assembled into this `activity`. Minimum 1.
`isUnsanctioned`	`Boolean!`	True when no policy covers the AI app for the tenant and the `activity` was allowed. False for covered apps, for uncovered `activity` that was warned, blocked, or modified, and for unclassified `activity`.

`SecureAiActivityConnection`¶

Relay-style paginated list of activities returned by Query.activities``.

Fields¶

Field	Type	Description
`activities`	`[SecureAiActivity!]!`	Activities on the current page.
`pageInfo`	`PageInfo!`	Cursor pagination metadata.
`totalCount`	`Int64!`	Total number of `activities` matching the current filter across all pages.

`Sensor`¶

Sensor that observed an activity.

Fields¶

Field	Type	Description
`id`	`String!`	Unique sensor identifier.
`name`	`String!`	`Sensor` display name.
`type`	`SensorType`	Normalized sensor category when classified; null when missing or unclassified in source data.
`vendor`	`String!`	`Sensor` vendor (e.g. 'Sophos'). Empty when not reported.

Enums¶

`Action`¶

Outcome of policy enforcement applied to an AI activity.

Values¶

Value	Description
`UNKNOWN`	Source did not report an enforcement action.
`ALLOWED`	Activity was permitted by policy.
`BLOCKED`	Activity was blocked by policy.
`WARNED`	Activity was permitted but the user was shown a warning.
`MODIFIED`	Activity was permitted with content modification.

`ActorType`¶

Type of actor that performed an activity.

Values¶

Value	Description
`UNKNOWN`	`Actor` type was not reported or could not be resolved.
`SYSTEM`	OS or platform-level actor (e.g. kernel, service host).
`SERVICE`	Service account or daemon.
`USER`	Human user.
`PROCESS`	Running process — Actor`.name` is the executable name,Actor`.id` is the process UUID.
`NETWORK_ENTITY`	Non-user network entity — Actor`.name` is a hostname or IP;Actor`.id` is a stable host id or `address:port`.

`AppRisk`¶

3-state app-risk signal (SAFE / CHECK_POLICY / DANGEROUS) surfaced on `SecureAiActivity.appRisk. Derived from theactivity's runtimerisk`: HIGH/CRITICAL → DANGEROUS, MEDIUM/UNKNOWN → CHECK_POLICY, INFO/LOW → SAFE.

Values¶

Value	Description
`SAFE`	Risk is below the review threshold (INFO/LOW).
`CHECK_POLICY`	Severity is borderline or undetermined (MEDIUM/UNKNOWN) — review policy.
`DANGEROUS`	Elevated risk (HIGH/CRITICAL).

`DevicePlatform`¶

Operating-system platform on which an activity was observed.

Values¶

Value	Description
`WINDOWS`
`LINUX`
`MACOS`
`IOS`
`ANDROID`
`UNKNOWN`

`DeviceType`¶

Endpoint device kind on which an activity was observed.

Values¶

Value	Description
`COMPUTER`
`SERVER`
`SECURITY_VM`
`UNKNOWN`

`ProductKey`¶

Product the user selected on the onboarding Sensor Selector step — not SensorType, since Server has no telemetry counterpart. ENDPOINT/FIREWALL reuse SensorType's string values.

Values¶

Value	Description
`ENDPOINT`
`FIREWALL`
`SERVER`

`ReportRelativeTimeFramePeriodV2`¶

Reuses the platform-wide ReportRelativeTimeFramePeriodV2 enum defined by report-service / reporting-api so that Apollo Federation merges cleanly.

Values¶

Value	Description
`SINCE_BEGINNING_OF_DAY`	Midnight UTC of the current day to now.
`SINCE_BEGINNING_OF_WEEK_SUNDAY`	Most recent Sunday 00:00 UTC to now.
`SINCE_BEGINNING_OF_WEEK_MONDAY`	Most recent Monday 00:00 UTC to now.
`SINCE_BEGINNING_OF_MONTH`	First day of the current month 00:00 UTC to now.
`SINCE_BEGINNING_OF_QUARTER`	First day of the current quarter 00:00 UTC to now.
`SINCE_BEGINNING_OF_YEAR`	First day of the current year 00:00 UTC to now.
`LAST_MONTH`	Entirety of the previous calendar month.
`LAST_QUARTER`	Entirety of the previous calendar quarter.
`LAST_YEAR`	Entirety of the previous calendar year.

`RiskLevel`¶

Risk classification shared across Secure AI activities, top apps, top users, the inventory views, and the AI Risk Assessment reports.

Values¶

Value	Description
`UNKNOWN`	Risk was not classified.
`INFO`	Informational only.
`LOW`	Low risk.
`MEDIUM`	Medium risk.
`HIGH`	High risk.
`CRITICAL`	Critical risk.
`ERROR`	The Secure AI catalog risk lookup could not resolve a usable risk for this app.

`SecureAIAppInventorySortField`¶

Field by which Query.appInventory`` can be sorted.

Values¶

Value	Description
`NAME`	Sort by app name.
`RISK`	Sort by risk level.
`USAGE`	Sort by `activity` volume in the window.
`UNIQUE_USERS`	Sort by distinct user count in the window.
`LAST_SEEN`	Sort by most recent observed `activity` timestamp.
`UNSANCTIONED_COUNT`	Sort by unsanctioned `activity` count in the window.
`TRAINS_ON_USER_DATA`	Sort by whether the app trains on user data.

`SecureAIAuditActorType`¶

Audit classification derived from authentication metadata.

Values¶

Value	Description
`UNKNOWN`
`INTERNAL`
`EXTERNAL`

`SecureAILicenseState`¶

License lifecycle state for the tenant's Secure AI entitlement, independent of onboarding progress. Set by Sophos from the tenant's license. API calls cannot change it.

Values¶

Value	Description
`ACTIVE`
`GRACE_PERIOD`
`EXPIRED`

`SecureAISortField`¶

Field by which Query.activities`` can be sorted.

Values¶

Value	Description
`TIMESTAMP`	Sort by `activity` timestamp.
`ACTION`	Sort by enforcement action.
`ACTOR_NAME`	Sort by actor name.
`PROVIDER_NAME`	Sort by provider name.
`DEVICE_NAME`

`SecureAISortOrder`¶

Sort direction.

Values¶

Value	Description
`ASC`	Ascending order.
`DESC`	Descending order.

`SecureAITenantOnboardingStatus`¶

Tenant onboarding status. COMPLETED means onboarding is finished.

Values¶

Value	Description
`NOT_STARTED`
`IN_PROGRESS`
`COMPLETED`

`SecureAIUserAppsSortField`¶

Field to sort a userApps result by.

Values¶

Value	Description
`USAGE`	Sort by the number of the user's `activities` with the app (default).
`NAME`	Sort by app display name.
`RISK`	Sort by app worst-observed risk level.
`POLICY_VIOLATIONS`	Sort by policy violation count in the window.
`NOT_COVERED_COUNT`	Sort by unsanctioned (shadow AI) `activity` count in the window.
`FIRST_USED`	Sort by first observed `activity` timestamp with the app.
`LAST_USED`	Sort by most recent observed `activity` timestamp with the app.

`SecureAIUserInventorySortField`¶

Field by which Query.userInventory`` can be sorted.

Values¶

Value	Description
`NAME`	Sort by user name.
`RISK`	Sort by risk level.
`APPS_USED`	Sort by apps used.
`USAGE`	Sort by `activity` volume in the window.
`LAST_SEEN`	Sort by most recent observed `activity` timestamp.
`UNSANCTIONED_COUNT`	Sort by unsanctioned `activity` count in the window.
`POLICY_VIOLATIONS`	Sort by policy violation count in the window.

`SensorType`¶

Enforcement sensor category. Null on `Sensor.type` when the source value is missing or unclassified.

Values¶

Value	Description
`ENDPOINT`	Sophos Endpoint Web Control.
`FIREWALL`	SFOS web filtering.
`DNS`	DNS Protection (SWG).
`BROWSER`	Protected Browser.

Input objects¶

`SecureAIAppInventoryFilter`¶

Filter predicates for Query.appInventory`. All fields are AND-combined. Mirrors the filter shape of [SecureAiActivityFilter`] but scoped to the per-app inventory dimensions.

Fields¶

Field	Type	Description
`search`	`String`	Case-insensitive literal substring match against app id, name, or provider. Blank input applies no constraint.
`riskLevels`	`[RiskLevel!]`	Match apps with at least one of these risk levels.
`categories`	`[String!]`	Match apps with at least one of these application categories.
`complianceCertificates`	`[String!]`	Match apps with at least one of these compliance certifications.
`trainingPolicies`	`[String!]`	Match apps with at least one of these training policies.
`trainsOnUserData`	`Boolean`	When true, match apps whose trainingPolicies indicate training by default (`trains_on_input` or `opt_out_available`); when false, match apps with known no-training policies.
`appId`	`String`	Match apps by their exact id.
`isUnsanctioned`	`Boolean`	When true, match only apps with at least one unsanctioned (NOT_COVERED and allowed) `activity`; when false, match only sanctioned apps. Omit for no filter.
`timeRange`	`SecureAITimeRange`	Provide absolute times or a relative preset. Default cannot live on the `relative` field itself because it would auto-fill when only startTime/endTime is provided, triggering the mutual-exclusivity error. Default: `{relative: SINCE_BEGINNING_OF_DAY}`.

`SecureAIAppInventorySortInput`¶

Sort specification for Query.appInventory`` — field and direction.

Fields¶

Field	Type	Description
`field`	`SecureAIAppInventorySortField!`	Field to sort by.
`order`	`SecureAISortOrder!`	Sort direction. Defaults to descending. Default: `DESC`.

`SecureAIInventorySummaryFilter`¶

Filter predicates for Query.inventorySummary``.

Fields¶

Field	Type	Description
`timeRange`	`SecureAITimeRange`	Default: `{relative: SINCE_BEGINNING_OF_DAY}`.

`SecureAIOrganizationDetailsInput`¶

Organization-details selections to persist.

Fields¶

Field	Type	Description
`role`	`String`
`numberOfUsers`	`String`
`aiFamiliarity`	`String`
`industry`	`String`

`SecureAIProductIntegrationInput`¶

Product-integration selections to persist.

Fields¶

Field	Type	Description
`acknowledgedCheckKeys`	`[String!]!`
`selectedProductKeys`	`[ProductKey!]`	Products the user picked on the `Sensor` Selector onboarding step (see `ProductKey`). Omit or send null to leave unset; empty list means visited-but-no-selection.

`SecureAITenantOnboardingInput`¶

Onboarding section of a settings update: the new status and current selections.

Fields¶

Field	Type	Description
`status`	`SecureAITenantOnboardingStatus!`
`selections`	`SecureAITenantOnboardingSelectionsInput`
`basePolicy`	`SecureAIPolicyDefinition`	Base policy to create when completing onboarding for a tenant that has none: a PolicyCreateInput whose kind must be TENANT_BASE. Accepted only with status COMPLETED and never persisted with the settings. With this set, the base policy is created with createPolicy before completion is recorded. When omitted, completion is recorded without checking for a base policy. On failure the status is not changed and the error carries extensions.code: - BASE_POLICY_REQUIRED: reserved; not returned while omitted definitions skip the base policy check. - BASE_POLICY_REJECTED: createPolicy rejected the request; the message and extensions.upstreamErrors ([{message, code}]) carry its errors verbatim.

`SecureAITenantOnboardingSelectionsInput`¶

Full replacement set of onboarding selections. Omit a field to leave it empty.

Fields¶

Field	Type	Description
`organizationDetails`	`SecureAIOrganizationDetailsInput`
`productIntegration`	`SecureAIProductIntegrationInput`
`passedStepKeys`	`[String!]`	Full replacement set of passed step keys. Omit (or send null) to leave the persisted value unchanged; send an empty list to clear.

`SecureAITimeRange`¶

Time range filter for activities. When omitted, the API defaults to SINCE_BEGINNING_OF_DAY. Provide either absolute times (startTime/endTime) or a relative preset — not both. Using both returns a validation error.

Fields¶

Field	Type	Description
`startTime`	`Time`	Absolute start time. Cannot be combined with `relative`.
`endTime`	`Time`	Absolute end time. Cannot be combined with `relative`.
`relative`	`ReportRelativeTimeFramePeriodV2`	Relative preset (e.g. SINCE_BEGINNING_OF_DAY). Cannot be combined with startTime/endTime.

`SecureAIUpdateTenantSettingsInput`¶

Settings to update for the calling tenant. Each section is optional so a caller can update just the parts it owns; an omitted section is left untouched. Today only onboarding exists.

Fields¶

Field	Type	Description
`onboarding`	`SecureAITenantOnboardingInput`

`SecureAIUserAppsFilter`¶

Filter predicates for Query.userApps``. All fields are AND-combined.

Fields¶

Field	Type	Description
`search`	`String`	Case-insensitive literal substring match against app id, name, or provider. Blank input applies no constraint.
`riskLevels`	`[RiskLevel!]`	Match apps with at least one of these risk levels.
`hasPolicyViolations`	`Boolean`	When true, match only apps with at least one policy violation for this user; when false, match only apps with none. Omit for no filter.
`hasNotCoveredCount`	`Boolean`	When true, match only apps with at least one unsanctioned (NOT_COVERED and allowed) `activity` for this user; when false, match only apps with none. Omit for no filter.
`timeRange`	`SecureAITimeRange`	Provide absolute times or a relative preset. Default cannot live on the `relative` field itself because it would auto-fill when only startTime/endTime is provided, triggering the mutual-exclusivity error. Default: `{relative: SINCE_BEGINNING_OF_DAY}`.

`SecureAIUserAppsSortInput`¶

Sort specification for Query.userApps`` — field and direction.

Fields¶

Field	Type	Description
`field`	`SecureAIUserAppsSortField!`	Field to sort by.
`order`	`SecureAISortOrder!`	Sort direction. Defaults to descending. Default: `DESC`.

`SecureAIUserInventoryFilter`¶

Filter predicates for Query.userInventory``. All fields are AND-combined.

Fields¶

Field	Type	Description
`search`	`String`	Case-insensitive literal substring match against user id or name. Blank input applies no constraint.
`riskLevels`	`[RiskLevel!]`	Match users with at least one of these risk levels.
`topAppIds`	`[ID!]`	Match users whose derived top app id is one of these values.
`usedAppIds`	`[ID!]`	Match users who used at least one of these AI apps in the window, regardless of whether it is their top app. Use it to list the users of an app. Unlike `topAppIds`, this matches any app the user touched, and the matched-user count equals the app's unique-user total.
`isUnsanctioned`	`Boolean`	When true, match only users with at least one unsanctioned (NOT_COVERED and allowed) `activity`; when false, match only sanctioned users. Omit for no filter.
`timeRange`	`SecureAITimeRange`	Provide absolute times or a relative preset. Default cannot live on the `relative` field itself because it would auto-fill when only startTime/endTime is provided, triggering the mutual-exclusivity error. Default: `{relative: SINCE_BEGINNING_OF_DAY}`.

`SecureAIUserInventorySortInput`¶

Sort specification for Query.userInventory`` — field and direction.

Fields¶

Field	Type	Description
`field`	`SecureAIUserInventorySortField!`	Field to sort by.
`order`	`SecureAISortOrder!`	Sort direction. Defaults to descending. Default: `DESC`.

`SecureAiActivityFilter`¶

Filter predicates for Query.activities`. All fields are AND-combined; within an array, values are OR-combined (IN`-clause semantics). An empty/null array applies no constraint.

Fields¶

Field	Type	Description
`search`	`String`	Case-insensitive literal substring match across `activity` id, application id/name, application-provider id/name, model id/name/provider, actor id/name, device id/name, and policy name. The search fields are OR-combined; this predicate remains AND-combined with every other filter field. Blank input applies no constraint.
`actorType`	`ActorType`	Match against actor type.
`modelProviderName`	`String`	Match against the model provider name (e.g. 'OpenAI', 'Anthropic') — the LLM-serving org.
`applicationCategories`	`[String!]`	Match against application's category list. Matches `activities` whose application has any of these.
`applicationCompliance`	`[String!]`	Match against application's compliance posture.
`applicationTrainingPolicies`	`[String!]`	Match against application's training policies. Matches `activities` having any of the given policies.
`sensorTypes`	`[SensorType!]`	Keep only `activities` where at least one sensor has one of these types.
`actions`	`[Action!]`	Filter by enforcement actions. Matches when an `activity`'s action is in this list.
`risks`	`[RiskLevel!]`	Filter by risk levels. Matches when an `activity`'s risk is in this list.
`actorIds`	`[String!]`	Filter by public actor ids (`Actor.id`, stable or temporary fallback). Case-significant exact match.
`applicationIds`	`[ID!]`	Filter by application identifiers (`Application`.id — slug). Case-significant exact match.
`deviceIds`	`[String!]`	Filter by device identifiers (`Device.id`). Case-significant exact match.
`deviceTypes`	`[DeviceType!]`	Filter by observed device kinds (`Device`.type).
`devicePlatforms`	`[DevicePlatform!]`	Filter by observed device platforms (`Device`.platform).
`policyIds`	`[ID!]`	Filter by stable policy identifiers. Matches when an `activity`'s matched policy id is in this list. Names can change and historical events may carry prior names — filter by id.
`isUnsanctioned`	`Boolean`	Match `activities` by their isUnsanctioned value. True matches allowed `activities` for AI apps not covered by a policy; false matches every other `activity`. Omit for no filter.
`hasPolicy`	`Boolean`	When true, match `activities` with a policy attribution; when false, match `activities` without a policy attribution. Omit for no filter.
`timeRange`	`SecureAITimeRange`	Provide absolute times or a relative preset. Default cannot live on the `relative` field itself because it would auto-fill when only startTime/endTime is provided, triggering the mutual-exclusivity error. Default: `{relative: SINCE_BEGINNING_OF_DAY}`.

`SortInput`¶

Sort specification — field and direction.

Fields¶

Field	Type	Description
`field`	`SecureAISortField!`	Field to sort by.
`order`	`SecureAISortOrder!`	Sort direction. Defaults to descending. Default: `DESC`.

Scalars¶

`Int64`¶

64-bit signed integer. Use instead of Int when values may exceed the GraphQL Int 32-bit range.

`JSON`¶

The JSON scalar type represents JSON values as specified by ECMA-404.

`SecureAIPolicyDefinition`¶

A PolicyCreateInput from the AI Defense Policy GraphQL API, as a JSON object. It is passed to createPolicy unchanged, which validates it.

`Time`¶

ISO 8601 timestamp.

AI Defense Activity GraphQL API types¶

Objects¶

Actor¶

Fields¶

AiModel¶

Fields¶

Application¶

Fields¶

ApplicationProvider¶

Fields¶

Device¶

Fields¶

ModelProvider¶

Fields¶

PageInfo¶

Fields¶

SecureAIAppInventoryEntry¶

Fields¶

SecureAIAppInventoryPage¶

Fields¶

SecureAIAppInventorySummary¶

Fields¶

SecureAIInventorySummary¶

Fields¶

SecureAIOrganizationDetails¶

Fields¶

SecureAIProductIntegration¶

Fields¶

SecureAITenantOnboarding¶

Fields¶

SecureAITenantOnboardingSelections¶

Fields¶

SecureAITenantSettings¶

Fields¶

SecureAITimestamp¶

Fields¶

SecureAIUserApp¶

Fields¶

SecureAIUserAppsPage¶

Fields¶

SecureAIUserInventoryEntry¶

Fields¶

SecureAIUserInventoryPage¶

Fields¶

SecureAIUserInventorySummary¶

Fields¶

SecureAiActivity¶

Fields¶

SecureAiActivityConnection¶

Fields¶

Sensor¶

Fields¶

Enums¶

Action¶

Values¶

ActorType¶

Values¶

AppRisk¶

Values¶

DevicePlatform¶

Values¶

DeviceType¶

Values¶

ProductKey¶

Values¶

ReportRelativeTimeFramePeriodV2¶

Values¶

RiskLevel¶

Values¶

SecureAIAppInventorySortField¶

Values¶

SecureAIAuditActorType¶

Values¶

SecureAILicenseState¶

Values¶

SecureAISortField¶

Values¶

SecureAISortOrder¶

Values¶

SecureAITenantOnboardingStatus¶

`Actor`¶

`AiModel`¶

`Application`¶

`ApplicationProvider`¶

`Device`¶

`ModelProvider`¶

`PageInfo`¶

`SecureAIAppInventoryEntry`¶

`SecureAIAppInventoryPage`¶

`SecureAIAppInventorySummary`¶

`SecureAIInventorySummary`¶

`SecureAIOrganizationDetails`¶

`SecureAIProductIntegration`¶

`SecureAITenantOnboarding`¶

`SecureAITenantOnboardingSelections`¶

`SecureAITenantSettings`¶

`SecureAITimestamp`¶

`SecureAIUserApp`¶

`SecureAIUserAppsPage`¶

`SecureAIUserInventoryEntry`¶

`SecureAIUserInventoryPage`¶

`SecureAIUserInventorySummary`¶

`SecureAiActivity`¶

`SecureAiActivityConnection`¶

`Sensor`¶

`Action`¶

`ActorType`¶

`AppRisk`¶

`DevicePlatform`¶

`DeviceType`¶

`ProductKey`¶

`ReportRelativeTimeFramePeriodV2`¶

`RiskLevel`¶

`SecureAIAppInventorySortField`¶

`SecureAIAuditActorType`¶

`SecureAILicenseState`¶

`SecureAISortField`¶

`SecureAISortOrder`¶

`SecureAITenantOnboardingStatus`¶

`SecureAIUserAppsSortField`¶

`SecureAIUserInventorySortField`¶

`SensorType`¶

`SecureAIAppInventoryFilter`¶

`SecureAIAppInventorySortInput`¶

`SecureAIInventorySummaryFilter`¶

`SecureAIOrganizationDetailsInput`¶

`SecureAIProductIntegrationInput`¶

`SecureAITenantOnboardingInput`¶

`SecureAITenantOnboardingSelectionsInput`¶

`SecureAITimeRange`¶

`SecureAIUpdateTenantSettingsInput`¶

`SecureAIUserAppsFilter`¶

`SecureAIUserAppsSortInput`¶

`SecureAIUserInventoryFilter`¶

`SecureAIUserInventorySortInput`¶

`SecureAiActivityFilter`¶

`SortInput`¶

`Int64`¶

`JSON`¶

`SecureAIPolicyDefinition`¶

`Time`¶