AI Defense Policy GraphQL API types¶

Every named type reachable from a query or mutation in this schema, grouped by kind.

Jump to: Objects · Enums · Input objects · Scalars

Objects¶

AppControlApplicationImpact¶

A catalog-owned AppControl identity shown in policy previews.

Fields¶

AppEnforcementTarget¶

Sanctioning status for one concrete enforcement identity.

Fields¶

AppSanctioningEntry¶

Sanctioning status for a single AI application.

Fields¶

AppSanctioningResult¶

Result of a batch sanctioning status lookup.

Fields¶

BrowserDataControls¶

Per-operation actions for the Sophos Endpoint browser extension's clipboard/upload/download enforcement. Mirrors Endpoint's ai_browserExtension.dataControls contract — each operation is independently allow/block/warn, attached to the same rule (and therefore the same resolved site list) as ResolvedRule.domains, not a separate list.

Fields¶

EnforcementImpact¶

Concrete WebControl and AppControl impact of target conditions.

Fields¶

PageInfo F¶

Cursor-based pagination metadata. Currently only forward pagination (first/after) is supported.

Fields¶

Policy¶

A Secure AI policy that governs access to AI services. Policies are evaluated in priority order (lower number = higher priority). Each policy contains an ordered list of rules — each rule targets a set of AI services and applies an action. Rules are evaluated top-to-bottom within a policy (first match wins).

Fields¶

PolicyBaseRule¶

Policy-wide settings applied independently of the ordered rule list. It is not a rule: it has no target and takes no part in first-match-wins evaluation. A container rather than a bare field so future policy-wide settings are purely additive.

Fields¶

PolicyConnection¶

Paginated list of policies with cursor-based navigation.

Fields¶

PolicyImpactResult¶

Result of evaluating an ordered ruleset against the catalog. Rules are walked top-to-bottom; the first matching rule wins per app. Counts sum to totalApps (allowed = totalApps - blocked - warned). Use it to check the rules of a starter template, a new policy, or a changed policy before you save them.

Fields¶

PolicyRule¶

A single rule within a policy. Pairs a target (which AI services to match) with an action (what to do when matched). Position is 0-based — assigned server-side from the array order.

Fields¶

PolicyTarget¶

Set of conditions that determine which AI services a policy applies to. All conditions must match (AND logic).

Fields¶

PreviewApp¶

A matched application in the target preview.

Fields¶

RiskCount¶

Count of applications at a specific risk level.

Fields¶

RuleTargetPreview¶

Preview of which catalog applications match a rule's target conditions.

Fields¶

RuleTargetPreviewV2¶

Sequence-aware preview returned only by PolicyRule.targetPreviewV2.

Fields¶

SecureAIMostBlockedPolicy¶

The policy that blocked the most activities in a time window.

Fields¶

SecureAIPolicyActivityMetrics¶

Activity of the tenant's enabled policies over a time window.

Fields¶

SensorConfig¶

Configuration for a single sensor on a policy. Each sensor type has its own scope schema (e.g., Endpoint uses user/device groups, Firewall uses CM groups). Endpoint scope JSON accepts two on-disk shapes per dimension; the deserializer unions them so producers may write either form: { "users": [{"id": "uuid", "name": "DOMAIN\\user", "exchange_login": "user@corp.com"}, ...], "group_ids": ["uuid", ...] (or "groups": [{"id": "uuid"}, ...]) "device_ids": ["uuid", ...] (or "devices": [{"id": "uuid"}, ...]) "device_group_ids": ["uuid", ...] (or "device_groups": [{"id": "uuid"}, ...]) } The legacy form "user_ids": ["uuid", ...] is also accepted and merges with the rich users array. For the user dimension only, name is matched against the activity's user-name before falling back to id. This lets user-scope policies match Windows endpoint events, where the user ID is a SID. exchange_login is accepted but not used for matching. Firewall scope JSON shape: {"groups": [{"group_id": "uuid", "web_policy_ids": ["uuid", ...]}]}

Fields¶

SensorConfigMap¶

Per-sensor enablement and scope. Null means the sensor is not configured for this policy.

Fields¶

StarterTemplate¶

A Sophos-shipped persona-based policy template. Supplies industry-tuned rules for a new policy. Stamping happens via the normal createPolicy mutation with builtInKey + builtInVersion set — there is no separate stamp endpoint. Templates are global, not tenant-specific.

Fields¶

Subject F¶

Federated reference to a platform subject (user, client, service principal). This service emits {id} references only — the federated gateway resolves the full Subject data from the platform subjects service, which owns the entity. Use to join policy createdBy/updatedBy IDs against user metadata (email, displayName).

Fields¶

TargetCondition¶

A single filter condition within a policy target. Example: { dimension: "risk_level", operator: IN, values: ["high", "critical"] }

Fields¶

Enums¶

AppSanctioningStatus¶

Classifies an AI application based on the tenant's policy rules. Scope-agnostic: the first matching rule wins across all policies by priority, and sensor scope is ignored.

Values¶

EffectiveReachStatus¶

Whether a V2 effective-reach figure was computed, and why not when absent.

Values¶

EnforcementMechanism¶

Sensor mechanism used to enforce an application policy decision.

Values¶

EnforcementStatus¶

Computed enforcement state derived from the policy's enabled flag and its distribution records. Never stored — eliminates concurrent write races between admin edits and policy distribution.

Values¶

FilterOperator¶

How a target condition's values are matched against an AI service's attributes. Conditions are ANDed across dimensions, ORed within a condition's values.

Values¶

PolicyAction¶

Action applied when a rule matches AI traffic. Each rule within a policy has its own action. The service merges per-rule actions into sensor configs.

Values¶

PolicyKind¶

Lifecycle class of a policy. Orthogonal to origin, which records authorship — a TENANT_BASE policy is system-provisioned but the tenant owns its rules.

Values¶

PolicyOrigin¶

Who created a policy. Determines editability and lifecycle behavior.

Values¶

PolicyState¶

Admin intent for a policy. More states, such as DRAFT or PENDING_APPROVAL, may be added later.

Values¶

ReportRelativeTimeFramePeriodV2¶

Reuses the platform-wide ReportRelativeTimeFramePeriodV2 enum defined by report-service / reporting-api so that Apollo Federation merges cleanly.

Values¶

ResolvedAction¶

Enforcement action for a resolved web control rule.

Values¶

Input objects¶

BrowserDataControlsInput¶

Write-side counterpart of BrowserDataControls, attached to a rule via PolicyRuleInput.dataControls.

Fields¶

PolicyBaseRuleInput¶

Policy-wide settings. Every field is optional: omitted fields keep their current value on update, and take their default on create.

Fields¶

PolicyCreateInput¶

Creates an ordinary policy DISABLED by default so the admin can review and position it before enforcement. Pass state: ENABLED to create-and-enable. TENANT_BASE requires state: ENABLED and is pinned below other policies.

Fields¶

PolicyFilterInput¶

Filters for the policies list query. All fields are optional and ANDed.

Fields¶

PolicyRuleInput¶

A single rule input. Position is NOT provided — it is assigned server-side from the array index (0-based). Send rules in desired evaluation order.

Fields¶

PolicyTargetInput¶

Conditions defining which applications a policy rule targets.

Fields¶

PolicyUpdateInput¶

Partial update — only provided fields are changed. Version is required for optimistic concurrency. Rules use full replacement: if provided, the entire rules list is replaced. Omit rules to leave them unchanged.

Fields¶

RuleTargetInput¶

A single rule in an ordered sequence submitted for preview. Rules are walked top-to-bottom under first-match-wins, so an application claimed by an earlier in-effect rule — whatever that rule's action — is excluded from every later rule's effective reach and from its risk advisories.

Fields¶

SecureAITimeRange¶

Time range filter for activities. When omitted, the API defaults to SINCE_BEGINNING_OF_WEEK_SUNDAY. Provide either absolute times (startTime/endTime) or a relative preset — not both. Using both returns a validation error.

Fields¶

SensorConfigInput¶

Enablement and sensor-specific scope supplied for one sensor.

Fields¶

SensorConfigMapInput¶

Per-sensor configuration supplied when creating or updating a policy.

Fields¶

TargetConditionInput¶

A dimension, operator, and values used to select matching applications.

Fields¶

Scalars¶

Int64¶

Signed 64-bit integer serialized according to the federated graph contract.

JSON¶

Arbitrary JSON value.

Time¶

RFC 3339 timestamp serialized as a string.

Federated types and introspection. Types marked with F are federated across one or more APIs in the graph. Other subgraphs may provide more fields than those strictly defined here.

Where introspection is available, query the federated endpoint to inspect its composed API schema and available fields. Learn how GraphQL introspection works.