Skip to main content

Run a read-only Cypher query and return the first 50 rows​

Synchronous preview for the Query Workflows UI. Validates the query (same validator as scheduled runs), runs it against the caller's org graph with a 10-second timeout and a hard 50-row cap. Read-only — write keywords are rejected. Not intended for batch use; use the scheduled-execute path for production reads.

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Request Body required
  • query string required

    Possible values: non-empty and <= 10000 characters

    Read-only Cypher query to execute against the org's graph.

  • parameters object

    Parameters bound into the query (same as scheduled config).

  • primary_entity_column string

    The column a scheduled run would resolve each row's entity from. When set, the response lists the detections the rows would become and the rows that would be dropped, with reasons; when omitted, every row is reported as dropped for no_primary_entity_column.

  • name string

    Possible values: <= 128 characters

    Detection name the would-be detections are typed with (see the data input configuration).

  • severity string

    Possible values: [critical, high, medium, low]

    Severity the would-be detections carry.

  • category string

    Category the would-be detections carry.

Responses

Preview results.

Schema
  • would_be_detections object[]

    The detections a scheduled run of this configuration would emit, one per surviving row.

  • row_index integer

    Index into rows of the row this detection comes from.

  • detection_id string
  • type string
  • category string
  • severity string

    Possible values: [disabled, low, medium, high, critical]

  • entity_id string
  • entity_type string
  • entity_source_type string
  • entity_identifier_from_source string
  • connection_id string

    The connection the entity node names; empty when the node carries none.

  • dropped object[]

    The rows a scheduled run would discard, with reasons.

  • row_index integer

    Index into rows.

  • reason string

    Possible values: [no_primary_entity_column, no_entity_node, no_entity_id, no_source_type, not_serializable]

    no_primary_entity_column: the request named no column; no_entity_node: the column is not a graph node; no_entity_id / no_source_type: the node lacks the property; not_serializable: the detection would not survive the event codec.

  • columns string[]

    Column names in declared order.

  • rows array[]

    Row values, parallel to columns. Cell values are arbitrary JSON.

  • duration_ms integer

    Server-measured query duration in milliseconds.

  • truncated boolean

    True when the query returned more than the preview cap (50 rows).