Skip to content
GitmoapAPIBeta
Shipcatalog
GET/catalog/services/{service_id}/graph

Walk the dependency graph outward from a service

get_service_graph
  • catalog:read
    A token needs the catalog:read scope: Read the service catalog: services, their bindings, their owners and their overviewsGranted by read_api, write_api.Every operation this scope unlocks
  • Filtered across resources

    x-gitmoap-isolation: {"kind":"cross_resource_filtered"}

Follows dependencies outward from this service for up to depth hops (1 to 3, default 2) and returns every service reached and every edge between them, each edge with the hop it was reached at. A depth outside that range is refused rather than reduced. Services you cannot see are left out.

Parameters

Path
  • service_idServiceId (string · uuid)The service the walk starts from
Query
  • depthinteger · int32optionalHow many hops to follow (1-3, default 2)

Responses

200Every service reached and every edge between them, bounded by the requested depthapplication/json
  • depthinteger · int320–∞How many hops were followed: the requested depth, at most 3.
  • edgesarray of DependencyGraphEdge
    • The DependencyGraphEdge schema
    • depthinteger · int320–∞How many hops from the root service this dependency was reached at, from 1 to the graph's depth.
    • from_service_idServiceId (string · uuid)
    • kindDependencyKindpackageapidatastoreotherHow a service depends on the far end of a dependency — not what the far end is. The same library service can be consumed as a package by one service and called over HTTP by another.
    • sourceDependencySourceobserved_lockfileobserved_publishdeclaredinferredHow a dependency came to be known, and therefore how far it can be trusted. A declared and an observed dependency between the same two services are reported separately, so a declaration no lockfile mentions, or a lockfile entry nobody declared, stands out.
    • to_service_idServiceId (string · uuid)
  • hiddeninteger · int320–∞Dependencies left out because you cannot see the service at the far end.
  • nodesarray of ServiceSummaryEvery service reached, the root included, deduplicated.
    • The ServiceSummary schema
    • display_namestring
    • group_idGroupId (string · uuid)
    • kindServiceKindservicelibrarywebsitejobdatastoreapiml_modelotherWhat sort of thing a service is. The kind decides which scorecard checks apply: a library has no deployments, so a deployment check is not applicable to it rather than failing. For your own classifications, use annotations.
    • lifecycleServiceLifecycleexperimentalproductiondeprecatedretiredWhere a service is in its life.
    • service_idServiceId (string · uuid)
    • slugServiceSlug (string)
    • sourceServiceSourceinferreddeclaredapiHow the catalog entry came to exist. Set by the platform, never accepted from a request. Any source other than inferred means a person has vouched for the entry.
    • externalbooleanoptional
    • orphaned_atstring or nulloptional
    • ownerOwnerRef or nulloptional
  • rootServiceSummary
    • The ServiceSummary schema
    • display_namestring
    • group_idGroupId (string · uuid)
    • kindServiceKindservicelibrarywebsitejobdatastoreapiml_modelotherWhat sort of thing a service is. The kind decides which scorecard checks apply: a library has no deployments, so a deployment check is not applicable to it rather than failing. For your own classifications, use annotations.
    • lifecycleServiceLifecycleexperimentalproductiondeprecatedretiredWhere a service is in its life.
    • service_idServiceId (string · uuid)
    • slugServiceSlug (string)
    • sourceServiceSourceinferreddeclaredapiHow the catalog entry came to exist. Set by the platform, never accepted from a request. Any source other than inferred means a person has vouched for the entry.
    • externalbooleanoptional
    • orphaned_atstring or nulloptional
    • ownerOwnerRef or nulloptional
  • truncatedbooleanWhether the graph stopped at its limit of 200 services, so it shows only part of the real graph.
200 exampleSynthesized example
{
"depth": 45,
"edges": [
{
"depth": 48,
"from_service_id": "b42c4831-8a9a-49fd-9b90-c39b0357c5b0",
"kind": "package",
"source": "observed_lockfile",
"to_service_id": "3ab2ac2e-c08a-44e2-a973-693f6dafae5a"
}
],
"hidden": 51,
"nodes": [
{
"display_name": "Lin Park",
"group_id": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"kind": "service",
"lifecycle": "experimental",
"service_id": "e2e55c03-93ee-4875-be53-d017c7894e1a",
"slug": "slug-a471",
"source": "inferred"
}
],
"root": {
"display_name": "Lin Park",
"group_id": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"kind": "service",
"lifecycle": "experimental",
"service_id": "62527310-8523-4aa9-8949-ca945df9de36",
"slug": "slug-2fb9",
"source": "inferred",
"external": false,
"orphaned_at": "2026-10-15T01:55:00Z",
"owner": {
"group_id": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69",
"kind": "group",
"full_path": "acme/payments-api"
}
},
"truncated": false
}
400The depth is outside 1-3application/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-56ab",
"message": "Label every synthesized example"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-3211",
"message": "Label every synthesized example"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-e291",
"message": "Label every synthesized example"
}
}
404No such service, or it is not visible to the callerapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-7e59",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap catalog get-service-graph

  • --service-ididThe service the walk starts from
  • --depthnumberoptionalHow many hops to follow (1-3, default 2)

Used in these guides