Run a Cypher query
Execute an openCypher query (org-scoped, read-only, temporary). Automated and agent callers must send intent: one short sentence naming the specific question this query should answer and how the result will guide the next step. It never changes the query or its results; when set, it is attached to the request trace in APM and to the security audit log of rejected queries, so automated traffic has an attributable purpose.
curl --request POST \
--url https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": "<string>",
"parameters": {},
"intent": "<string>"
}
'import requests
url = "https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher"
payload = {
"query": "<string>",
"parameters": {},
"intent": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({query: '<string>', parameters: {}, intent: '<string>'})
};
fetch('https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => '<string>',
'parameters' => [
],
'intent' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher"
payload := strings.NewReader("{\n \"query\": \"<string>\",\n \"parameters\": {},\n \"intent\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": \"<string>\",\n \"parameters\": {},\n \"intent\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": \"<string>\",\n \"parameters\": {},\n \"intent\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"rows": [
{}
],
"metadata": {
"executionTimeMs": 123,
"rowCount": 123
}
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}Authorizations
A Tolmo API token, sent as Authorization: Bearer <token>. Either a user token (usr_tok.*, minted by tolmo auth login, scoped to your own permissions) or an org API token created in the Tolmo app, for CI and automation.
Path Parameters
Body
1 - 10000Show child attributes
Show child attributes
Automated and agent callers MUST set this on every query: in one short sentence, name the specific question this query should answer and how the result will guide your next step. For initial discovery, say what you need to learn, e.g. "Identify which resource types are present so I can choose the right checks for this environment". For a follow-up, e.g. "Find roles attached to exposed EC2 instances so I can inspect their permissions". Avoid generic phrases like "explore the graph", repeating the overall task, or assuming a finding before seeing results. Recorded for observability; does not affect query results. Omit only for a one-off interactive query typed by a human.
1000curl --request POST \
--url https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": "<string>",
"parameters": {},
"intent": "<string>"
}
'import requests
url = "https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher"
payload = {
"query": "<string>",
"parameters": {},
"intent": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({query: '<string>', parameters: {}, intent: '<string>'})
};
fetch('https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => '<string>',
'parameters' => [
],
'intent' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher"
payload := strings.NewReader("{\n \"query\": \"<string>\",\n \"parameters\": {},\n \"intent\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": \"<string>\",\n \"parameters\": {},\n \"intent\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tolmo.com/api/v1/orgs/{orgSlug}/cypher")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": \"<string>\",\n \"parameters\": {},\n \"intent\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"rows": [
{}
],
"metadata": {
"executionTimeMs": 123,
"rowCount": 123
}
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}