Process-attributed connection map.

GET

/v1/projects/{projectId}/inventory/connection-map

Code sample: Shell / cURL

curl --request GET \
  --url https://stratum.example.com/v1/projects/example/inventory/connection-map \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

Nodes are the project’s instances (+ the listening apps the agent reported); edges are observed network flows (from flow logs) annotated with the owning process on the instance side. Edges to endpoints with no agent (external/agentless) carry an address, not a process. When flow logs are not enabled the response has flowLogsEnabled=false + a note, and degrades to nodes + listening ports.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

Responses

200

The connection map.

Media typeapplication/json

object

nodes

required

Array<object>

object

instanceId

required

string

coverage

required

Per-instance reporting health: reporting = fresh; stale = was reporting but has gone quiet; absent = never reported (or a terminated/agentless guest).

string

Allowed values: reporting stale absent

listeningPorts

Array<object>

object

proto

required

string

port

required

integer

process

string

edges

required

Array<object>

object

from

required

The instance the flow was observed on.

string

to

The far-end instance when it is in-project; empty for external/agentless.

string

toAddr

The far-end address when it has no agent (external/agentless).

string

proto

required

string

port

required

integer

action

required

ACCEPT | REJECT

string

process

Owning process on the instance side, when a listening port matches.

string

flowLogsEnabled

required

False when no flow logs are enabled; the graph then degrades to nodes + listening ports (no edges).

boolean

note

string

Example

{
  "nodes": [
    {
      "coverage": "reporting"
    }
  ]
}

403

Authenticated but not authorized.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}