Deepwatch Security Center API

name: Deepwatch Security Center API
description: 'The authenticated GraphQL API behind the Deepwatch Security Center console (devportal.deepwatch.com).
  The endpoint is an AWS AppSync GraphQL service at devportalapi.deepwatch.com/graphql/ with a realtime
  subscription channel advertised over wss://*.deepwatch.com/graphql/realtime. Deepwatch publishes no
  public schema, reference documentation or OpenAPI: anonymous introspection is refused by a WAF rule
  (HTTP 403 WAFForbiddenException) and access is gated behind Okta-brokered single sign-on. Recorded here
  as an evidenced, auth-gated contract surface, not a public API.'
humanURL: https://devportal.deepwatch.com/
baseURL: https://devportalapi.deepwatch.com/graphql/
tags:
- Security Operations
- GraphQL
- Managed Detection and Response
properties:
- type: Login
  url: https://login.deepwatch.com/
- type: Authentication
  url: authentication/deepwatch-authentication.yml
x-evidence:
  fetched: '2026-08-01'
  endpoint_discovered_in: https://devportal.deepwatch.com/main.js
  csp_realtime_channel: wss://*.deepwatch.com/graphql/realtime
  introspection_http_status: 403
  introspection_error: WAFForbiddenException
  access: authenticated