Kagura AI Graph API

openapi: 3.2.0
info:
  title: Kagura Memory Cloud Graph API
  description: Universal AI Memory Platform - Remote MCP Server + Web Management
  version: 0.158.1
tags:
- name: Graph
  description: Neural Memory graph operations
paths:
  /api/v1/graph/stats:
    get:
      tags:
      - Graph
      summary: Get Graph Stats
      description: 'Get Neural Memory graph statistics for specified context.


        Issue #82: Context-scoped stats.

        Issue #383: Authorization is delegated to ``PermissionService``. Previously

        this endpoint hard-filtered by ``user_id == caller``, hiding shared-context

        memories authored by other workspace members. Now:


        - Shared context (``is_private = false``): any workspace member sees

        the full graph for the context.

        - Private context (``is_private = true``): only the private-context

        creator can access the graph for that context. The creator-only

        rule matches ``can_access_memory`` (returns ``False`` for

        non-creators) and ``check_context_access`` (not found for

        non-creators). This endpoint answers that denial with the same

        404 as a cross-workspace probe.

        - Cross-workspace probes and private-context access by non-creators

        both surface as 404 (CWE-639 / OWASP A01 uniform disclosure)

        to avoid existence leakage.


        Args:

        context_id: Optional context ID. When absent, returns an empty graph

        (no scope = no visible edges).


        Returns:

        Graph statistics including node/edge counts, top connections, etc.'
      operationId: get_graph_stats_api_v1_graph_stats_get
      parameters:
      - name: context_id
        in: query
        required: false
        schema:
          anyOf:
          - type: string
            format: uuid
          - type: 'null'
          description: 'Optional context ID. When absent, returns an empty graph (no scope = no visible edges) per Issue #383.'
          title: Context Id
        description: 'Optional context ID. When absent, returns an empty graph (no scope = no visible edges) per Issue #383.'
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GraphStatsResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v1/graph/data:
    get:
      tags:
      - Graph
      summary: Get Graph Data
      description: 'Get Neural Memory graph data for visualization (context-scoped).


        Args:

        context_id: Context ID for scoping (required for proper isolation)

        limit_nodes: Maximum nodes to return (default: 100, max: 500)

        min_weight: Minimum edge weight threshold

        memory_types: Optional list of memory types to include


        Returns:

        Graph data with nodes and edges'
      operationId: get_graph_data_api_v1_graph_data_get
      parameters:
      - name: context_id
        in: query
        required: true
        schema:
          type: string
          format: uuid
          description: Context ID (required for isolation)
          title: Context Id
        description: Context ID (required for isolation)
      - name: limit_nodes
        in: query
        required: false
        schema:
          type: integer
          maximum: 500
          minimum: 1
          description: Maximum number of nodes to return
          default: 100
          title: Limit Nodes
        description: Maximum number of nodes to return
      - name: min_weight
        in: query
        required: false
        schema:
          type: number
          maximum: 3.0
          minimum: 0.0
          description: Minimum edge weight to include
          default: 0.0
          title: Min Weight
        description: Minimum edge weight to include
      - name: memory_types
        in: query
        required: false
        schema:
          anyOf:
          - type: array
            items:
              type: string
          - type: 'null'
          description: Filter by memory types (e.g., code, note)
          title: Memory Types
        description: Filter by memory types (e.g., code, note)
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GraphDataResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v1/graph/edges:
    post:
      tags:
      - Graph
      summary: Create Graph Edge
      description: 'Create a user-declared edge between two memories in a context (#1416).


        REST twin of the MCP ``create_edge`` tool: both call the shared

        ``services.edge_service.create_declared_edge`` so the deterministic

        declared-duplicate contract (#1321) and the #1403 supersede accept/self-heal

        behave identically. The web UI''s confirm→create flow for a supersede

        suggestion posts here with ``edge_type="supersedes"``; accepting a stored

        suggestion clears the ``supersede_candidate`` in the same transaction.


        Authorization: mirrors the MCP ``create_edge`` tool and the REST

        ``remember`` / ``patch`` writers — workspace membership at ``member`` level

        or higher (viewers are read-only). Resolution goes through

        ``resolve_context_for_workspace_read``, which returns a **uniform 404** on

        every deny path (context not found, caller not a workspace member, viewer,

        private-context non-creator, whitelist/agent-binding miss) so context

        existence never leaks across workspace/privacy boundaries (CWE-639 / OWASP

        A01). Both endpoints must be live memories in the resolved (workspace,

        context) — a missing/out-of-scope/deleted endpoint is a 404, which also

        closes the edge write-time invariant the ``/graph`` read paths defend

        against. A ``supersedes`` edge additionally needs both memories to be the

        caller''s own — in a private context, a linked account''s too (#1803 /

        #2313, the rule ``remember(supersedes=)`` and the supersede accept apply):

        otherwise 403 ``AUTH-101`` and nothing is written.


        Status: 201 when a new edge is created; 200 for updated / unchanged; 409

        when a differing declared edge already exists (unless ``overwrite=true``).'
      operationId: create_graph_edge_api_v1_graph_edges_post
      parameters:
      - name: authorization
        in: header
        required: false
        schema:
          anyOf:
          - type: string
          - type: 'null'
          title: Authorization
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEdgeRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateEdgeResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    GraphStats:
      properties:
        total_nodes:
          type: integer
          title: Total Nodes
        total_edges:
          type: integer
          title: Total Edges
        avg_edge_weight:
          type: number
          title: Avg Edge Weight
        max_edge_weight:
          type: number
          title: Max Edge Weight
        min_edge_weight:
          type: number
          title: Min Edge Weight
        density:
          type: number
          title: Density
        top_connections:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Top Connections
        recent_edges:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Recent Edges
      type: object
      required:
      - total_nodes
      - total_edges
      - avg_edge_weight
      - max_edge_weight
      - min_edge_weight
      - density
      - top_connections
      - recent_edges
      title: GraphStats
      description: Graph statistics response.
    GraphEdge:
      properties:
        source:
          type: string
          title: Source
        target:
          type: string
          title: Target
        weight:
          type: number
          title: Weight
        type:
          type: string
          title: Type
        created_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Created At
        confidence:
          anyOf:
          - type: number
          - type: 'null'
          title: Confidence
      type: object
      required:
      - source
      - target
      - weight
      - type
      title: GraphEdge
      description: 'Graph edge for visualization.


        `created_at` and `confidence` are surfaced for downstream UI consumers

        (#430 — graph edge metadata overlay, future #435). They were already

        on the underlying `NeuralMemoryEdge` row but previously stripped at

        this response model. Both stay optional so existing API clients that

        don''t read the new fields continue to deserialize unchanged.'
    GraphNode:
      properties:
        id:
          type: string
          title: Id
        summary:
          type: string
          title: Summary
        type:
          type: string
          title: Type
        importance:
          type: number
          title: Importance
        degree:
          type: integer
          title: Degree
        created_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Created At
      type: object
      required:
      - id
      - summary
      - type
      - importance
      - degree
      title: GraphNode
      description: Graph node for visualization.
    CreateEdgeResponse:
      properties:
        operation:
          type: string
          title: Operation
        edge:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Edge
        previous:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Previous
      type: object
      required:
      - operation
      - edge
      title: CreateEdgeResponse
      description: 'Response for ``POST /graph/edges``.


        ``operation`` is one of created / updated / unchanged (conflict surfaces as a

        409, never a 200 body). ``edge`` is the serialized post-state; ``previous``

        is the pre-image when an existing non-protected edge was upserted.'
    GraphDataResponse:
      properties:
        nodes:
          items:
            $ref: '#/components/schemas/GraphNode'
          type: array
          title: Nodes
        edges:
          items:
            $ref: '#/components/schemas/GraphEdge'
          type: array
          title: Edges
        stats:
          additionalProperties: true
          type: object
          title: Stats
      type: object
      required:
      - nodes
      - edges
      - stats
      title: GraphDataResponse
      description: Graph data for visualization.
    GraphStatsResponse:
      properties:
        user_id:
          type: string
          title: User Id
        stats:
          $ref: '#/components/schemas/GraphStats'
        last_updated:
          type: string
          title: Last Updated
      type: object
      required:
      - user_id
      - stats
      - last_updated
      title: GraphStatsResponse
      description: Graph stats API response.
    CreateEdgeRequest:
      properties:
        context_id:
          type: string
          format: uuid
          title: Context Id
        source_id:
          type: string
          format: uuid
          title: Source Id
        target_id:
          type: string
          format: uuid
          title: Target Id
        edge_type:
          type: string
          title: Edge Type
          default: related_to
        weight:
          type: number
          maximum: 3.0
          minimum: 0.0
          title: Weight
          default: 1.0
        confidence:
          type: number
          maximum: 1.0
          minimum: 0.0
          title: Confidence
          default: 1.0
        overwrite:
          type: boolean
          title: Overwrite
          default: false
      type: object
      required:
      - context_id
      - source_id
      - target_id
      title: CreateEdgeRequest
      description: 'Body for ``POST /graph/edges`` (#1416).


        Mirrors the MCP ``create_edge`` tool''s inputs (edge_type default,

        weight/confidence ranges, overwrite semantics) so the two transports stay

        contract-consistent. ``context_id`` scopes the write; both endpoints must be

        live memories in that context (enforced by the route).'
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError