API version: dev

---

# GET /graph-structure — Get graph structure

Returns metadata about the graph structure and its node and relation types.

**Note**: This endpoint shares the `instanceConfiguration.enabled` configuration option with the
[`GET /instance-configuration`](/api/get-instance-configuration.md) endpoint and can therefore be disabled by the
administrator, in which case a `403 Forbidden` response is returned instead.

## Request

```bash
curl \
  -H 'Authorization: Bearer secret-token:PIPeJGUt7c00ENn8a5uDlc' \
  https://api.example.com/graph-structure
```

## Response

### 200 · OK

Returns the node and relation types currently present in the graph.

#### Body

```json
{
  "nodeTypes": [
    "Collection",
    "Comment",
    "Data",
    "Group",
    "Location",
    "Tag",
    "Token",
    "User"
  ],
  "relationTypes": [
    "HAS_READ_ACCESS",
    "HAS_SEARCH_ACCESS",
    "HAS_TAG",
    "IS_IN_GROUP",
    "IS_MEMBER_OF",
    "OWNS",
    "RELATED"
  ]
}
```

#### Headers

```http
Access-Control-Allow-Headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Location
Allow: GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK
Cache-Control: no-cache, private
X-Powered-By: Ember Nexus API
```

#### Schema

```json
{
  "type": "object",
  "description": "The node and relation types currently present in the graph.",
  "required": [
    "nodeTypes",
    "relationTypes"
  ],
  "properties": {
    "nodeTypes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "example": [
        "Collection",
        "Comment",
        "Data",
        "Group",
        "Location",
        "Tag",
        "Token",
        "User"
      ]
    },
    "relationTypes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "example": [
        "HAS_READ_ACCESS",
        "HAS_SEARCH_ACCESS",
        "HAS_TAG",
        "IS_IN_GROUP",
        "IS_MEMBER_OF",
        "OWNS",
        "RELATED"
      ]
    }
  }
}
```

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/200) · [HTTP.dev](https://http.dev/200)

### 401 · Unauthorized

The provided token is either invalid or expired.

#### Body

```json
{
  "type": "https://api.example.com/error/401/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Authorization for the request failed due to possible problems with the token (incorrect or expired), password (incorrect or changed), the user's unique identifier, or the user's status (e.g., missing, blocked, or deleted)."
}
```

#### Headers

`Access-Control-Allow-Headers`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Origin`, `Access-Control-Expose-Headers`, `Allow`, `Cache-Control`, `X-Powered-By`. Descriptions and example values are in the Response Header section below.

#### Schema

Same as `Problem` — see the Response Schema section below.

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/401) · [HTTP.dev](https://http.dev/401)

### 403 · Forbidden

The endpoint has been disabled by the instance's administrator (`instanceConfiguration.enabled` set to `false`).

#### Body

```json
{
  "type": "https://api.example.com/error/403/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "Requested endpoint, element or action is forbidden."
}
```

#### Headers

`Access-Control-Allow-Headers`, `Access-Control-Allow-Methods`, `Access-Control-Allow-Origin`, `Access-Control-Expose-Headers`, `Allow`, `Cache-Control`, `X-Powered-By`. Descriptions and example values are in the Response Header section below.

#### Schema

Same as `Problem` — see the Response Schema section below.

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/403) · [HTTP.dev](https://http.dev/403)

## Request Header

### `Authorization` (optional)

Bearer token for user authentication. If omitted, the request is processed as an anonymous user; if provided, the associated user account is used.

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization) · [HTTP.dev](https://http.dev/authorization) · [Authentication guide](/guide/authentication.md)

## Response Schema

### `Problem`

RFC 7807 Problem Details object.

```json
{
  "$schema": "https://spec.openapis.org/oas/3.0/schema/2021-09-28#/definitions/Schema",
  "type": "object",
  "description": "RFC 7807 Problem Details object.",
  "properties": {
    "type": {
      "type": "string",
      "format": "uri"
    },
    "title": {
      "type": "string"
    },
    "status": {
      "type": "integer"
    },
    "detail": {
      "type": "string"
    }
  }
}
```

## Response Header

### Other Headers

#### `Access-Control-Allow-Headers` (always)

Specifies which HTTP headers can be used during a cross-origin request, returned in preflight responses.

Example: `Authorization, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Headers) · [HTTP.dev](https://http.dev/access-control-allow-headers)

#### `Access-Control-Allow-Methods` (always)

Indicates which HTTP methods are permitted for cross-origin requests, typically returned in preflight responses.

Example: `GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Methods) · [HTTP.dev](https://http.dev/access-control-allow-methods)

#### `Access-Control-Allow-Origin` (always)

Specifies which origin(s) may access the resource.

Example: `*`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin) · [HTTP.dev](https://http.dev/access-control-allow-origin)

#### `Access-Control-Expose-Headers` (always)

Lists the response headers that browsers are allowed to access from JavaScript beyond the default restricted set.

Example: `ETag, Location`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Expose-Headers) · [HTTP.dev](https://http.dev/access-control-expose-headers)

#### `Allow` (always)

Lists the HTTP methods supported by the endpoint; returned alongside a `405 Method Not Allowed` response.

Example: `GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Allow) · [HTTP.dev](https://http.dev/allow)

#### `Cache-Control` (always)

Directives controlling caching behavior for the response.

Example: `no-cache, private`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control) · [HTTP.dev](https://http.dev/cache-control)

#### `X-Powered-By` (always)

Identifies the underlying API implementation.

Example: `Ember Nexus API`

[MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By) · [HTTP.dev](https://http.dev/x-powered-by)

---

Home: [Ember Nexus API docs](/index.md)

Full site map: [llms.txt](/llms.txt)

Previous: [Get instance configuration](/api/get-instance-configuration.md)

Next: [Get well known security.txt](/api/get-well-known-security-txt.md)