Entity raw data

Raw data is the unmodified payload a source system returned to an integration for an entity. Use the entityRawDataV2 GraphQL query to retrieve the raw data for a single entity.

entityRawDataV2 replaces entityRawDataLegacy, which is deprecated. See Migrate from entityRawDataLegacy.

Prerequisites

An API key and your account ID. See Authentication.
A user or API key with permission to read graph data, such as Read Graph Data.

Send requests to the JupiterOne GraphQL endpoint, https://graphql.us.jupiterone.io/, with the Authorization: Bearer <api-key> and JupiterOne-Account: <account-id> headers. The query reads only from the account in the JupiterOne-Account header.

Query

query EntityRawData($entityId: ID!, $address: EntityIngestionAddress!) {
  entityRawDataV2(entityId: $entityId, address: $address) {
    entityId
    status
    message
    collectedAt
    payload {
      name
      contentType
      data
    }
  }
}

Arguments

Argument	Type	Description
`entityId`	`ID!`	The entity's `_id`. The response echoes this value back.
`address`	`EntityIngestionAddress!`	Where the entity was ingested from. JupiterOne uses the address to find the payload.

EntityIngestionAddress has four required fields. Each field is a metadata property on the entity:

Field	Type	Entity property
`source`	`String!`	`_source`, for example `integration-managed`
`integrationInstanceId`	`String!`	`_integrationInstanceId`
`entityKey`	`String!`	`_key`
`entityType`	`String!`	`_type`

entityType is required because _key is unique only within a _type.

Get the address values

If you already have the entity, read the address values from its properties. Otherwise, return them with a J1QL query:

FIND aws_instance
  RETURN aws_instance._id, aws_instance._source, aws_instance._integrationInstanceId,
         aws_instance._key, aws_instance._type

Example variables:

{
  "entityId": "<entity _id>",
  "address": {
    "source": "integration-managed",
    "integrationInstanceId": "<entity _integrationInstanceId>",
    "entityKey": "<entity _key>",
    "entityType": "aws_instance"
  }
}

Response

Field	Type	Description
`entityId`	`ID!`	The `entityId` you passed in.
`status`	`RawDataStatus!`	`AVAILABLE` or `NOT_AVAILABLE_OR_EXPIRED`.
`payload`	`[RawDataEntry!]!`	The raw data entries. Empty unless `status` is `AVAILABLE`.
`message`	`String`	A human-readable explanation. Set only when `status` is `NOT_AVAILABLE_OR_EXPIRED`.
`collectedAt`	`String`	ISO 8601 start time of the sync job the payload came from. Set only when `status` is `AVAILABLE`.

Each RawDataEntry has these fields:

Field	Type	Description
`name`	`String!`	The name the integration gave the raw data entry. An entity can have more than one entry.
`contentType`	`String!`	The content type of `data`, for example `application/json`.
`data`	`JSON`	The payload as the source system returned it.

Example response:

{
  "data": {
    "entityRawDataV2": {
      "entityId": "<entity _id>",
      "status": "AVAILABLE",
      "message": null,
      "collectedAt": "2026-10-21T14:02:11.000Z",
      "payload": [
        {
          "name": "default",
          "contentType": "application/json",
          "data": { "InstanceId": "i-0abc123def4567890", "State": { "Name": "running" } }
        }
      ]
    }
  }
}

When raw data is not available

When there is no raw data for an entity, the query returns status: NOT_AVAILABLE_OR_EXPIRED, an empty payload, and a message. It does not return an error. Check status before you read payload.

Raw data is retained for 7 days from the sync job that uploaded it, and comes from the integration's most recent run. Raw data is not available in these cases:

The integration has not run in more than 7 days, for example because it is disabled.
The entity was not included in the integration's most recent run.
The entity was not created by an integration. This includes entities created through the Sync API (_source: api) and entities JupiterOne creates.
The integration did not upload raw data for the entity.

The entity and its properties are unaffected in every case. See What's new in Asset Data for more detail.

info

Raw data is a record of what a source system sent, not a store of record. If you need a durable copy of a source payload, export it or retain it at the source.

Retrieve raw data in bulk

entityRawDataV2 returns one entity per request. To retrieve raw data for many entities:

Run a J1QL query that returns _id, _source, _integrationInstanceId, _key, and _type for the entities you need. See Entity and relationship queries.
Call entityRawDataV2 once for each entity, using the values from step 1.

Because you supply the address, JupiterOne does not have to look it up, so entityRawDataV2 is faster per entity than entityRawDataLegacy. Requests count toward your rate limits.

Migrate from entityRawDataLegacy

Deprecated

entityRawDataLegacy is deprecated. It continues to return raw data, but new and updated code should use entityRawDataV2.

entityRawDataLegacy takes only the entity ID. JupiterOne must look up where the entity was ingested from before it can fetch the raw data, which makes each request slower than entityRawDataV2. Both queries return the same raw data and follow the same 7-day retention.

To migrate:

Add _source, _integrationInstanceId, _key, and _type to the J1QL queries that return the entities you fetch raw data for.
Replace the entityRawDataLegacy call with entityRawDataV2, and pass those values in address.
Replace the union fragments in your selection set with plain fields. entityRawDataLegacy returns payload as a union of RawDataJSONEntityLegacy and RawDataTextEntityLegacy. entityRawDataV2 returns a list of RawDataEntry objects.
Check status instead of checking for an empty payload.

Before:

query EntityRawData($entityId: String!, $source: String!) {
  entityRawDataLegacy(entityId: $entityId, source: $source) {
    entityId
    payload {
      ... on RawDataJSONEntityLegacy {
        name
        contentType
        data
      }
      ... on RawDataTextEntityLegacy {
        name
        contentType
        data
      }
    }
  }
}

After:

query EntityRawData($entityId: ID!, $address: EntityIngestionAddress!) {
  entityRawDataV2(entityId: $entityId, address: $address) {
    entityId
    status
    message
    collectedAt
    payload {
      name
      contentType
      data
    }
  }
}

note

The fetch_entity_raw_data method in the Python client uses entityRawDataLegacy.

Prerequisites​

Query​

Arguments​

Get the address values​

Response​

When raw data is not available​

Retrieve raw data in bulk​

Migrate from entityRawDataLegacy​

Related topics​

Contents