Graph namespaces: full entity graph on inspection, service token required
Inspecting a graph namespace returned only Note nodes and zero entities. The endpoint now returns the namespace’s full deduplicated entity graph, as the documentation always described.
GET /memories/graph?graph_id=acme__product_kb
Authorization: Bearer $SERVICE_TOKENWhy the entity layer was empty
The entity layer hides entities that no non-note episode mentions. That rule keeps per-note artifacts out of a note-heavy graph. It defined “non-note” as two internal episode tags, written by chat flushes and agent-tool writes.
Namespaces receive neither. API ingest populates them entirely, so no episode ever qualified. The filter blanked the entity layer for every namespace. It now applies to user graphs only.
The entities were always present in the graph. Search and retrieval always blended them in, and only this visualization endpoint hid them. No re-ingest or backfill is required.
Breaking: namespace inspection requires a service token
GET /memories/graph and GET /memories/timeline with a graph_id now return 403 AUTH_SERVICE_REQUIRED for end-user tokens. This matches the existing policy for namespace writes, deletes, and merges. Both endpoints expose the same namespace entities, so gating one alone would leave the other as a bypass.
A namespace holds cross-user data scoped to no caller in particular, so an end-user token has no principled claim on its contents. Returning the unfiltered entity graph widens that gap. Service tokens with no user attached continue to work.
A browser client calling either endpoint directly with an end-user token will break. Proxy the call through your backend with a service token instead.
Reading a user’s own graph, by omitting graph_id, is unchanged and still works with an end-user token.
Also documented
source_description_prefix on GET /memories/graph is now documented. It redefines which episodes count as notes, and therefore which entities pass the filter described above.
Read Memory Graph visualization for the parameter reference and the two-layer response model, or Inspecting a Namespace for the token requirement.