---
title: "Graph namespaces: full entity graph on inspection, service token required"
description: "GET /memories/graph with a graph_id now returns the namespace's deduplicated entity graph instead of an empty entity layer, and requires a service token."
date: 2026-07-27
tags: ["TIE AI Gateway"]
---

> Documentation Index
> Fetch the complete documentation index at: https://truememory-docs.mvstg.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Graph namespaces: full entity graph on inspection, service token required

Inspecting a graph namespace returned only `Note` nodes and zero entities. The endpoint now returns the namespace's full deduplicated entity graph, as the documentation always described.

```bash
GET /memories/graph?graph_id=acme__product_kb
Authorization: Bearer $SERVICE_TOKEN
```

## Why the entity layer was empty

The entity layer hides entities that no *non-note* episode mentions. That rule keeps per-note artifacts out of a note-heavy graph. It defined "non-note" as two internal episode tags, written by chat flushes and agent-tool writes.

Namespaces receive neither. API ingest populates them entirely, so no episode ever qualified. The filter blanked the entity layer for every namespace. It now applies to user graphs only.

The entities were always present in the graph. [Search and retrieval](/memory/retrieval/) always blended them in, and only this visualization endpoint hid them. No re-ingest or backfill is required.

## Breaking: namespace inspection requires a service token

`GET /memories/graph` and `GET /memories/timeline` with a `graph_id` now return `403 AUTH_SERVICE_REQUIRED` for end-user tokens. This matches the existing policy for namespace writes, deletes, and merges. Both endpoints expose the same namespace entities, so gating one alone would leave the other as a bypass.

A namespace holds cross-user data scoped to no caller in particular, so an end-user token has no principled claim on its contents. Returning the unfiltered entity graph widens that gap. Service tokens with no user attached continue to work.

**A browser client calling either endpoint directly with an end-user token will break.** Proxy the call through your backend with a service token instead.

Reading a user's own graph, by omitting `graph_id`, is unchanged and still works with an end-user token.

## Also documented

`source_description_prefix` on `GET /memories/graph` is now documented. It redefines which episodes count as notes, and therefore which entities pass the filter described above.

Read [Memory Graph visualization](/memory/building-uis/#memory-graph-visualization) for the parameter reference and the two-layer response model, or [Inspecting a Namespace](/memory/graph-namespacing/#inspecting-a-namespace) for the token requirement.

Source: https://truememory-docs.mvstg.com/changelog/tie-ai-gateway/2026-07-27-namespace-graph-entities//index.md