Skip to Content
CLI Run and ExportOutput and results

Output and results

What the CLI prints and what it writes after a successful scan.

Console output

  • Progress lines such as [scan] ingest: … and [scan] analyze: … are emitted only when stdout is a TTY (interactive terminal). In CI or when stdout is redirected, those lines are omitted to keep logs small.
  • Success path: when the diagram graph is written, the CLI always prints a line of the form [scan] dataflow.json written to <absolute path> so scripts and tests can rely on it even when progress lines are hidden.
  • Auto-upload (when auto-upload is not skipped): after the write line, the CLI uploads the scan and prints [scan] Preview ready: <URL>. With a workspace API key the URL uses ?importDraft=<draftId>; without a key it uses /preview/cli/<claimToken> and sign-up. Upload failures print [scan] Auto-upload failed: … on stderr but do not change the scan exit code if dataflow.json was written. See Upload to dashboard.
  • Warnings: configuration issues at startup (when interactive) and non-fatal scan warnings (parsers, manifest limits, optional AI hints) may appear on stderr; the process can still exit 0 and produce a valid file. When AI inference is enabled, expect a reminder that .env files are excluded from scans and provider prompts, and (for cloud providers without an API key) a hint that provider calls will return no proposals.
  • AI inference (if enabled): a summary line with candidate, proposal, applied, and rejected counts plus provider and model. With --ai-verbose, you also get token usage and per-proposal detail lines. See AI inference for tool-loop and third-party data-flow behavior.
  • Invalid configuration: if merged settings fail schema validation (for example invalid numeric flags), the CLI prints [scan] invalid configuration: and exits with code 2 before ingest.
  • Failures: messages such as Scan failed: … or write errors on stderr; exit code is non-zero when the scan records errors, graph construction fails, or the output file cannot be written.

Output file

By default the CLI writes dataflow.json in the process current working directory (not necessarily the scanned directory). Override the destination with -o / --output <file> (see Scan arguments).

The file is a small wrapper: schemaVersion, a graph object (DiagramGraphJson: nodes, edges, viewport), and metadata (for example files scanned and duration). Import the result through the app’s diagram import flow using that graph payload, or use Upload to dashboard to send the file from the CLI and open preview via a dashboard link.

Example wrapper shape:

{
  "schemaVersion": "1.0",
  "graph": {
    "nodes": [],
    "edges": [],
    "viewport": { "x": 0, "y": 0, "zoom": 1 }
  },
  "metadata": {
    "componentsCount": 0,
    "dataFlowsCount": 0,
    "filesScanned": 0,
    "scanDurationMs": 0
  }
}

Which properties are filled

The CLI emits all Engineering, Privacy, and Security property keys (from the DataParade property models) so the import UI can show every field. Only a subset are set from code/config; the rest are null or empty and are intended for you to complete in Preview & Edit. See node properties for field definitions.

Third-party / external API (from pattern detection):

  • Filled when we detect an external API (e.g. Auth0, Stripe): integration_method, authentication_method, integration_status, vendor, documentation_url (known doc URLs), code_reference_package (known npm package names), api_type, sdk_available, https_enforced.
  • service_url_api_endpoint is set when the detector saw a request URL (e.g. fetch('https://...')); otherwise null.
  • api_version only when the finding carries it (e.g. from code); otherwise null.

Other patterns (env, config, database, auth, routes):

  • Env/config: cloud_provider, region_location, encrypt_at_rest, connection_encryption, data_retention_period_days, etc. when matching env or config keys.
  • Database: connection_encryption, backup_frequency, audit_logging_enabled, etc. when patterns match.
  • Auth: mfa_required, authentication_method, sso_integration from auth middleware patterns.
  • Routes: request_validation, api_type, https_enforced for route patterns.
  • Data flow edges (graph mapping): engineering.protocol is set to rest or graphql for api_call flows when the endpoint, method, or source code indicates HTTP REST vs GraphQL. Pattern rules in property.patterns.yaml also set api_type to graphql for /graphql URLs and paths.

Terraform / IaC (.tf / .tfvars):

  • Structural resource/data/module/provider detection and reference-based edges between resources (see Scan patterns).
  • Provider topology: after scan, deterministic fallbacks apply provider-topology.rules.yaml so e.g. Amazon Web Services connects to managed service nodes such as Aws S3, Aws Lambda, and Aws Pg with managed_by_provider / managed_service_key where rules match.
  • For stable, reproducible Terraform-only diagrams in tests or CI, set SCAN_AI_INFERENCE=false so optional AI merge does not reshape components.

Privacy and Security:

  • Most Privacy and Security fields (e.g. data_categories_received, compliance_certifications, risk_rating, last_assessment_date) are not inferred from code; they stay null and are for manual or AI inference enrichment.

metadata.aiInference (when AI ran)

When --ai-inference (or equivalent config/env) was enabled, metadata may include an aiInference object with:

  • Counts — candidatesConsidered, proposalsGenerated, proposalsApplied, proposalsRejected, plus heuristic vs provider breakdowns.
  • Usage — providerCalls, inputTokens, outputTokens, totalTokens, optional estimatedCostUsd, aiProvider, aiModel.
  • thirdPartyPropertyCoverage (optional) — tallies of autofilled vs suggested third-party fields after merge.
  • thirdPartyDataFlow (optional) — per-vendor data-sharing insights (entries[] with componentId matching final graph node ids, plus direction, dataShared categories, confidence, evidence). Built after fallbacks and stable id assignment; omitted when aiThirdPartyDataFlowEnabled is false. Documented in AI inference.
  • agenticTrace (optional) — per third-party candidate tool-loop runs and toolCalls for debugging and preview summary display.

The app maps thirdPartyDataFlow entries onto third-party graph nodes by componentId as data._cliDataFlowInsights during CLI import preview so the Data tab can show them without re-running the scan.

Graph payload notes

  • Node and edge data may include engineering, privacy, and security fields populated by patterns and AI merge rules.
  • Source locations in the export keep file path and line range only (raw code snippets are stripped).
  • Structural scans are deterministic: the same codebase and configuration produce the same logical graph.nodes and graph.edges; only run metadata (such as duration) varies. See Deterministic output.

If the import fails or the schema looks off, see Troubleshooting.

Last updated on
Environment variablesTroubleshooting