Neo4j

Schema-driven source documentation.

NEO4J42 fields3 examples

Required

Fields required for a valid configuration payload under `config.required`.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	Neo4j connection endpoint. Accepts bolt://, neo4j://, or neo4j+s:// URIs.	—	no extra properties
required.database	string	No	Target database name (defaults to "neo4j"). Multi-database requires Neo4j 4.0+.	—	—
required.uri	string	Yes	Bolt or Neo4j URI (e.g. bolt://localhost:7687 or neo4j+s://abc123.databases.neo4j.io)	—	—

Masked

Sensitive fields under `config.masked` (secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	Yes	—	—	—

Optional

Optional configuration fields under `config.optional`.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.connection	object	No	Neo4j driver connection tuning options.	—	no extra properties
optional.connection.connection_timeout_ms	integer	No	Driver connection timeout in milliseconds.	30000	min 1000
optional.connection.encrypted	boolean	No	Force encrypted connection (overrides URI scheme detection).	—	—
optional.connection.max_connection_pool_size	integer	No	Maximum number of connections in the driver pool.	10	min 1
optional.connection.trust_strategy	enum	No	Certificate trust strategy. TRUST_ALL_CERTIFICATES is useful for self-signed certs in dev. Allowed values: TRUST_ALL_CERTIFICATES, TRUST_SYSTEM_CA_SIGNED_CERTIFICATES	—	—
optional.scope	object	No	Controls which node labels and relationships are included.	—	no extra properties
optional.scope.exclude_labels	array	No	Denylist of node labels to skip (case-sensitive).	—	—
optional.scope.exclude_labels[]	string	No	—	—	—
optional.scope.include_labels	array	No	Allowlist of node labels to scan. If empty, all labels are included.	—	—
optional.scope.include_labels[]	string	No	—	—	—
optional.scope.include_relationships	boolean	No	When true, relationship edges between labels are resolved and stored as asset links.	true	—
optional.scope.node_limit_per_label	integer	No	Maximum number of assets (node labels) to emit per extraction run.	—	min 1

Examples

Reference payloads generated from shared source examples JSON.

Local Neo4j discovery scan

Scan all node labels and relationships in a local Neo4j instance with basic auth

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "45 6 * * 1-5",
  "timezone": "UTC"
}

Config Payload

{
  "type": "NEO4J",
  "required": {
    "uri": "bolt://your-host:7687"
  },
  "masked": {
    "username": "neo4j",
    "password": "your-password"
  },
  "optional": {
    "scope": {
      "include_relationships": true
    }
  },
  "sampling": {
    "strategy": "RANDOM"
  }
}

Neo4j Aura cloud scan

Scan specific node labels in a Neo4j Aura cloud instance over encrypted connection

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "15 7 * * 1-5",
  "timezone": "UTC"
}

Config Payload

{
  "type": "NEO4J",
  "required": {
    "uri": "neo4j+s://your-instance.databases.neo4j.io"
  },
  "masked": {
    "username": "neo4j",
    "password": "your-password"
  },
  "optional": {
    "scope": {
      "include_labels": [
        "Person",
        "Organization",
        "Transaction"
      ],
      "include_relationships": true
    }
  },
  "sampling": {
    "strategy": "LATEST",
    "rows_per_page": 50
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    }
  ]
}

Neo4j local dev (no auth)

Scan a local Neo4j dev instance without authentication — for development and testing

Schedule

{
  "enabled": false
}

Config Payload

{
  "type": "NEO4J",
  "required": {
    "uri": "bolt://localhost:7687"
  },
  "masked": {},
  "sampling": {
    "strategy": "ALL",
    "rows_per_page": 500
  }
}