> ## Documentation Index > Fetch the complete documentation index at: https://docs.trunk.io/llms.txt > Use this file to discover all available pages before exploring further. # Get a merge queue's dependency graph > Returns the queue's dependency graph: which pull requests the engine considers related, and why. **This does not tell you what runs next.** The engine schedules on a priority that cascades backwards through the graph and on a pending-failure gate, and neither is in this payload — `priorityValue` here is each pull request's own value, not the cascaded one. For dispatch order use `GET /v2/merge-queues/{id}/order`. Edges are transitively reduced, so an indirect dependency appears through the node between its endpoints rather than as its own edge. They mean overlapping impacted targets, not a stacked-branch relationship. Only pull requests the engine has admitted to its graph appear: anything past the graph's soft cap, or not yet ready, is absent. `includeImpactedTargets` adds the target lists that explain each node and edge; it is off by default because populating it costs a lookup per distinct commit. ## OpenAPI ````yaml /openapi-v2.json get /v2/merge-queues/{id}/graph openapi: 3.1.0 info: title: Trunk API version: 2.0.0 description: >- The Trunk public API. Every endpoint is scoped to a single organization and requires a credential. ## Authentication For automation, send an API key as `Authorization: Bearer `. An organization admin creates one in the Trunk app under **Settings → Developer → API Keys**, and chooses the merge-queue permissions it holds. A key with no permissions can read merge queues but change nothing. Those permissions scope merge queue only: every key can use the Flaky Tests and Dynamic CI endpoints, including their writes, whatever permissions it holds. A short-lived first-party token in the `x-trunk-token` header is what the `trunk` CLI sends after `trunk auth login`. A GitHub Actions job can upload impacted targets with no Trunk secret: the `trunk-io/login` action exchanges the run's own GitHub credential (its OIDC token, or on a pull request from a fork its `GITHUB_TOKEN`) for a short-lived first-party token. That token is accepted only by `PUT /v2/impacted-targets`, for the run's own repository — and on a fork pull request, only for that pull request and its head sha. ## Errors Every 4xx and 5xx response is a `ErrorResponse`: `{ "error": { "code", "message" } }`. Switch on `code`, which is stable; `message` is prose and may change at any time. **An authorization denial on a read is reported as `404`, not `403`** — whether a resource exists must not leak across organizations, so a resource in another organization is indistinguishable from one that does not exist. `403 INSUFFICIENT_PERMISSIONS` means the credential is valid but is not permitted the action (or carries no organization). Every response carries an `X-Request-Id` header. Quote it in support requests. ## Rate limiting Requests are limited per organization (currently 100 requests/second). Exceeding it returns `429` with `RATE_LIMIT_EXCEEDED`; retry with backoff. Note that the limit is enforced at the edge, which does not yet wrap its `429` in the `ErrorResponse` envelope described above — treat any `429` as rate limiting regardless of body. ## Compatibility Within v2, Trunk may add: new endpoints, new **optional** response fields, new members to any enum (including new `code` values, new queue-entry states, and new providers), and new optional request parameters. **Clients must tolerate values and fields they do not recognize** rather than failing closed — a client that switches exhaustively over an enum will break when a member is added. Removals and semantic changes require a new major version. ## Provider support Merge queues, verification runs and checks are **GitHub-only** today; `Check.provider` has a single member for that reason. Impacted-target uploads additionally require a `github.com` repository named `owner/repo`. The `Provider` enum lists values the repository index can store, not surfaces that are fully supported. ## Not yet available A pull request's numeric **position** in its queue is not exposed, and list responses are not ordered by queue position. `GET /v2/merge-queues/{id}/order` returns the order the engine will consider pull requests in, but an array index there is not a wait: use a pending entry's `directlyAhead` rather than counting, and `GET /v2/pull-requests/{id}/queue-entry-estimate` for when it is expected to merge (on queues that serve estimates). This API delivers no events of its own — poll it, or subscribe to [Merge Queue's webhooks](https://docs.trunk.io/merge-queue/webhooks). `Idempotency-Key` is not yet honored, so a mutation that times out must be reconciled by reading the resource back rather than blindly retried. contact: name: Trunk Support url: https://docs.trunk.io servers: - url: https://api.trunk.io description: Production security: - apiKey: [] - trunkToken: [] tags: - name: mergeQueues x-group: Merge Queues - name: pullRequests x-group: Pull Requests - name: mergeQueueVerificationRuns x-group: Verification Runs - name: impactedTargets x-group: Impacted Targets - name: repositories x-group: Repositories - name: dynamicCi x-group: Dynamic CI - name: ciJobs x-group: CI Jobs - name: ciWorkflowRuns x-group: CI Workflow Runs - name: ciFailureClusters x-group: CI Failure Clusters - name: testCollections x-group: Test Collections - name: tests x-group: Tests - name: testUploads x-group: Test Uploads paths: /v2/merge-queues/{id}/graph: get: tags: - mergeQueues summary: Get a merge queue's dependency graph description: >- Returns the queue's dependency graph: which pull requests the engine considers related, and why. **This does not tell you what runs next.** The engine schedules on a priority that cascades backwards through the graph and on a pending-failure gate, and neither is in this payload — `priorityValue` here is each pull request's own value, not the cascaded one. For dispatch order use `GET /v2/merge-queues/{id}/order`. Edges are transitively reduced, so an indirect dependency appears through the node between its endpoints rather than as its own edge. They mean overlapping impacted targets, not a stacked-branch relationship. Only pull requests the engine has admitted to its graph appear: anything past the graph's soft cap, or not yet ready, is absent. `includeImpactedTargets` adds the target lists that explain each node and edge; it is off by default because populating it costs a lookup per distinct commit. operationId: mergeQueues.graph parameters: - schema: type: string description: The merge queue's id. example: xK9mP2nQ required: true description: The merge queue's id. name: id in: path - schema: type: boolean default: false description: >- Include the impacted-target lists on nodes and edges. Off by default: resolving them costs one lookup per distinct commit in the graph. example: false required: false description: >- Include the impacted-target lists on nodes and edges. Off by default: resolving them costs one lookup per distinct commit in the graph. name: includeImpactedTargets in: query responses: '200': description: The queue's dependency graph content: application/json: schema: $ref: '#/components/schemas/MergeGraph' '400': description: '`VALIDATION_FAILED`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: VALIDATION_FAILED: summary: VALIDATION_FAILED value: error: code: VALIDATION_FAILED message: 'Invalid input: expected string, received undefined' '401': description: '`AUTHENTICATION_REQUIRED` | `INVALID_TOKEN`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: AUTHENTICATION_REQUIRED: summary: AUTHENTICATION_REQUIRED value: error: code: AUTHENTICATION_REQUIRED message: No credential was supplied INVALID_TOKEN: summary: INVALID_TOKEN value: error: code: INVALID_TOKEN message: The supplied token failed verification '403': description: '`INSUFFICIENT_PERMISSIONS`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: INSUFFICIENT_PERMISSIONS: summary: INSUFFICIENT_PERMISSIONS value: error: code: INSUFFICIENT_PERMISSIONS message: >- The supplied credential is missing the required permission '404': description: '`MERGE_QUEUE_NOT_FOUND`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: MERGE_QUEUE_NOT_FOUND: summary: MERGE_QUEUE_NOT_FOUND value: error: code: MERGE_QUEUE_NOT_FOUND message: Merge queue not found '429': description: '`RATE_LIMIT_EXCEEDED`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: RATE_LIMIT_EXCEEDED: summary: RATE_LIMIT_EXCEEDED value: error: code: RATE_LIMIT_EXCEEDED message: Rate limit exceeded; retry after the Retry-After delay '500': description: '`INTERNAL_ERROR`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: INTERNAL_ERROR: summary: INTERNAL_ERROR value: error: code: INTERNAL_ERROR message: An unexpected error occurred '502': description: '`UPSTREAM_ERROR`' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: UPSTREAM_ERROR: summary: UPSTREAM_ERROR value: error: code: UPSTREAM_ERROR message: An upstream service did not respond components: schemas: MergeGraph: type: object properties: nodes: type: array items: $ref: '#/components/schemas/MergeGraphNode' maxItems: 10000 edges: type: array items: $ref: '#/components/schemas/MergeGraphEdge' maxItems: 10000 description: >- Transitively reduced, so an indirect dependency is represented through the node between its endpoints rather than as its own edge. required: - nodes - edges description: >- The queue's dependency graph. **The dispatch order is NOT derivable from this** — the engine schedules on a cascaded priority and a pending-failure gate, neither of which is in this payload; use `GET /v2/merge-queues/{id}/order`. It also contains only pull requests the engine has admitted to its graph, so anything awaiting admission, or not yet ready, is absent. ErrorResponse: type: object properties: error: type: object properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable description of what went wrong. Not stable — do not parse. example: An unexpected error occurred required: - code - message required: - error description: >- The uniform error envelope. Every 4xx and 5xx response in this API has this shape. MergeGraphNode: type: object properties: pullRequestNumber: type: integer description: >- Identifies this node within the graph, and resolves to a pull request through `GET /v2/pull-requests` with the queue's `repositoryId`. A merge queue holds at most one entry per pull request, so the number is unique here. example: 4901 title: type: string example: Add the widget endpoint author: type: string example: octocat state: $ref: '#/components/schemas/QueueEntryState' priorityValue: type: integer description: >- The pull request's OWN priority. Not the cascaded value the engine schedules on — that is computed per pass and is not exposed here. example: 100 priorityName: type: string example: medium skipsTheLine: type: boolean example: false allowsBatching: type: boolean example: true verificationRunId: type: string description: The run testing this node, when it is testing. example: 4f3e2d1c-0b9a-4876-9543-210fedcba987 isBisection: type: boolean example: false impactedTargets: type: array items: type: string maxItems: 10000 description: >- Present only under `includeImpactedTargets`. Truncated — see `totalImpactedTargets`. totalImpactedTargets: type: integer example: 12 required: - pullRequestNumber - title - author - state - priorityValue - skipsTheLine - allowsBatching - isBisection description: One pull request in the queue's graph. MergeGraphEdge: type: object properties: fromPullRequestNumber: type: integer example: 4901 toPullRequestNumber: type: integer example: 4902 commonImpactedTargets: type: array items: type: string maxItems: 10000 description: >- Why the edge exists: the targets both pull requests impact. Present only under `includeImpactedTargets`, and truncated. totalCommonImpactedTargets: type: integer example: 3 required: - fromPullRequestNumber - toPullRequestNumber description: >- A dependency between two pull requests, derived from overlapping impacted targets. ErrorCode: type: string enum: - AUTHENTICATION_REQUIRED - INVALID_TOKEN - INSUFFICIENT_PERMISSIONS - INTERNAL_ERROR - VALIDATION_FAILED - NOT_FOUND - INVALID_CURSOR - MERGE_QUEUE_NOT_FOUND - PR_ALREADY_ENQUEUED - PR_NOT_ENQUEUEABLE - UPSTREAM_ERROR - VERIFICATION_RUN_NOT_FOUND - PR_NOT_FOUND - REPOSITORY_NOT_FOUND - IMPACTED_TARGETS_UNSUPPORTED - QUEUE_ALREADY_EXISTS - QUEUE_HAS_ACTIVE_ENTRIES - MODE_CHANGE_IN_PROGRESS - PR_NOT_IN_ACTIVE_STATE - MERGE_QUEUE_NOT_CREATABLE - PR_TESTS_NOT_RESTARTABLE - ALLOWED_BOT_SUBMITTERS_FROZEN - ESTIMATE_NOT_ENABLED - PROVIDER_URL_NOT_FOUND - CI_HOST_UNSUPPORTED - CI_SCOPE_NOT_FOUND - CI_JOB_NOT_FOUND - CI_FAILURE_CLUSTER_NOT_FOUND - TEST_COLLECTION_NOT_FOUND - TEST_NOT_FOUND - TEST_UPLOAD_NOT_FOUND - TICKETING_NOT_CONFIGURED - TICKETING_CREDENTIALS_INVALID - TICKETING_SITE_REFUSED - TICKET_NOT_FOUND - TICKET_LINK_CONFLICT - TEST_ALREADY_LINKED - TICKET_FIELDS_REJECTED - TICKET_CONTENT_UNAVAILABLE - TICKETING_CREATE_REFUSED - RATE_LIMIT_EXCEEDED description: >- Stable machine-readable error identifier. Switch on this, never on `message`. A shipped code's meaning never changes, but **new codes may be added within v2** — treat an unrecognized code as a generic failure of its HTTP status rather than failing closed. example: INTERNAL_ERROR QueueEntryState: type: string enum: - notReady - pending - testing - testsPassed - merged - failed - cancelled - pendingFailure description: >- Where a pull request sits in its queue's lifecycle. | Value | Meaning | | --- | --- | | `notReady` | Enqueued but not yet eligible to test — a readiness condition is unmet (see `QueueEntry.readiness`). | | `pending` | Ready and waiting for a test slot, or waiting on an earlier entry. | | `testing` | A verification run is in flight for this entry. | | `testsPassed` | Verification succeeded; waiting to merge. | | `merged` | Terminal — merged into the target branch. | | `failed` | Terminal — verification or the merge itself failed. | | `cancelled` | Terminal — removed from the queue (dequeued, or cancelled by the engine). | | `pendingFailure` | A failure is expected because an entry ahead failed, but this entry has not been re-tested yet. Not terminal: it usually returns to `pending` or `testing`. | New members may be added within v2. example: testing securitySchemes: apiKey: type: http scheme: bearer description: >- An API key, sent as `Authorization: Bearer `. An organization admin creates one in the Trunk app under **Settings → Developer → API Keys** and chooses the merge-queue permissions it holds; a key with none can read merge queues but change nothing. Those permissions scope merge queue only: every key can use the Flaky Tests and Dynamic CI endpoints, including their writes, whatever permissions it holds. trunkToken: type: apiKey in: header name: x-trunk-token description: >- A short-lived first-party token, sent in the `x-trunk-token` header. The `trunk` CLI sends one after `trunk auth login`, and the `trunk-io/login` action obtains one for a GitHub Actions run. **A token from a GitHub Actions run can only upload impacted targets** (`PUT /v2/impacted-targets`), for the repository the run belongs to; every other endpoint refuses it. ````