KnowledgeGraph Visualizer - Production Readiness and User Guide
A Confluence-ready guide for stakeholders, managers, developers, testing teams, and data stewards who need to understand, operate, validate, and use the KnowledgeGraph Visualizer to browse Neptune graph data.
Document version: 1.0 | Last updated: June 7, 2026
Executive Summary
Amazon Neptune stores the enterprise knowledge graph, but users need a business-friendly and application-specific way to browse the ontology, inspect relationships, search resources, validate graph structure, and share findings. The KnowledgeGraph Visualizer was built to fill that gap.
The tool provides a visual graph exploration layer over Neptune data. Users can search by label, URI, or resource type, select a node, view its connected neighborhood, inspect properties and relationships, run approved governance checks, and validate that Neptune data is usable for business and technical workflows.
Page Contents
1. Why This Tool Was Built 2. Audience Guide 3. How To Use The Tool 4. Architecture Diagrams 5. Development And Production Environment Model 6. Production Readiness Requirements 7. Security Model 8. Testing And UAT Plan 9. Operations And Support 10. Reference LinksWhy This Tool Was Built
Business Problem
Neptune is the graph data store, but a graph database endpoint by itself is not enough for day-to-day discovery. Business users, managers, testers, and data stewards need a visual way to understand how concepts, policies, entities, documents, coverage terms, and relationships are connected.
Without this tool, teams must rely on raw SPARQL queries, local TTL files, or developer-assisted exports. That slows down validation, makes demos harder, and limits visibility into the graph.
Solution
The KnowledgeGraph Visualizer adds an application-specific visualization and governance layer on top of Neptune. It turns graph data into searchable, inspectable, and shareable views.
The tool is designed to help teams see the graph rather than only query the graph. This helps stakeholder review, data quality checks, ontology development, and production readiness validation.
User Journey
High-level journey from opening the application through search, graph inspection, governance checks, and sharing findings.
Audience Guide
Use this page to understand why the tool exists, what business value it provides, and what must be true before production rollout.
Use this page to understand architecture, service boundaries, Choreo runtime settings, Neptune integration, and production guardrails.
Use this page to plan UAT, smoke tests, regression checks, Neptune connectivity validation, and graph browsing scenarios.
Use this page to inspect ontology structure, verify relationship quality, review governance findings, and confirm data usability.
How To Use The Tool To Browse Neptune Data
- Open the Choreo-hosted web application URL for the correct environment.
- Confirm the Neptune badge shows connected. If it shows disconnected, use
/api/neptune-statusor the support section below. - Use the Neptune search box to search by business label, URI fragment, ontology class, policy term, or resource type.
- Select a search result to render the graph neighborhood for that resource.
- Use the graph controls to fit, zoom, switch layout, export PNG, or expand related nodes.
- Click nodes to inspect labels, types, data properties, object relationships, and incoming links.
- Use governance and validation views to review warnings, data quality concerns, and ontology structure.
- Share findings with screenshots, graph exports, resource URIs, or validation notes.
Expected User Outcomes
| User Goal | What The Tool Provides |
|---|---|
| Understand graph relationships | Interactive node-link visualization of Neptune-backed resources and relationships. |
| Find business concepts quickly | Search by labels, URI fragments, resource types, and graph terms. |
| Validate data quality | Ontology stats, validation results, SHACL-related summaries, and governance query views. |
| Support demos and reviews | Visual graph browsing, PNG export, and resource-level inspection. |
Architecture Diagrams
The application uses a web app and backend service boundary. The browser calls Choreo, Choreo routes to the Python service, and only the Python service communicates with Neptune.
Development Architecture
Development uses the non-production Choreo web app and API gateway, a Python service component, Choreo configs/secrets, cached TTL files, optional S3 bulk load, and the development Neptune endpoint.
Production Architecture
Production should use authenticated browser access, production Choreo gateway controls, backend authorization, IAM role or workload identity for AWS access, strict CORS, and read-only defaults.
Development And Production Environment Model
| Area | Development | Production |
|---|---|---|
| Purpose | Feature validation, connectivity testing, data exploration, developer troubleshooting. | Controlled business usage, approved graph browsing, governance review, operational validation. |
| Web app URL | Development Choreo web app | <production-web-app-url> |
| API base URL | https://dev.nonprod.bt.choreoapis.dev/genai/knowledgegraph-visualizer/v1.0 |
<production-service-api-url> |
| Neptune endpoint | dev-neptune-w.chubb.com:8182 |
<production-neptune-endpoint>:8182 |
| AWS identity | Temporary Choreo service secrets may be used during testing. | IAM role or workload identity is preferred. Avoid manually pasted AWS session tokens. |
| CORS | Development web app origin only. | Production web app origin only. Do not use wildcard CORS in production. |
| Write/delete operations | Allowed only for controlled testing. | Disabled by default or restricted to approved admin users. |
Required Production Information To Finalize
| Information Needed | Where To Find It | Owner |
|---|---|---|
| Production web app URL and service API URL | Choreo production components and endpoints | Application or Choreo owner |
| Production Neptune endpoint, AWS account, and region | AWS Neptune console, Route 53/internal DNS, cloud platform team | Cloud/data platform team |
| IAM role ARN and policy permissions | AWS IAM console, security/cloud team | Cloud security team |
| User groups and access model | Choreo auth configuration and enterprise identity provider | Application owner and IAM team |
| Allowed production endpoints | Security review and product owner approval | Application owner |
Production Readiness Requirements
Go-Live Checklist
| Readiness Area | Requirement | Status |
|---|---|---|
| Authentication | Production users authenticate through approved Choreo/enterprise auth. Browser-side secrets are removed. | Confirm |
| Authorization | Read-only users and admin users are separated. Dangerous endpoints are not available to general users. | Confirm |
| AWS access | Service uses IAM role or workload identity, with least-privilege Neptune data access permissions. | Confirm |
| Neptune connectivity | /api/neptune-status returns configured: true and connected: true. |
Required |
| CORS | Service allows only the production web app origin. | Required |
| Feature flags | Read-only mode is enabled unless admin workflows are explicitly approved. | Required |
| Logging | Logs include request IDs and error details but never secrets, access tokens, or AWS session tokens. | Required |
| Support model | Runbook, escalation path, and owner contacts are documented. | Confirm |
Recommended Production Feature Flags
APP_ENV=production NEPTUNE_READ_ONLY=true ENABLE_NEPTUNE_WRITES=false ENABLE_DESTRUCTIVE_ENDPOINTS=false ENABLE_SPARQL_WORKBENCH=false
Security Model
Security Principles
| Principle | Production Implementation |
|---|---|
| Backend trust boundary | The browser calls the backend through Choreo. Only the backend signs Neptune requests. |
| Least privilege | Read-only graph browsing should use read-only Neptune permissions. Write/admin actions require separate approval. |
| No browser secrets | Browser runtime config should contain public URLs only. Avoid browser-side client credentials. |
| Controlled CORS | Allow only approved web app origins for each environment. |
| Operational audit | Capture gateway correlation IDs, Neptune request IDs, service status, and health check results. |
Endpoint Classification
| Endpoint Group | Examples | Production Access |
|---|---|---|
| Read-only browsing | /api/neptune-status, /api/neptune-stats, /api/neptune-search, /api/neptune-describe, /api/neptune-explore |
Allowed for approved users. |
| Local ontology views | /api/ontology, /api/validate, /api/reasoned, /api/inferred |
Allowed for approved users. |
| SPARQL workbench | /api/sparql |
SELECT-only or restricted to advanced users. |
| Write/admin operations | /api/neptune-insert, /api/neptune-delete, /api/neptune-sync, /api/neptune-bulk-load |
Admin-only if enabled. Disabled by default. |
| Destructive operations | /api/neptune-drop-all, delete-resource workflows |
Disable in production unless explicitly approved with break-glass controls. |
Testing And UAT Plan
Smoke Tests
| Test | Steps | Expected Result |
|---|---|---|
| Application loads | Open the web app URL. | Home page loads with ontology stats and navigation. |
| Backend health | Call /api/health. |
HTTP 200 and JSON health payload. |
| Neptune status | Open Neptune tab or call /api/neptune-status. |
configured: true and connected: true. |
| Neptune stats | Call /api/neptune-stats. |
Triple/class/individual/named graph counts return successfully. |
| Graph search | Search for a known term such as Policy, Coverage, Carrier, or a known URI fragment. | Search results appear, and selecting a result renders a graph neighborhood. |
| Governance view | Open governance and validation areas. | Approved checks load without backend errors. |
Regression Test Areas
- Navigation between Ontology Explorer, Governance, Neptune, and Compare views.
- Search index build or fetch behavior.
- Graph rendering after search, expand, fit, zoom, and layout changes.
- Resource details for nodes with data properties and object relationships.
- Error behavior when Neptune is unreachable or AWS identity is invalid.
- CORS behavior from the approved web app origin only.
AccessDeniedException and says the security token is invalid, the backend
reached Neptune but the AWS signing identity was rejected. Validate AWS identity first, then Neptune
IAM permissions.
Operations And Support
Operational Checks
| Check | Where | Healthy Signal |
|---|---|---|
| Choreo web app availability | Choreo Web App component | Web app responds and serves the UI. |
| Service availability | Choreo Service component and /api/health |
HTTP 200 with backend response. |
| Neptune connectivity | /api/neptune-status and /api/neptune-connection-check |
DNS, TCP, AWS credentials, and Neptune status checks pass. |
| Gateway routing | Choreo gateway logs | Requests show BACKEND_RESPONSE and service path maps to /api/*. |
| Application errors | Choreo application logs | No repeated 403, 500, or connection timeout errors. |
Common Issues
| Symptom | Likely Cause | Action |
|---|---|---|
| Neptune badge says Not configured | NEPTUNE_ENDPOINT missing or service did not restart after env update. |
Check Service component environment variables and redeploy/restart. |
| Neptune returns 403 invalid security token | AWS credentials are invalid, mismatched, expired, or not usable from the service runtime. | Run/verify STS caller identity from the same runtime; rotate credentials or fix IAM role setup. |
| Browser receives 401 from Choreo API | Web app did not attach valid Choreo auth or API gateway credentials. | Review web app auth model and Choreo connection configuration. |
| Browser CORS failure | Service CORS allowlist does not include the web app origin. | Set CORS_ALLOW_ORIGINS to the exact web app URL for that environment. |
| Graph view is empty after search | Search term returned no connected resources, or Neptune query failed. | Try a known URI/class and check service logs for Neptune errors. |
Reference Links
Support Contact
In case of any issue with this application, Neptune graph browsing, Choreo deployment, or production readiness questions, please contact guptara@chubb.com.