# mizcausevic-dev/servicenow-cyberark-evidence-pipeline architecture

> Architecture diagram of the GitHub repository mizcausevic-dev/servicenow-cyberark-evidence-pipeline, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline
- Repository: https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline

## Overview

Purpose and principal workflow: An external HTTP client requests the FastAPI application’s incident, dashboard, or evidence-bundle endpoints. The application loads a seeded incident dataset and serves computed risk evaluations, review-ready bundle representations, and operational/security posture views as JSON or HTML. Although the product is framed as a ServiceNow–CyberArk evidence pipeline, the sampled implementation models those systems’ data and posture; it does not establish live connections or a background ingestion workflow.

Components

**HTTP API and page routing**
- **FastAPI application** — `app/main.py`: Defines the FastAPI app, initializes its service instance, and exposes HTML and JSON routes; its command-line entry starts Uvicorn.
- **HTTP caller** — `null`: External clients initiate the workflow by requesting the application’s documented pages or API endpoints.

**Evidence data and evaluation**
- **Seed incident dataset** — `app/data/sample_pipeline_data.json`: Supplies the incident records loaded by the service; it is sample data, not evidence of a live ServiceNow feed.
- **Pipeline service and risk evaluation** — `app/services/evidence_pipeline_service.py`: Loads the dataset and derives incident catalogs, risk verdicts, summaries, board items, evidence-bundle representations, audit/terminal feeds, and posture payloads. Its scoring and bundle-building helpers are internal stages of this same service.

**Presentation and operational surfaces**
- **HTML control surfaces** — `app/render.py`: Builds the dashboard, pipeline board, bundle, audit, integration, monitor, security/architecture, methodology, and documentation pages by rendering service-produced data.
- **ServiceNow** — `null`: A modeled source of incident and workflow context in the product description and posture views; live calls are not established by the sampled code.
- **CyberArk Vault** — `null`: A modeled source of safe/account and privileged-access context; live calls are not established by the sampled code.
- **Governance and audit consumers** — `null`: Downstream review, certification, and audit targets are represented in the product’s posture and bundle concepts; actual exports or consumer connections are not established.

Relationships
- **HTTP caller -> FastAPI application**: Sends HTTP requests to the application’s routes.
- **FastAPI application -> Pipeline service and risk evaluation**: Calls service methods to produce JSON response data; the application constructs a service instance during module initialization.
- **Pipeline service and risk evaluation -> Seed incident dataset**: Reads and parses the JSON payload to initialize its incident records.
- **FastAPI application -> HTML control surfaces**: Calls the corresponding render functions for page requests.
- **HTML control surfaces -> Pipeline service and risk evaluation**: Calls service methods to obtain data for rendered views; the renderer constructs its own service instance.
- **Pipeline service and risk evaluation -> Pipeline service and risk evaluation**: Evaluates incident attributes into risk scores/verdicts and uses evaluation results when assembling bundle representations.
- **Pipeline service and risk evaluation -> ServiceNow**: No runtime interaction established; ServiceNow is represented in modeled data and descriptive posture.
- **Pipeline service and risk evaluation -> CyberArk Vault**: No runtime interaction established; vault enrichment appears in modeled posture and audit/terminal content.
- **Pipeline service and risk evaluation -> Governance and audit consumers**: No runtime export established; certification and audit handoff are represented in returned data and product descriptions.

Coverage limits: The service excerpt omits substantial portions of its implementation, and the architecture documentation was not sampled. The available evidence establishes local seeded-data processing and HTTP presentation, but not live connector behavior, authentication, persistence beyond the in-memory service data, or downstream delivery.

Main entry points: [`app/services/evidence_pipeline_service.py`](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/services/evidence_pipeline_service.py) (Evidence pipeline), [`app/main.py`](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/main.py) (FastAPI app), [`app/render.py`](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/render.py) (HTML renderer), [`app/data/sample_pipeline_data.json`](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/data/sample_pipeline_data.json) (Seed incidents)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_http["HTTP API"]
  node_fastapi_app["FastAPI app<br/>[main.py]"]
end

subgraph group_evidence["Evidence Evaluation"]
  node_pipeline_service["Evidence pipeline"]
  node_seed_dataset["Seed incidents<br/>JSON dataset"]
end

subgraph group_presentation["Presentation Surfaces"]
  node_html_renderer["HTML renderer<br/>[render.py]"]
end

node_http_caller(("HTTP caller<br/>HTTP client"))
node_servicenow["ServiceNow<br/>Modeled source"]
node_cyberark_vault["CyberArk Vault<br/>Modeled source"]
node_governance_audit["Governance and audit<br/>Modeled consumers"]

node_http_caller -->|"sends requests"| node_fastapi_app
node_fastapi_app -->|"calls service"| node_pipeline_service
node_pipeline_service -->|"reads dataset"| node_seed_dataset
node_fastapi_app -->|"calls renderers"| node_html_renderer
node_html_renderer -->|"gets view data"| node_pipeline_service
node_pipeline_service -->|"evaluates and bundles"| node_pipeline_service

click node_fastapi_app "https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/main.py"
click node_pipeline_service "https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/services/evidence_pipeline_service.py"
click node_seed_dataset "https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/data/sample_pipeline_data.json"
click node_html_renderer "https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/render.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_fastapi_app,node_http_caller toneBlue
class node_pipeline_service,node_seed_dataset toneAmber
class node_html_renderer toneMint
class node_servicenow,node_cyberark_vault,node_governance_audit toneIndigo
```

## Components

### HTTP API

Application entry point and request routing.

- [FastAPI app](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/main.py): FastAPI · `app/main.py`

### Evidence Evaluation

Seeded incident data and in-memory risk and bundle processing.

- [Evidence pipeline](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/services/evidence_pipeline_service.py): Service · `app/services/evidence_pipeline_service.py`
- [Seed incidents](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/data/sample_pipeline_data.json): JSON dataset · Local sample data; not a live ServiceNow feed. · `app/data/sample_pipeline_data.json`

### Presentation Surfaces

HTML views rendered from service-produced data.

- [HTML renderer](https://github.com/mizcausevic-dev/servicenow-cyberark-evidence-pipeline/blob/main/app/render.py): Renderer · `app/render.py`

### Other components

- **HTTP caller**: HTTP client
- **ServiceNow**: Modeled source · Incident and workflow context is represented in data and posture views; no live calls are established.
- **CyberArk Vault**: Modeled source · Safe, account, and privileged-access context is represented in posture and audit content; no live calls are established.
- **Governance and audit**: Modeled consumers · Review, certification, and audit targets are represented in returned data; no downstream exports are established.

## Connections

- HTTP caller → FastAPI app: sends requests
- FastAPI app → Evidence pipeline: calls service · The application constructs a service instance during module initialization.
- Evidence pipeline → Seed incidents: reads dataset · Loads and parses the JSON payload to initialize incident records.
- FastAPI app → HTML renderer: calls renderers
- HTML renderer → Evidence pipeline: gets view data · The renderer constructs its own service instance.
- Evidence pipeline → Evidence pipeline: evaluates and bundles · Evaluates incident attributes into risk scores and verdicts, then uses evaluation results in bundle representations.