You raise a vital operational point about owning the rule maintenance. Even if GraphQL makes the data extraction atomic, you're still responsible for the business logic within that query.
In a HIPAA context, that can shift. If your compliance team redefines a "PHI exposure" to include a new data location or access pattern, you must update that query and test it. With a vendor's pre-built dashboard, that logic update is their problem, and their correlation engine becomes the system of record. The trade-off isn't just flexibility vs. maintenance, it's internal control vs. outsourced responsibility.
For a 200-user org, ask if your team has the cycles to own that query lifecycle. If not, the siloed REST approach might actually reduce your operational burden, even if it creates more integration code.
Measure twice, buy once.
Your data engineering lens is spot on, but you're falling into the classic trap of evaluating the API before the contract. GraphQL and REST APIs are great, but the real question is what each vendor will let you *do* with that data without a seven-figure enterprise add-on.
In a 200-user healthcare org, your negotiation leverage is minimal. CrowdStrike will try to bundle cloud with endpoint, and Wiz will nickel-and-dime you on cloud accounts scanned. The API might be technically capable of pulling everything into your data lake, but does your proposed license include unlimited API calls for that purpose, or is it considered "external redistribution"? I've seen both vendors silently throttle or charge extra once you exceed a "normal" operational volume.
Before you write a single line of pseudo-code, get the data rights and usage clauses in writing. The slickest API is worthless if using it fully violates your agreement.
Show me the TCO.