Skip to content

GraphQL

GraphQL lets applications request fields through a typed API schema. The server remains responsible for data access and permissions.

APIs and data contracts

Selecting the fields needed from an API

GraphQL is a query language for APIs with rules for server-side execution. A typed schema defines the data and operations on offer. The application selects the fields it needs from that schema. GraphQL does not require a particular database.

A fictional software company is planning a customer portal. The selection { project(id: "P-42") { name } } requests a project's name if its own schema offers those fields and that argument. This invented example is not a query sent to an existing service. The server implementation must fetch the data and decide whether the person requesting it may see it. A schema-valid call alone grants no access rights; the internal field internalRate should remain unavailable to customers even if they explicitly request it.

The portal therefore needs definitions for both the fields offered and their access rules. Field selection helps views with differing data needs; actual response times and database work must be examined in the implementation.

Sources