GraphQL

GraphQL is a query language and runtime for APIs, developed by Facebook. Clients can request exactly the data they need, no more, no less.

Key Features

• Single endpoint (e.g., /graphql).
• Strongly typed schema defines queries and data.
• Client-driven → Clients shape the response.
• Supports queries, mutations, and subscriptions (real-time).

Advantages

• No over/under-fetching → Efficient data transfer.
• Great for frontends with many views and data needs.
• Introspective → Clients can explore available data.
• Ecosystem tools (playgrounds, type safety, auto-generated docs).

Disadvantages

• Steeper learning curve.
• Complex queries can be expensive on servers.
• Caching is harder compared to REST.
• Not ideal for very simple APIs.

Common Use Cases

• Apps with diverse frontend clients (web, mobile).
• Dashboards and data-heavy apps.
• Complex systems where clients need flexibility.

Security

• GraphQL itself doesn’t define authentication — it relies on the underlying HTTP layer.
• Common approaches:
  • Bearer tokens / JWT in HTTP headers.
  • Session cookies (server-side sessions).
  • OAuth 2.0 for delegated access.
• The server resolves queries based on the user identity, often passing a context object containing the authenticated user.

GraphQL Query Example

Suppose you want to get a user’s ID, name, and email:

Request (Query):

Explanation:

• The query asks for exactly the fields needed (id, name, email).
• Everything goes through a single endpoint (/graphql).
• No over-fetching; you don’t get extra fields you didn’t ask for.

GraphQL Response Example

The server responds with a JSON object matching the requested fields:

Explanation:

• The data key wraps the result of your query.
• Fields match exactly what was requested.
• If there’s an error, you’ll also get an errors array in the response.

GraphQL Mutation Example

Suppose you want to update a user’s email:

Response:

Notes:

• Mutations are used to create, update, or delete data.
• Like queries, the response only contains the requested fields.