GraphQL

GraphQL is a query language and runtime for APIs, developed by Facebook. Clients can request exactly the data they need, no more, no less.

Key Features

• Single endpoint (e.g., /graphql).
• Strongly typed schema defines queries and data.
• Client-driven → Clients shape the response.
• Supports queries, mutations, and subscriptions (real-time).

Advantages

• No over/under-fetching → Efficient data transfer.
• Great for frontends with many views and data needs.
• Introspective → Clients can explore available data.
• Ecosystem tools (playgrounds, type safety, auto-generated docs).

Disadvantages

• Steeper learning curve.
• Complex queries can be expensive on servers.
• Caching is harder compared to REST.
• Not ideal for very simple APIs.

Common Use Cases

• Apps with diverse frontend clients (web, mobile).
• Dashboards and data-heavy apps.
• Complex systems where clients need flexibility.

Security

• GraphQL itself doesn’t define authentication — it relies on the underlying HTTP layer.
• Common approaches:
  • Bearer tokens / JWT in HTTP headers.
  • Session cookies (server-side sessions).
  • OAuth 2.0 for delegated access.
• The server resolves queries based on the user identity, often passing a context object containing the authenticated user.

GraphQL Query Example

Suppose you want to get a user’s ID, name, and email:

Request (Query):

POST /graphqlContent-Type: application/json​{  "query": "    query {      user(id: 123) {        id        name        email      }    }  "}

Explanation:

• The query asks for exactly the fields needed (id, name, email).
• Everything goes through a single endpoint (/graphql).
• No over-fetching; you don’t get extra fields you didn’t ask for.

GraphQL Response Example

The server responds with a JSON object matching the requested fields:

{  "data": {    "user": {      "id": 123,      "name": "Alice",      "email": "alice@example.com"    }  }}

Explanation:

• The data key wraps the result of your query.
• Fields match exactly what was requested.
• If there’s an error, you’ll also get an errors array in the response.

GraphQL Mutation Example

Suppose you want to update a user’s email:

{  "query": "    mutation {      updateUser(id: 123, input: { email: \"newemail@example.com\" }) {        id        name        email      }    }  "}

Response:

{  "data": {    "updateUser": {      "id": 123,      "name": "Alice",      "email": "newemail@example.com"    }  }}

Notes:

• Mutations are used to create, update, or delete data.
• Like queries, the response only contains the requested fields.