This pageapplies toApigee andApigee hybrid.

View Apigee Edge documentation.

The GraphQL policy parses GraphQL payloads into message flow variables, verifies GraphQL requests against a schema, or both.

Use the GraphQL policy to:

• Ensure that your APIs only process requests that conform to the schema you provide.
• Impose restrictions on the payload by setting a maximum on the number of fragments allowed.
• Associate GraphQL with API products.
• Leverage the Oauth2, VerifyAPIKey, and Quota policy features, just as in REST.

GraphQL supports the following types of payloads:

• POST of graphQL payloads withContent-Type : application/graphql
• POST of graphQL payloads withContent-Type: applcation/json
• GET of graphQL payloads where the payload is a query parameter

{"query": "...","operationName": "...","variables": { "myVariable": "someValue", ... }}

• Introduction to GraphQL
• Queries and Mutations
• Flow variables reference

This policy is aStandard policy and can be deployed to any environment type. For information on policy types and availability with each environment type, seePolicy types.

SeeUsing GraphQL for an example that uses this policy.

<GraphQLcontinueOnError="[false|true]"enabled="[true|false]"name="POLICY_NAME"><Source>request</Source><OperationType>[query|mutuation|all]</OperationType><MaxDepth>MAX_DEPTH</MaxDepth><MaxCount>MAX_NUMBER_OF_QUERIES</MaxCount>// [Start maxpayloadsize]<MaxPayloadSizeInBytes>MAX_PAYLOAD_SIZE_IN_BYTES&lt/MaxPayloadSizeInBytes><Action>parse</Action><ResourceURL>PATH/TO/SCHEMA.xsd</ResourceURL></GraphQL>

<?xmlversion="1.0"encoding="UTF-8"standalone="yes"?><GraphQLname="GraphQLParser"><Source>request</Source><OperationType>query</OperationType><MaxDepth>10</MaxDepth><MaxCount>10</MaxCount><MaxPayloadSizeInBytes></MaxPayloadSizeInBytes><Action>parse</Action><ResourceURL></ResourceURL></GraphQL>

The following table provides a high-level description of the child elements of<GraphQL>:

Each of these child elements is described in the sections that follow.

Child element reference

This section describes the child elements of<GraphQL>.

<Action>

Action represents one of the following GraphQL actions:

• parse: Apigee parses the GraphQL payload into message flow variables. SeeExamples of message flow variable representations for an explanation of the variables that are set whenAction is set toparse. This can save valuable CPU time in the backend. Note thatverify also parses the payload.
• verify: Apigee verifies that the GraphQL payload conforms to the schema uploaded to the proxy.
• parse_verify: Apigee parses and verifies the GraphQL request.

The<Action> element uses the following syntax:

<GraphQL    continueOnError="[false|true]"    enabled="[true|false]"    name="POLICY_NAME" >  <Action>parse</Action></GraphQL>

<MaxCount>

The maximum number of fragments that can be in the payload. You can use this to prevent the GraphQL back-end server of the customer from executing highly complex queries, forcing clients to break their logic in to smaller payloads.

The<MaxCount> element uses the following syntax:

<GraphQL    continueOnError="[false|true]"    enabled="[true|false]"    name="POLICY_NAME" >  <MaxCount>MAX_NUMBER_OF_QUERIES</MaxCount></GraphQL>

<MaxDepth>

The maximum depth of the query, when represented as a tree.MaxDepth allows you to block deep queries in the payload, so that Apigee does not need to create very large flow variables to hold the values. However, the payload is sent as is, regardless of the value ofMaxDepth. The default value is 10.

<GraphQL    continueOnError="[false|true]"    enabled="[true|false]"    name="POLICY_NAME" >  <MaxDepth>MAX_DEPTH</MaxDepth></GraphQL>

<GraphQLcontinueOnError="[false|true]"enabled="[true|false]"name="POLICY_NAME"><MaxPayloadSizeInBytes>MAX_PAYLOAD_SIZE_IN_BYTES</MaxPayloadSizeInBytes></GraphQL>

<GraphQL    continueOnError="[false|true]"    enabled="[true|false]"    name="POLICY_NAME" >  <OperationType>[query|mutation|query_mutation]</OperationType></GraphQL>

The path to the GraphQL schema file that the GraphQL policy verifies requests against. SeeExample for an example of uploading a GraphQL schema to Apigee.

If the name of your uploaded schema file ismy-schema.graphql, then the<ResourceURL> element would be

<ResourceURL>graphql://my-schema.graphql</ResourceURL>

TheResourceURL element uses the following syntax:

<GraphQL    continueOnError="[false|true]"    enabled="[true|false]"    name="POLICY_NAME" >  <ResourceURL>PATH/TO/SCHEMA.graphql</ResourceURL></GraphQL>

<Source>

Source on which this policy executes.

<GraphQL    continueOnError="[false|true]"    enabled="[true|false]"    name="POLICY_NAME" >  <Source>request</Source></GraphQL>

The graphQL parser supports all features of a graphQL query and represents it as a graph in the message flow dotted notation. A query can comprise of operation definition and optionally fragments identified as fragment definitions. See theGraphQL specification.

Anatomy of a graphQL request

The diagram below shows the anatomy of a graphQL request.

Representation in message flow of operation definitions

The parser implementation covers all aspects ofgraphQL syntax, including support for query and mutations. SeeMessage flow variable.

The message flow variables follows this convention:

graphql.(root-index).(root definition)[(sub-indices).(child-definitions)…]

where:

• graphql: Static prefix indicating this is graphQL related message flow variables
• root-Index: based index indicating the root level query definitions index (default up to 4 per request)
• root-definition: Root level graphQL request message body, args, its values
• sub-indices: Child indices
• child-definitions: Leaf level definitions that correlate to specific fields and its values

Representation in message flow variable of operation definitions

Representation in message flow of fragment definitions

Examples of message flow variable representations

The following examples show the message flow variable representations for sample request payloads.

{ employee(id: 123) {   id   firstName   lastName }}

query Characters($episode: Episode, $withFriends: Boolean!) {   friends @include(if: $withFriends) {     friendsName    }}

query getUsers {  admins: users(role: ADMIN) {    lastName  }  accountants: users(role: ACCOUNTANT) {    firstName  }}

Related topics

Using GraphQL