GraphQL
3vendors are named alongside GraphQL. 1 source references it, most recently CISA alerts on graphql-upload-minimal prototype pollution (Mar 2026).
What is GraphQL?
GraphQL is a query language and server-side runtime for APIs that enables clients to request and receive structured data from a strongly typed schema over a single endpoint.
- Typed schema and type system for Application Programming Interface (API) data (API design)
- Declarative queries where clients specify required fields and shape of responses (API querying)
- Mutations for data writes and side-effectful operations (API write operations)
- Subscriptions for real-time data over a single API contract (real-time APIs)
- Introspection for querying the schema itself and tooling integration (API introspection and tooling)
Show more
More About GraphQL
GraphQL is a query language and runtime for APIs designed to give clients control over the data they request from services, based on a strongly typed schema that defines available types, fields, and relationships. It addresses common issues with REST-style APIs such as over-fetching and under-fetching by allowing clients to specify exactly which fields they need in a single request. GraphQL operates over a single endpoint and focuses on expressing data requirements and capabilities in a schema rather than relying on multiple resource-specific URLs.
The core GraphQL specification defines the type system (schema definition language), query language, execution semantics, and validation rules (API protocol). A GraphQL schema exposes object types, scalar types, interfaces, unions, and enums, along with queries, mutations, and subscriptions as root operation types. Queries retrieve data, mutations apply data changes or trigger side effects, and subscriptions maintain real-time connections to receive updates when server-side events occur. The runtime executes incoming operations against application code called resolvers, which map requested fields to underlying data sources such as databases, services, or other APIs.
GraphQL is widely used in enterprise environments as an API layer that aggregates multiple back-end systems into a unified graph (API aggregation). Organizations use it to provide a consistent data contract across microservices, legacy systems, and third-party APIs. The strict type system supports schema validation, automated documentation, and compatibility checks between client and server. Introspection queries allow tools to discover the schema and power features such as auto-completion, schema explorers, and code generation for client SDKs (developer tooling).
The GraphQL ecosystem includes server implementations in multiple languages and client libraries that integrate GraphQL queries into web, mobile, and backend applications (application integration). Many deployments position GraphQL as a gateway or API composition layer in front of existing Representational State Transfer (REST) or Simple Object Access Protocol (SOAP) services, using resolvers to orchestrate and combine data from various systems (API gateway and orchestration). The specification is transport-agnostic, although Hypertext Transfer Protocol (HTTP) is a common choice for carrying GraphQL requests and responses.
For enterprises, GraphQL introduces a schema-centric model that supports contract-driven development across distributed teams, enabling API versioning strategies based on field deprecation rather than multiple API versions (API lifecycle management). Its use of a uniform query model, introspection, and tooling integration places GraphQL in the categories of API design, API querying, and application integration technology, serving as a central layer for data access between client applications and backend services.