What Is GraphQL?
GraphQL as a Query Language for APIs
What is GraphQL? GraphQL is a query language for APIs and a runtime that executes those queries against data. The client describes exactly which fields it needs, and the server returns a response shaped the same way.
GraphQL was developed at Facebook, now Meta, and released publicly in 2015. It was designed for apps that needed different subsets of related data and found that fetching them with many separate requests was slow. The specification is maintained as an open standard, and libraries implementing it exist for many programming languages.
Schemas, Queries and Mutations
Every GraphQL API has a schema, a typed description of the data the API offers. The schema lists types such as Customer or Order, the fields each type has and the operations clients may call. Clients can read the schema to see what is available.
A query reads data. The client names the fields it wants, including fields from related types, and the server returns only those fields. A mutation changes data, such as creating an order or updating an address. Both use the same language, which keeps the interface consistent.
A short illustrative query might look like this: { customer(id: 42) { name orders { id total } } }. The response would contain the customer's name and a list of order IDs and totals, and nothing else.
Subscriptions and the Single Endpoint
A subscription lets a client receive updates when data changes, such as a new message or a status change. Subscriptions are often delivered over a persistent connection, so the server can push updates as they happen.
Most GraphQL APIs expose a single endpoint, often at a path such as /graphql, where every operation is sent. Instead of one URL per resource, as in REST APIs, the client sends operations to one address and the query determines the result. Background on endpoints is in API endpoints.
Frequently asked questions
Does GraphQL replace REST?
Not in general. GraphQL is an alternative for some APIs, especially those with complex, connected data and many kinds of clients. Many organizations use both, with REST for simple resource access or public APIs and GraphQL for data-heavy applications. A fuller comparison is in REST vs GraphQL.
Is GraphQL more secure than REST?
Neither style is automatically more secure. GraphQL's flexibility creates its own risks, because a client can request deeply nested data or expensive combinations of fields. Well-run GraphQL APIs limit query depth and cost, and they check authorization on every field. Security depends on how the API is built and protected, not on the query language alone.