--- tags: - devops - l1 - flashcard-deck - graphql --- [Portal](../../../../library/portal/index.md) | **Level:** [L1: Foundations](../../../../library/portal/levels.md) | **Topics:** [GraphQL](../../../../library/portal/topics.md) | **Domain:** DevOps & Tooling id category difficulty tags question answer source_path graphql/3a1f8c2e904b graphql easy graphql, sdl, types What are the five built-in scalar types in GraphQL SDL? String, Int, Float, Boolean, and ID. ID is serialized as a String but signals to the type system that it is an opaque, unique identifier rather than human-readable text.\n\nName origin: GraphQL was created by Facebook in 2012, open-sourced in 2015. The Graph refers to the application data graph it exposes.\n\nRemember: SIFBI — String, Int, Float, Boolean, ID. Five built-in scalars.\n\nGotcha: Custom scalars (DateTime, JSON, URL) must be explicitly defined and have serialization logic. training/library/topics/graphql/primer.md graphql/7d4b2f1a6e83 graphql easy graphql, sdl, nullability What does the exclamation mark (!) mean in a GraphQL type declaration? It marks the field as non-nullable — the server guarantees it will never return null for that field. A field without ! is nullable and may return null. A list type like [Order!]! means the list itself is non-null and every element in it is also non-null. training/library/topics/graphql/primer.md graphql/c8e5a3d70f12 graphql easy graphql, operations What are the three root operation types in GraphQL? Query (read-only data fetching), Mutation (state-changing operations), and Subscription (real-time event streams). Every GraphQL document must specify one of these as its operation type.\n\nRemember: QMS — Query (read), Mutation (write), Subscription (stream). Three root operations.\n\nGotcha: Despite the name, a Query can trigger side effects in a poorly designed server. The convention is that only Mutations change state.\n\nFun fact: Subscriptions use WebSocket (graphql-ws protocol) or Server-Sent Events for real-time updates. training/library/topics/graphql/primer.md graphql/b2f9e7c41053 graphql easy graphql, sdl, input-types Why does GraphQL use separate Input types for mutations instead of reusing Object types? Object types can contain fields that reference other Object types and may include computed or resolver-backed fields that don't make sense as inputs. Input types are simpler — they are plain data bags with scalar and enum fields. The separation keeps the read schema and write schema distinct and prevents accidentally exposing server-side computed fields as writable arguments. training/library/topics/graphql/primer.md graphql/5e3c9a8b2d76 graphql easy graphql, resolvers What are the four arguments passed to every GraphQL resolver function? (1) parent (or root): the resolved value of the parent field. (2) args: the arguments passed to this field in the query. (3) context: shared request-scoped object containing DB connections, auth info, DataLoader instances, etc. (4) info: the query AST, field path, and schema — used for optimizations and projections. training/library/topics/graphql/primer.md graphql/9f1d6e4a7b30 graphql easy graphql, over-fetching, rest What problems does GraphQL solve that REST APIs commonly exhibit? Over-fetching: REST endpoints return fixed shapes — clients receive fields they don't need. Under-fetching: a single screen may require multiple REST round trips to assemble its data. GraphQL lets clients request exactly the fields they need in a single request, eliminating both problems. training/library/topics/graphql/primer.md graphql/4a7c3e2f91b8 graphql easy graphql, introspection What is GraphQL introspection and why is it disabled in production? Introspection is a built-in mechanism that lets clients query the schema itself — listing all types, fields, arguments, directives, and deprecation notes. It powers tools like GraphiQL. In production it is disabled because it exposes the full API surface to potential attackers, including deprecated field names that may contain migration hints revealing internal design decisions. training/library/topics/graphql/street_ops.md graphql/0b8d5f3c6a19 graphql easy graphql, http What HTTP status code does a GraphQL server return for a query that partially fails? 200 OK, even when errors occurred. GraphQL returns partial data alongside an errors array. The presence of HTTP 200 does not mean the response is error-free — callers must always check for an errors field in the response body. training/library/topics/graphql/street_ops.md graphql/e6f2b4d81c07 graphql easy graphql, fragments What is a GraphQL fragment and when do you use one? A fragment is a reusable selection set named and defined separately from a query. You use fragments to avoid repeating the same field list across multiple queries, to share field selections between operations, and to co-locate data requirements with the UI component that uses them (the Relay/Colocated Fragments pattern). training/library/topics/graphql/primer.md graphql/2c5e9a7f3b14 graphql medium graphql, n+1, performance Explain the N+1 problem in GraphQL and how DataLoader solves it. N+1 occurs when a query fetches a list of N items and each item's resolver fires an independent DB query to load a related resource. 100 orders with a user resolver generates 101 queries. DataLoader solves it by batching: it collects all .load() calls within the same event loop tick, fires a single batch query for all IDs, and returns results mapped back to each caller. This reduces 101 queries to 2. training/library/topics/graphql/primer.md graphql/8d3f1c7e5a02 graphql medium graphql, dataloader, caching Why must DataLoader instances be created per-request, not as module-level singletons? DataLoader maintains an in-memory cache keyed by ID. A singleton would accumulate stale entries across requests and serve one user's data to another user (cache poisoning). Per-request instances are created fresh in the context factory, share their cache only within that request's resolver tree, and are garbage-collected when the request ends. training/library/topics/graphql/primer.md graphql/1a9b4d6f2c35 graphql medium graphql, pagination What is the difference between offset pagination and cursor pagination in GraphQL, and when should you prefer each? Offset pagination uses limit/offset arguments and is simple but unstable under concurrent writes — new inserts shift rows and cause duplicates or skips across pages. Cursor pagination uses opaque cursors (typically base64-encoded IDs or timestamps) and is stable under writes and efficient at any depth. Use cursor pagination for any list that grows under production load; use offset only for small, stable, admin-facing lists. training/library/topics/graphql/primer.md graphql/7e2c8b5a3f91 graphql medium graphql, relay, pagination What are the five standard fields in a Relay-spec connection type? A connection type contains: edges (list of edge objects), pageInfo (pagination metadata), and optionally totalCount. Each edge contains: node (the actual item) and cursor (opaque pointer for pagination). pageInfo contains: hasNextPage, hasPreviousPage, startCursor, and endCursor. training/library/topics/graphql/primer.md graphql/d4a6f0e7c821 graphql medium graphql, errors, extensions What should every GraphQL error extension include for programmatic handling? A machine-readable code in the extensions object (e.g., extensions.code: "NOT_FOUND"). Clients must never parse the human-readable message string for logic decisions — it can change. The code field enables stable error handling, retry logic, and localized error display. Additional extension fields like the resource type or ID help callers understand context without embedding it in the message. training/library/topics/graphql/primer.md graphql/6b1e9d3c5f08 graphql medium graphql, security, depth How do query depth limits and complexity scoring protect a GraphQL API from abuse? Depth limits reject queries nested beyond a threshold (e.g., 5 levels), blocking recursive fan-out attacks. Complexity scoring assigns a cost to each field (with list fields multiplied by requested count) and rejects queries whose total cost exceeds a budget. Together they cap the worst-case work any single query can force the server to perform, making the API resistant to both adversarial and accidental expensive queries. training/library/topics/graphql/primer.md graphql/3f7a2e8b1d46 graphql medium graphql, security, persisted-queries What are Automatic Persisted Queries (APQ) and what security benefit do they provide? APQ is a protocol where clients send only a SHA-256 hash of the query. On first request, the server returns PersistedQueryNotFound; the client resends with the full query and hash, and the server caches it. Subsequent requests use the hash only. Security benefit: once deployed, only pre-registered queries are accepted — arbitrary query injection is blocked, and the executable query surface is bounded to what clients actually ship. training/library/topics/graphql/primer.md graphql/9c5d4f3a7e21 graphql medium graphql, subscriptions, websocket What is the recommended WebSocket subprotocol for GraphQL subscriptions and what replaced the original one? The current recommended protocol is graphql-ws (implemented in the graphql-ws npm library). It replaced subscriptions-transport-ws, which was abandoned in 2020. The old library had open security issues and was not being maintained. Teams migrating from Apollo Client 2 to Apollo Client 3 needed to switch transports. Server-Sent Events (SSE) over HTTP is an alternative transport now covered by the GraphQL over HTTP specification (2023). training/library/topics/graphql/trivia.md graphql/a0e8c6f2b413 graphql medium graphql, schema, federation What is Apollo Federation and what problem does it solve? Apollo Federation enables multiple independent GraphQL services (subgraphs) to each own a slice of the schema. An Apollo Router composes them into a unified supergraph and routes query fragments to the right service. It solves the monolith vs. fragmentation problem: without federation, either one team owns the entire schema (bottleneck) or each service exposes its own API (no unified graph). Federation lets teams move independently while presenting a single endpoint to clients. training/library/topics/graphql/primer.md graphql/5d1b7c9e3a60 graphql medium graphql, schema, breaking-changes Which schema changes are breaking and which are non-breaking? Non-breaking: adding a new field, adding a nullable argument, deprecating a field, adding an enum value clients don't switch on. Breaking: removing a field, renaming a field, changing a field's type, adding a required (non-null) argument to an existing field, removing an enum value. The safe migration path for any breaking change is deprecation first → one release cycle → removal. training/library/topics/graphql/primer.md graphql/c2a4e8f6b701 graphql medium graphql, caching, http Why is HTTP response caching harder with GraphQL than with REST, and what are the main workarounds? REST maps resources to URLs, so GET /users/42 is naturally cacheable by CDNs and browsers. GraphQL typically uses POST to /graphql with the query in the body — POST is not cached by default. Workarounds: (1) Persisted queries sent as GET requests with a hash parameter — CDN-cacheable. (2) @cacheControl directives that instruct Apollo Server to set Cache-Control headers. (3) Application-level caching via DataLoader (request-scoped) and Redis (cross-request). training/library/topics/graphql/primer.md graphql/7f3b1d5a9e82 graphql medium graphql, variables What are GraphQL variables and why should you always use them instead of string interpolation? Variables are typed, named inputs declared in the operation signature and passed alongside the query as a separate JSON object. They prevent injection attacks (analogous to parameterized SQL vs. string-interpolated SQL), enable query plan caching on the server (same query shape with different variable values reuses the parsed AST), and make queries reusable across different inputs without string manipulation. training/library/topics/graphql/primer.md graphql/e5c9a2f7d013 graphql medium graphql, directives What are the built-in execution directives @skip and @include used for? @include(if: Boolean) and @skip(if: Boolean) conditionally include or exclude fields in a query based on a variable value. They let a single query document handle multiple display states without sending multiple queries. \nExample: query { user { id name avatar @include(if: $showAvatar) { url } } }. The condition is evaluated per-request, so clients can toggle fields based on feature flags or user settings. training/library/topics/graphql/primer.md graphql/4b6d3e8c1f25 graphql medium graphql, schema-first, code-first What are the trade-offs between schema-first and code-first GraphQL development? Schema-first: write SDL first, implement resolvers to match. The schema is a readable, language-agnostic contract that exists before any code runs — ideal for multi-team federation and schema registry workflows. Drift risk if codegen is skipped. Code-first: decorators or builder APIs derive the schema from code. Types stay in sync with resolvers by construction, better IDE support. Schema is implicit and requires running the server to extract — harder to share as a contract. training/library/topics/graphql/primer.md graphql/0d2f7a4b9c16 graphql medium graphql, unions, interfaces When do you use a GraphQL union vs. an interface? Interface: multiple types share a common set of fields that clients will always query (e.g., Node with id, or Animal with name and species). Use when the shared fields drive client logic. Union: types have no shared fields but a resolver might return any of them (e.g., SearchResult = User | Order | Product). Use when the types are genuinely heterogeneous. Unions require inline fragments to query type-specific fields; interfaces allow querying shared fields directly plus inline fragments for type-specific ones. training/library/topics/graphql/primer.md graphql/8a5e3b2f6d49 graphql hard graphql, federation, query-planning How does Apollo Router plan and execute a federated query across subgraphs? The router receives the full client query and uses the composed supergraph schema to build a query plan — a tree of fetch operations. It identifies which fields belong to which subgraphs, parallelizes independent fetches, and sequences dependent fetches (e.g., fetch User from users-service, then use the returned id to fetch Orders from orders-service via the @key extension mechanism). Results are merged and returned to the client as a single response. The query plan is computed from the schema, not hardcoded. training/library/topics/graphql/primer.md graphql/f1c7d4b2e096 graphql hard graphql, dataloader, ordering What is the contract a DataLoader batch function must fulfill, and what happens if it is violated? The batch function receives an array of keys and must return a Promise that resolves to an array of values in the exact same order and length as the input keys. If a key has no result, return null or an Error instance at that index — never skip an index or change the order. Violating this contract causes DataLoader to resolve the wrong value for each .load() call, producing silent data corruption where users see other users' data or resolvers return incorrect objects. training/library/topics/graphql/primer.md graphql/3e9b6a1f7c24 graphql hard graphql, subscriptions, cleanup What mechanism ensures subscription resolvers clean up their PubSub listeners when a client disconnects? When using async generators for subscriptions (the graphql-ws protocol), the generator's finally block is guaranteed to execute when the generator is closed, whether by normal completion, client disconnect, or an error. The transport layer calls .return() on the generator on disconnect, which triggers the finally block. This is where you call pubsub.unsubscribe(), remove event listeners, or clear intervals — ensuring no zombie listeners outlive the connection. training/library/topics/graphql/street_ops.md graphql/b7d2c5a8f043 graphql hard graphql, complexity, cost-analysis How do you assign complexity costs to fields that return paginated lists, and why does the list size argument matter? Paginated list fields multiply their base cost by the first or limit argument. A field returning 100 items is ~100x more expensive than one returning 1. Without argument-aware cost calculation, a client requesting first: 1000 would pay the same complexity cost as first: 1, defeating the purpose of limits. Tools like graphql-cost-analysis let you define listFactor multipliers on specific fields, so the complexity engine correctly scales cost with the requested page size. training/library/topics/graphql/primer.md graphql/6f4a1d9c3b07 graphql hard graphql, error-unions, result-types What is the error union pattern and when is it preferred over returning null with errors? The error union pattern defines a union return type for mutations that can include both success and typed failure cases: UpdateOrderResult = Order | OrderNotFound | ValidationError. Each error type has specific fields. Clients pattern-match on __typename to handle each case. It is preferred when: (1) errors are expected domain outcomes (not infrastructure failures), (2) clients need structured error data (not just a message), (3) you want exhaustive error handling enforced by the type system. Null + errors array is acceptable for simple read queries on nullable fields but lacks type safety. training/library/topics/graphql/primer.md graphql/2a8e5c7f1b39 graphql hard graphql, schema-registry, ci Describe a CI pipeline gate that prevents accidental breaking schema changes from reaching production. Steps: (1) Export the current production schema via introspection and store it as a baseline artifact. (2) In CI, after any change to the schema file, run graphql-inspector diff --fail-on-breaking. (3) Block the deployment if breaking changes are detected unless a --allow-breaking override is explicitly set and reviewed. (4) On successful deployment, update the baseline artifact in the schema registry with the new schema. This creates a guardrail that forces engineers to consciously acknowledge breaking changes rather than shipping them accidentally. training/library/topics/graphql/street_ops.md --- ## Wiki Navigation ### Related Content - [GraphQL](../../../../library/topics/graphql/index.md) (Topic Pack, L2) — GraphQL