Rules and limits
GraphQL
Block mutations and allow only the GraphQL operations you name.
Custom API and GitHub keys can check GraphQL operations. With graphql set, every POST must be readable GraphQL (JSON, a batch, or application/graphql), and each operation in it is checked:
Text
"graphql": { "allowMutations": false, "allowSubscriptions": false, "operations": ["GetProduct", "ListOrders"] }operations: null allows any operation name. Unnamed operations are refused when names are listed. Persisted queries (a hash instead of the query text) cannot be read, so they are refused.
Still have a question?
We read every email, usually within a day.