GraphQL connection
The saved link to one GraphQL API. In the connection picker it is GraphQL.
Powers these nodes
Fields
| Field | Required | Description |
|---|---|---|
| Name | Yes | A name for the connection. |
| Endpoint URL | Yes | The URL GraphQL requests are posted to, such as https://api.example.com/graphql. |
| Auth | No | How the API authenticates—API Key, Basic, Bearer Token, or Client Credentials. Leave it empty for a public API. Credentials are stored encrypted and kept out of run logs. |
| Headers | No | Name/value pairs sent on every call to this API, including when its schema is read—an API version, for example. A header whose name looks like a credential is flagged, since it belongs under Auth instead. |
| Schema Source | Yes | Where the API's schema comes from: Introspection, the default, asks the API itself; Pasted Schema (SDL) uses the schema you paste. |
A token pasted with its Bearer prefix still works—the prefix is dropped rather than sent twice.
Some headers are set by every GraphQL call and can't be added here: Accept, Content-Length, Content-Type, Host, and Transfer-Encoding.
The schema
The schema is what lets a GraphQL step check its query, shape its output, and type its variables, and what GraphiQL's documentation and autocompletion are built from.
Save the connection and its schema is read. The note under Schema Source then reports what was found—how many types, queries, and mutations—or why the read failed. Saving again reads the schema again, which is how you pick up a change to the API right away; otherwise a schema is reused for an hour and then re-read in the background.
Many production APIs turn introspection off. If the note says the API refused, choose Pasted Schema (SDL) and save the connection. Then click Paste the schema in the note under Schema Source, paste the schema the API's developers publish, in GraphQL's schema definition language, and save it. The schema has a form of its own, since a large API's runs to megabytes. Saving it reads the schema again, and afterwards the link reads Edit the pasted schema.
The endpoint is still called when the schema is read, with a minimal query, so a wrong URL or a bad credential shows up then rather than in the first run.
A step whose API's schema can't be read still runs. What it loses is the checking: its query is sent without being validated, later steps see the names of the fields it selects but not their types, and only variables of GraphQL's own scalar types are checked.