GraphQL
A query language for APIs developed by Facebook that lets clients request exactly the data they need in a single request, avoiding over-fetching or under-fetching.
Detailed Explanation
GraphQL was created by Facebook in 2012 and open-sourced in 2015 to solve a specific problem: mobile apps on slow networks needed to fetch precisely the data they required without wasting bandwidth. Unlike REST, where the server determines the shape of the response, GraphQL lets the client specify exactly what fields it needs.
In a GraphQL API, there is typically a single endpoint. Clients send a query describing the data they want, and the server returns a JSON response matching that shape. This eliminates the common REST problem where a mobile app needs to make five separate API calls to build one screen, or where a simple list endpoint returns 50 fields when the client only needs 3.
Why It Matters
GraphQL solves real problems with data fetching in complex applications. It is increasingly adopted by companies like GitHub, Shopify, and Netflix.
Real-World Example
GitHub's GraphQL API lets you fetch a repository, its issues, contributors, and recent commits in a single query instead of making four separate REST calls.
When to Use
When clients have diverse data needs, when you want to reduce network requests, when building complex nested data models, or when mobile apps need to minimize data transfer.
Advantages
- Clients get exactly the data they need
- Single endpoint simplifies API surface
- Strongly typed schema serves as documentation
- Built-in introspection for tooling
- Reduces over-fetching and under-fetching
Disadvantages
- More complex server implementation
- Caching is harder than REST
- Potential for expensive nested queries
- Learning curve for teams used to REST
- File uploads require additional handling
Frequently Asked Questions
Is GraphQL better than REST?
Neither is universally better. GraphQL excels when clients need flexible queries with varying data requirements. REST is simpler, better cached, and sufficient for most CRUD APIs. Choose based on your specific needs.
Does GraphQL replace my database?
No. GraphQL is an API layer that sits between your clients and your data sources. You still need a database—GraphQL just provides a flexible way to query and manipulate data.
Is GraphQL secure?
GraphQL introduces unique security concerns like deeply nested queries that can overload your server. Implement query depth limits, complexity analysis, and rate limiting to secure your GraphQL API.
How do I version a GraphQL API?
GraphQL avoids versioning by evolving the schema. You add new fields and deprecate old ones rather than creating v1/v2 endpoints. Clients can continue using deprecated fields until they are ready to migrate.
What are GraphQL subscriptions?
Subscriptions are GraphQL's mechanism for real-time data. They use WebSockets to push updates to clients when data changes, enabling features like live notifications, chat, and real-time dashboards.