What is GraphQL?
GraphQL is a query language and runtime for APIs that lets clients request exactly the data they need in a single round trip, reducing over-fetching and under-fetching.
GraphQL is a query language and server-side runtime for APIs, developed internally by Facebook in 2012 and publicly released in 2015. It provides a type system that defines the capabilities of an API, allowing clients to describe the shape and structure of the data they require. Unlike REST, where the server defines fixed response shapes per endpoint, GraphQL lets the client specify fields, nested objects, and even rename results in a single query.
A GraphQL API exposes a single endpoint (typically /graphql) that accepts POST requests containing a query string. The server parses the query, validates it against the schema, and executes resolver functions for each field. This process ensures that the client receives only the requested data, nothing more. Queries can include arguments for filtering, sorting, or pagination. Mutations handle data modifications, and subscriptions enable real-time updates over WebSockets. The introspection system allows tools like GraphiQL to explore the schema dynamically.
GraphQL sits between the client and the data sources. It is not a storage engine or a database; it is an abstraction layer that can aggregate data from multiple backends (REST APIs, databases, microservices) into a single coherent response. This makes it popular for mobile applications where bandwidth is constrained, and for complex frontends that need data from many endpoints. The specification is maintained by the GraphQL Foundation under the Open Web Foundation agreement.
Key facts
- Developed by Facebook in 2012, open-sourced in 2015.
- Uses a single endpoint, typically /graphql, over HTTP POST.
- Supports queries, mutations, and subscriptions.
- Schema is defined using the GraphQL Schema Definition Language (SDL).
- Introspection allows clients to discover the schema at runtime.
How it works in practice
Related terms
References
More in Web Protocols
CORS
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that lets servers explicitly allow web pages from one origin to request resources from a different origin via HTTP response headers.
gRPC
gRPC is a high-performance, open-source remote procedure call framework initially developed by Google. It uses HTTP/2 for transport, Protocol Buffers as its interface definition language and message serialization format, and supports bidirectional streaming.
HTTP
HTTP is a text-based request-response protocol that defines how web clients and servers exchange resources, forming the foundation of data communication on the World Wide Web.
HTTP Pipelining
HTTP Pipelining is a technique in HTTP/1.1 that sends multiple requests on a single connection without waiting for each response, now largely replaced by HTTP/2 multiplexing.
HTTP Status Code
A three-digit integer in an HTTP response that indicates the result of the server's attempt to process the request, grouped into five classes (1xx through 5xx).
HTTP/1.1
HTTP/1.1 is the persistent-connection version of the Hypertext Transfer Protocol, defined in RFC 2616 and updated by RFCs 7230-7235, enabling multiple requests and responses over a single TCP connection.
HTTP/2
HTTP/2 is a binary, multiplexed version of HTTP that reduces latency through header compression, stream prioritization, and server push, as defined in RFC 7540.
HTTP/3
HTTP/3 is the third major version of the Hypertext Transfer Protocol, which runs over QUIC instead of TCP to reduce latency, eliminate head-of-line blocking, and improve connection setup time.
HTTPS
HTTPS (HTTP Secure) is HTTP traffic encrypted inside a TLS session, protecting data confidentiality, integrity, and server authenticity between a client and a web server.
Keep-Alive
Keep-Alive, also called persistent connection, allows multiple HTTP requests and responses over a single TCP connection, reducing latency and overhead compared to opening a new connection per request.