You should manage internal access to your supergraph as thoughtfully as you manage communication from external clients. GraphOS provides both graph API keys and personal API keys to restrict access to the graphs within an organization. It also supports SSO integration and different member roles so that team members can be assigned appropriate permissions when contributing the graph.

Cloud supergraph s require an Apollo organization on the Serverless (Free) or Serverless plan. Learn more about plans. With schema stitching, you must define the “stitching” in the gateway yourself. Your team now has a separate service that needs to be altered, which limits flexibility. The use case for schema stitching is when your underlying services are not all GraphQL. Schema stitching allows you to create a gateway connected to a REST API, for example, while federation only works with GraphQL. Without any restrictions in place, clients could effectively enumerate through all nodes in a single request like the one above while slipping past other brute force protections. Limiting query breadth or using query cost analysis can help protect a GraphQL API from this type of abuse. If you have your own existing subgraph s that you want to use instead of these examples, feel free! Provide their names and URLs wherever you see the example subgraphs used in the steps below. Most supergraph s have multiple variants , each of which represents that supergraph running in a different environment (production, staging, and so on).role header from context to requests to all subgraphs (inserting a user’s role to context is performed by a custom Apollo Router plugin; it will be shown later) While you're building operation s in the Explorer , you can see which subgraph each field of your operation originates in by enabling subgraph hints from the Explorer's Settings tab. Creating a new supergraph variant always requires also creating the first subgraph for that variant. You can omit @ and the variant name. If you do, Rover uses the default variant, named current . Composing a supergraph schema supergraph compose Particularly for GraphQL APIs that are consumed by third-party clients, depth and breadth limiting and paginated field s may not provide enough demand control. For these cases, rate-limiting API requests may be warranted. Enforcing rate limits for a GraphQL API is more complicated than a REST API because GraphQL operation s may vary widely in size and complexity so the rate limit can't be based on individual requests alone. Instead, we have to think about how much of the graph an operation may traverse in the context of a single request.

For example, you might want to set fixed costs for different kinds of nodes, or you might manually set costs on a per-type or per- field basis by annotating them with directive s (or do some combination of both). You might also have different considerations for how type complexity (the cost returning the number of field s requested) and response complexity (the cost of providing responses for the requested field s) are handled. Or for a completely different approach that doesn't explicitly count types and fields, you could set and iterate query costs based on field tracing data and set a maximum time budget per query. Deleting a subgraph in Studio has no effect on your actual running subgraph instance. It only removes your router 's knowledge of that instance and its corresponding schema field s. Because our router is connected to GraphOS , it automatically collects and reports metrics on incoming operation s and their field s. You can then visualize those metrics in Studio.

What is GraphQL

This auto-update flow will cause issues if you don't update your router version prior to updating your composition pipeline. We strongly recommend always specifying an exact federation_version . Preventing auto-updates This method of adding a variant is available only to cloud supergraph s. For other graph types, see Adding a variant via the Rover CLI

rover subgraph publish supergraph-router@dev --routing-url http://products:4000/graphql --schema subgraphs/products/products.graphql --name products We'll cover these concepts in more detail as we proceed through the steps below. 1. Set up Apollo tools Displays the results of recent launches executed for your supergraph. A launch occurs whenever changes are made to one of your subgraph schemas, resulting in an update to your router. Learn moreFeel free to use whichever server library best suits your organization. Different subgraph s can even use completely different libraries, which is helpful if your various microservices use different languages. How do clients query my supergraph? The greatest difficulty in using federation is figuring out _when_ to use it. Many teams find it improves their infrastructure and increases performance. But that isn’t true in all cases. Next, we'll cover some of the most common and important actions to perform on your new supergraph , including: A supergraph enables the use of powerful tooling for schema management, metrics aggregation, and change validation. Learn more about GraphOS tooling.