GraphQL enables API consumers to retrieve data from backend services by defining the specific data needed in a query. This contrasts with REST APIs where the resource structure is defined by the provider. While GraphQL gives consumers more control, it also requires management of queries' impact on backend systems. API management solutions can enforce throttling, rate limits, access controls and pricing models for GraphQL APIs to provide threat protection and differentiated API plans.

1. Secure & Manage APIs using
GraphQL
Ozair Sheikh
Program Director - API & Gateways
IBM
1
medium.com/@ozairs
linkedin.com/in/ozairsheikh

2. API History 101
• Do we really need
GraphQL?
• Technology is always
providing developers
new solutions to
existing problems
• Lets step back and
understand how we got
here

3. API 1.0 a.k.a SOA
• API interface represent the
“contract” (ie WSDL) created by
the API Provider
• API Provider: exposes contract to
API consumer
• API Consumer: tries to consume
service based on “contract”

4. API 1.0 - SOA
Advantage: API Provider
API Provider API Consumer
• API Provider controls the
service interface
• API Consumer does not have
much input into the design
of the “contract”

5. API 2.0 a.k.a REST
• API interface is
represented by modern
contract (ie “OpenAPI”)
• API Provider: exposes
RESTful interface
• API Consumer: self-service
discovery via developer
portals & simplified
consumption

6. API 2.0 - REST
Advantage: Tie
• API Provider provides
simpler interface of service
implementation
• API Consumer able to self-
discover and use modern
standards to invoke API

7. API 3.0 a.k.a
GraphQL
• Query language and
implementation paradigm
for data-centric APIs
• API Consumer define the
data they need (and
nothing more)
• API Provider: Handles
complexity of obtaining
data from backend
systems

8. API 3.0 - GraphQL
Advantage: API
Consumer
• API Consumer maintains
control over the data
independent of the data
structure within backend
systems

9. GraphQL vs REST
§ In GraphQL, profiles, or resource access
rules depend on the query:
POST ../graphql
{ me { name, age }}
POST ../graphql
mutation {
createK8Cluster (name: "c1"){
clusterId
}
}
vs.
GET …/profiles/me
vs.
POST …/resources/k8cluster
§ In REST APIs, profiles, or resource access
rules are defined for endpoints:
Q: Is GraphQL replacing REST?
A: No. REST APIs are well-defined interfaces with standard error codes, easily
cached and optimized for the HTTP protocol.
GraphQL provides an alternative query-based approach, optimized for data-
intensive operations

10. GraphQL
Endpoints
• Single GraphQL transaction
may invoke multiple backends
POST /sports/graphql? HTTP/1.1
query {
Players (name: "John T") {
name
league
team {
name
arena {
name
…
}
city
}
}
}
Server
1. GET …/players/
2. GET …/team/player.name=?
3. GET …/arena/team.name=?

11. Understanding
Queries
• What can we learn from
other query languages (ie
SQL)
• How can a “Bad Query”
from an API consumer
overwhelm backend
systems
• Bad queries can be
malicious (ie SQL
Injection) or unintentional
(bad programming)
Select * From Transactions
SELECT cust.name, address.name, …. {infinite
attributes}
FROM cust, address, … {infinite tables},
WHERE cust.name = address.name AND …. {infinite
joins}
Selecting all data from a database
Complex and nested queries with multiple table joins

12. Throttling &
Rate Limits
• Throttling: Protect backends when
system usage spike
• Single transaction can trigger
multiple nested backend calls on
GraphQL server
• Manage transaction calls based on
backend service calls to reflect
compute time
• Rate Limits: Consumer X is allowed
access to Y transactions
Server

13. API Management
of GraphQL
• Threat Protection
• Rate Limit

14. GraphQL Management
GraphQL
Management
Runtime gateway
Initiali-
zation
introspection
query
(if allowed)
Server
Policy definition &
configuration
policy, config.Policy enforcement
query
inspection
Query inspection
Static
analysis
schema
GraphQL client

15. Technical Details …
{
"maxNesting": 2,
"operationType": "query",
"resolveCounts": {
"query:users": 1,
"user:employerCompany": 5
},
"typeCounts": {
"user": 5,
"company": 5
},
"typeComplexity": 10,
"resolveComplexity": 6
}
Think threat
prevention…
Think rates…
Think access
control or
pricing…

16. Threat
Protection
• Detect and reject requests with
complex nesting
• Pre-calculate load to determine if
query will overwhelm backends
• GitHub GraphQL API uses a point
system to individually calculate cost
for different query parameters

17. API Plans (1 of 2)
GOOD
BETTER
BEST
{ REST }

18. API Plans (2 of 2)
PREMIUM
GOLD
Levels = 10
Levels = 100

19. Summary
• GraphQL enables API
consumer to easily
retrieve data from data-
intensive services
• GraphQL management
requires insight into the
impact of a query on
backend systems
• API Management of
GraphQL APIs enables
differentiated API plans &
new threat protection
policies