When GraphQL fits and what it costs

API design: REST, HTTP, GraphQL and gRPC Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

A public GraphQL API slows to a crawl when someone queries friends of friends of friends. First defence?

Options
Hint 1 of 1

Who decides how expensive a query can be?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Enforce query depth and complexity limits (and prefer persisted queries)

Correct. Reject expensive queries before running them.

In GraphQL the client chooses how deep a query goes, so one request can fan out into millions of resolver calls. Rejecting queries over a depth or cost budget before running them caps that work.

Why not the others?
  • B Add more servers. One crafted query can still cost more than any fleet.
  • C Switch every query to GET. Changes caching, not cost.
  • D Remove the friends field. Removes a feature instead of limiting abuse.

30-second answer

GraphQL fits when many clients need different shapes of related data: one endpoint, a typed schema, and each client asks for exactly the fields it needs, avoiding over-fetching and chains of requests. The costs: N+1 database queries from naive resolvers, harder HTTP caching because everything is a POST to one URL, and expensive queries clients can write unless you limit depth and complexity.

Practise saying it · 35 s. No recording, just a timer

When does GraphQL fit?

Say your answer out loud, then check which of these points you covered:

  • Many clients, different shapes
  • Typed schema, one endpoint
  • N+1: DataLoader
  • Caching is harder
  • Depth and cost limits

Deep dive

Batch resolvers with DataLoader per request.

Persisted queries (a hash the server knows) allow GET caching and block arbitrary queries.

Limit depth, complexity and page sizes; time out slow queries.

With plain application/json, errors usually come back as 200 with an errors array; the GraphQL-over-HTTP application/graphql-response+json type allows 4xx for request errors. Either way, monitoring must read the body.

Common mistakes

  • Exposing the database schema as the GraphQL schema.
  • No depth or cost limits on a public endpoint.
  • Assuming GraphQL removes the need for versioning discipline (fields still need deprecation).

Senior take & follow-ups

Give the fit (many clients, shaped reads), then N+1, caching and query-cost limits.

Follow-up questions

Think of your answer first, then open the hint.

  1. How do you cache GraphQL?

    Show hint

    Persisted queries over GET, response caching per query hash, and client-side normalized caches.

  2. What's a federation gateway?

    Show hint

    A gateway that combines schemas owned by different services.

Related questions

Suggest a fix if something here is wrong or out of date.