API endpoint

/api/graphql

POST

Demo baseline · November 13, 2026

Endpoint

/api/graphql. Use the platform base URL for your tenant. Check the active role and tenant before making requests.

POST

One bounded read-only GraphQL query using existing record authorization, tenant and field policies. No mutations, subscriptions or batches.

Operation ID governedGraphqlRead

Parameter	Location	Requirement	Description
`request`	body	Required

request schema

{
  "type": "object",
  "required": [
    "query"
  ],
  "properties": {
    "query": {
      "type": "string",
      "description": "Read query document; maximum 16 KiB and 2000 parser tokens"
    },
    "operationName": {
      "type": "string"
    },
    "variables": {
      "type": "object",
      "additionalProperties": true
    }
  }
}

Status	Published response
`200`	Typed data and optional GraphQL execution errors
`400`	Invalid or oversized read query
`403`	Session or capability access denied

See API authentication and query examples and Troubleshooting by symptom.