Query connected application data in one request.

Confirm GraphQL is enabled

GraphQL is optional. Enable it in the server configuration for the deployed release, restart/reconfigure as required, and request /graphql. Treat a disabled route as an intentional deployment choice, not an application error. Keep JSON:API available when its resource and relationship semantics better fit a client.

Inspect the generated schema

The schema is derived from the active Daptin data model. Inspect it after importing or changing tables; do not assume field and operation names from a different installation. Begin with a small query for one existing type, then add relationships and fields .

curl --fail http://localhost:6336/graphql \
  -H 'Content-Type: application/json' \
  --data '{"query":"{ __schema { queryType { name } } }"}'

A successful response should contain a data object. GraphQL can return HTTP 200 with an errors array, so clients must inspect the response body as well as the status code.

Test authorization through GraphQL

1. Run the intended query as an administrator to verify the generated shape.
2. Repeat as the real application role with its bearer token.
3. Query a record the user may read and one they may not read.
4. Attempt a mutation or action the role must not execute and preserve the refusal as a regression test.

GraphQL is another interface to the application model; it is not a permission bypass. Configure access in Permissions and account lifecycle in Authentication.

Choose GraphQL or JSON:API by client task