GraphiQL Editor
Build and run GraphQL queries to any endpoint.
Only public http(s) endpoints. Internal/private addresses (localhost, 127.x, 10.x, 192.168.x, 169.254.x, host.internal) are rejected.
Risposta
Inserisci un endpoint, scrivi la tua query e premi Esegui Query per vedere la risposta qui.
Cos'e GraphQL?
GraphQL e un linguaggio di query per API che consente ai client di richiedere esattamente i dati di cui hanno bisogno, ne' di piu' ne' di meno.
A differenza di REST, un singolo endpoint gestisce tutte le operazioni: query (lettura), mutation (scrittura) e subscription (eventi in tempo reale).
Tipi di operazioni
query - Recupera dati (equivalente GET)
mutation - Modifica dati (equivalente POST/PUT/DELETE)
subscription - Stream di eventi in tempo reale
__schema - Introspect il tipo system dell'API
Suggerimenti
Usa la query di introspection predefinita per scoprire i tipi e le operazioni disponibili sull'endpoint.
Aggiungi un header Authorization: Bearer <token> per gli endpoint protetti.
Le variabili permettono di parametrizzare le query senza concatenare stringhe.
Come utilizzare GraphQL Explorer
Insert your GraphQL endpoint
Attach the full URL http:// or https:// of the tested GraphQL endpoint. Internal/private endpoints (localhost, local network IP, .internal/.local) are rejected for security reasons.
Write your query and variables
Use the default introspection query to explore the schema, or write your own query/mutation. In the "Variables" panel, insert a valid JSON if your query requires it.
Configure headers (optional)
Aggiungi header personalizzati come Authorization: Bearer <token> per endpoint protetti. Ogni header puo' essere abilitato o disabilitato singolarmente senza rimuoverlo.
Execute and read the response
Send Request - Execute to send the POST request. The JSON response appears with syntax highlighting and execution time; errors in GraphQL (in array "errors") are highlighted separately. Each query remains in history (last 5).
Suggerimenti
- Start with the query of introspection to understand what types and fields an endpoint exposes before writing complex queries.
- Use chronology to quickly compare response times between different queries on the same endpoint.
- In case of partial GraphQL errors (non-null data but valued errors), check the "path" field of each error to understand which field of the query failed.
Domande frequenti
Do my queries go through an intermediate server or directly to the endpoint?
Requests go directly from the browser to the GraphQL endpoint on the server, bypassing a proxy server. Since there is no SSRF risk on the server side, the tool still applies client-side checks that block non-HTTP(s) and internal hosts (localhost, RFC1918 IP addresses, link-local).
Why am I getting a CORS error or "Cannot reach the server"?
If the GraphQL endpoint does not include a CORS header that allows requests from federicocalo.dev, the browser blocks the response for security policy reasons. Verify that the server exposes an appropriate Access-Control-Allow-Origin header, or test the endpoint from an environment with CORS disabled/configured (e.g., a desktop client).
Are you authenticating requests to a protected endpoint?
Apri il pannello Header e aggiungi una riga con chiave Authorization e valore Bearer <il-tuo-token> (o il formato richiesto dall'API, es. API-Key). L'header viene inviato solo se la riga e' marcata come abilitata.
How do I use variables in GraphQL instead of concatenating values in the query?
Write the query with pre-defined placeholders (e.g., query($id: ID!)
Is the query history saved somewhere?
Session history (last 5 executions with endpoint, query, variables, result, and duration) lives only in browser session memory: not sent to any server and lost upon page reload. Use "Restore" on a history entry to bring it back into the form.