GraphQL
A query language for APIs that lets the client ask for exactly the fields it needs from one endpoint, removing over-fetching and under-fetching.
· Reviewed by senior engineers
GraphQL is a query language and runtime for APIs developed by Facebook in 2012 and open-sourced in 2015. Instead of a fixed set of REST endpoints each returning a fixed payload, a GraphQL server exposes a single endpoint and a typed schema. The client sends a query describing the exact shape it wants — fields, nested relations, arguments — and the server returns precisely that.
GraphQL shines when one screen needs data from many resources, when you have many client types (web, iOS, Android, partner) each wanting slightly different fields, or when network round-trips are expensive. The Shopify Storefront API, GitHub API and most modern headless CMSs offer GraphQL for exactly these reasons.
The trade-offs are real. Caching is harder because every query is a POST with a different body, n+1 database queries are easy to write and hard to spot, and authorisation has to be enforced field-by-field rather than per endpoint. Tools like persisted queries, DataLoader and schema directives address each of these, but they have to be set up consciously.
At devinsta we use GraphQL where it earns its keep — headless storefronts, dashboards with deeply nested data, and mobile apps where bandwidth matters — and stick with REST elsewhere. We always pair GraphQL with query complexity limits, depth limits and a persisted query layer to keep the public surface safe.