Run a GraphQL operation
The GraphQL endpoint for queries and mutations; subscriptions use graphql-ws on the same path. The schema and every operation are documented in schema.graphql at the repository root. Send the session as a Bearer token; each root field declares its own auth (public or session). The media cookie is never read here.
Try the REST routes against the public demo at https://demostash.aldyernesto.my.id. Get a read-only token (valid for 60 minutes), then paste it as the Bearer token in the console of any route.
The GraphQL endpoint for queries and mutations; subscriptions use graphql-ws on the same path. The schema and every operation are documented in schema.graphql at the repository root. Send the session as a Bearer token; each root field declares its own auth (public or session). The media cookie is never read here.
application/json- body
query*stringThe GraphQL document.
variables?Operation variables.
operationName?stringWhich operation of the document to run.
GraphQL result (errors are inside the body)
application/json- response
data?|The result, shaped by the query.
errors?array<>Errors; each carries extensions.code.
curl -X POST "https://example.com/api/graphql" \ -H "Content-Type: application/json" \ -d '{ "query": "string" }'{ "data": { "property1": null, "property2": null }, "errors": [ { "property1": null, "property2": null } ]}Run a GraphQL query (GET) GET
GraphQL over GET for queries only (query and variables in the URL). The schema and every operation are documented in schema.graphql at the repository root; each root field declares its own auth (public or Bearer session).
Health check GET
Public and served before first-run setup. Everyone gets ok and setupRequired and version; a loopback client (the TCP peer, never a forwarded header) or a Bearer session whose account may configure the instance (instance.configure) also gets db and cache and storage and schemeMismatch. 503 carries the same body with ok false.