GraphQL introspection

What it means

GraphQL introspection is a built-in feature that lets a client ask a GraphQL server to describe itself. A single query returns the types, fields, arguments and operations the API supports, along with a short description of each. Developer tools use it to offer auto-complete, to generate documentation and to check queries before they are sent.

In effect the server hands over a complete map of what can be asked. That is helpful while you build. On a live product it also shows a stranger every query and mutation, including ones the interface never calls and ones you meant to keep internal.

Why it matters

A full schema saves an outsider hours of guessing. They can spot admin mutations, internal fields and old operations, then test each one. Introspection does not break anything on its own, but it makes the next step cheaper, and it can expose names that hint at features you have not announced.

The wrong lesson is to treat the schema as secret. Disabling introspection may slow someone down, yet it does not fix a missing permission check. If a mutation lacks one, it is still open to anyone who finds its name, and names can be guessed or taken from your own app.

How it shows up

Many GraphQL servers have introspection on by default. You can check by sending a query for the __schema field to your production endpoint. OWASP advises turning it off in production for APIs that are not meant to be public, and some servers still hint at field names in error messages even then.

The sensible order is: first make every field and mutation check who is asking, then switch introspection off where it is not needed, then test again. Keep it on for a public API whose documentation you want others to use. See also GraphQL and excessive data exposure.