GraphQL plugin — a protocol adapter over REST

The content API, spoken as GraphQL. It is an adapter over the REST API’s own services, not a second API: it owns no schema of its own, adds no credential, and introduces no permission. A token minted before it existed works against it unchanged.

Install

npm install @apograph/content-graphql

Register

import { ContentGraphqlPlugin } from '@apograph/content-graphql';

const content = ContentPlugin({ types: contentTypes });

ContentGraphqlPlugin({
    content,
    ...config.plugins.contentGraphql,
    playground: config.docs.enabled === true
});

It takes the content plugin by value. That is what lets it fail the boot on two content types that would collide as GraphQL names, rather than on the first request from a workspace granted both.

Environment

Variable	What it bounds
`GRAPHQL_MAX_DEPTH`	Nesting depth of one query
`GRAPHQL_MAX_COMPLEXITY`	The computed cost budget
`GRAPHQL_MAX_FIELDS`	Fields one query may select
`GRAPHQL_MAX_QUERY_LENGTH`	Bytes of query text accepted
`GRAPHQL_SCHEMA_CACHE_TTL_MS`	How long a built schema is reused

GraphiQL rides the same switch as the Scalar API reference — both are developer tooling, and neither should be reachable in production unless the operator asks for it with API_DOCS=true.

The budgets exist because GraphQL lets a caller ask for arbitrarily much in one request. A deeply nested query over relations is an unbounded join with a polite syntax, and the depth and complexity limits are what stop one.

The schema cache is bounded

A schema is built per grant set — the set of content types a token can see — and the cache is bounded and TTL’d. Left unbounded it would keep one schema per grant set ever seen, which is a slow leak on an installation with many tokens.

Off by default in a new app

create-apograph-app asks which protocols the content API should speak. REST is always there; GraphQL and MCP are opt-in, because an endpoint nobody asked for is still an endpoint.

Add it later with npm install @apograph/content-graphql and the registration above.

See the GraphQL API for queries, arguments and the error shape.