Skip to main content
2026-07-29 16:01
GraphQL

Schema Introspection

QueryParseValidateMedium
Try Interactive Demo

What you will learn

  • Introspection is a powerful debug tool AND an information-disclosure vector — disable on public prod APIs
  • Test that __schema and __type queries are either allowed (dev) or return 403 (prod) — no half-measures
  • Field-level docstrings help clients, but NEVER include internal business logic, schemas, or secrets in descriptions

Description

Query the schema to discover types and fields.

Test Scenario

const query = `
  {
    __schema {
      queryType { name }
      mutationType { name }
      types { name kind }
    }
  }
`;
Endpoint/api/graphql

Testing Tips

  • •Use __schema and __type queries
  • •Discover available queries/mutations
  • •Check field types and descriptions
// Playwright API Testing - GraphQL
import { test, expect } from '@playwright/test';


test('GraphQL query', async ({ request }) => {
  const response = await request.post('/api/graphql', {
    data: {
      query: `
        query {
          users {
            id
            name
            email
          }
        }
      `
    }
  });


  expect(response.ok()).toBeTruthy();
  const { data } = await response.json();
  expect(data.users).toBeDefined();
});

Challenge ID: graphql-introspection

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/graphql

Press Enter to send