Introspection

Clients rely on __schema, __type(name: …), and related fields to introspect the graph. Bundled GraphiQL issues those queries over GET, so dev‑first defaults (on) usually flip to off (or network‑segmented equivalents) alongside hardened POST traffic.

Companion guides: Security · Limits

Disable introspectionCopy Anchor Link

package main

import (
	"log"

	"example.com/hello-grx/graph"

	"github.com/grx-gql/grx"
)

func main() {
	srv, err := grx.NewServer(
		grx.WithSchema(graph.Schema()),
		grx.WithDisableIntrospection(),
	)
	if err != nil {
		log.Fatal(err)
	}
	_ = srv
}

Executors emit GraphQL errors for introspection-only operations whenever WithDisableIntrospection applies.

Turn off bundled GraphiQLCopy Anchor Link

package main

import (
	"log"

	"example.com/hello-grx/graph"

	"github.com/grx-gql/grx"
)

func main() {
	srv, err := grx.NewServer(
		grx.WithSchema(graph.Schema()),
		grx.WithPlaygroundPath(""), // no GET explorer
	)
	if err != nil {
		log.Fatal(err)
	}
	_ = srv
}

Assume POST /graphql is the supported API when production facing; host explorers internally (auth + SSO) whenever teams still crave UI assistance.

Keeping GraphiQL while disabling introspection is rarely productive - explorer panes stall without schema queries.

SDL export mirrorsCopy Anchor Link

**WithSchemaSDLPath** publishes schema text GET when configured. Omit it - or wrap with auth/proxy ACLs - as part of tightening schema disclosure.