GraphQL

Codapult includes an optional graphql-yoga server for teams that prefer GraphQL over REST or tRPC. It is an independent module and can be removed without affecting other API layers.

The implementation is an independent API module.

Endpoint

The GraphQL endpoint is available at /api/graphql. It supports both GET (for queries via URL params) and POST (standard JSON body) methods.

In development, graphql-yoga serves a built-in GraphiQL playground at the same URL when accessed from a browser.

When to Use GraphQL vs tRPC

Both layers share the same auth primitives (getAppSession) and rate limiting. You can use both simultaneously.

Authentication

The GraphQL route checks auth and applies rate limiting (60 requests per 60 seconds):

const session = await getAppSession();
// session is available in resolver context

Pass the session to resolvers via the context object. Protected resolvers should check ctx.session before returning data.

Removal

GraphQL is a separately mapped optional module. Use the setup wizard:

npx @codapult/cli setup

For manual pruning, remove the route, schema, resolver, and package dependencies together, then run the project checks.