<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1063935717132479&amp;ev=PageView&amp;noscript=1 https://www.facebook.com/tr?id=1063935717132479&amp;ev=PageView&amp;noscript=1 "> Learn GraphQL 102

Learn GraphQL 102

Before you begin

If you find bugs in this training or have suggestions, create an issue or email contact@bitovi.com.

Overview

In GraphQL 101, you built an API for a fictional insurance company. It works, but it isn’t ready for real users yet. It returns every claim in one response, it accepts dates that don’t exist, it tells anyone who asks exactly how it’s built, anyone can issue a policy, and nothing stops a client from sending a query big enough to slow it down.

This course fixes those problems, one section and exercise at a time.

After this course, you’ll be able to:

  • Paginate long lists with cursor-based connections
  • Use a custom scalar from a library to reject invalid values
  • Return errors that clients can act on
  • Protect an API from leaking its details, and from expensive queries
  • Decide who can see and change which data
  • Mark how long data can be cached, and cache repeated queries on the server
  • Explain how subscriptions push live updates to clients
  • Describe what else changes when a GraphQL API runs in production

Prerequisites

This course assumes you’ve completed GraphQL 101, or are comfortable writing queries, mutations, schemas, and resolvers.

Outline

  1. Course Setup: create the course Codespace and start the API
  2. The Course Data: the policyholders, policies, and claims the API starts with
  3. Pagination: return claims one page at a time with cursors and connections
  4. Custom Scalars: replace plain-string dates with a date type that rejects invalid dates
  5. Error Handling: return coded errors for mistakes, and typed results for problems the user needs to see
  6. Security: turn off introspection, hide schema details from errors, and limit page size and query depth
  7. Authorization: decide who can see and change which data, and let only agents issue policies
  8. Caching: mark how long data can be cached, and serve repeated queries from a server-side cache
  9. Subscriptions: how a server pushes live updates to clients, and when to use them instead of polling
  10. Performance and Hosting: persisted queries, compression, monitoring, health checks, and a production checklist
  11. Wrapping Up: what you changed, and where to go next