Endpoint BayISSUE #21 of 45

graphql · queries · mutations · subscriptions

RestaVSThe 401 Bandit

Resta saysGraphQL has three operation types: queries (read), mutations (write), subscriptions (real-time).

Queries fetch data; mutations change it (create/update/delete) and return the result; subscriptions stream live updates over a persistent connection (typically WebSocket). One schema defines all three, so the client uses the same typed, field-selecting syntax whether reading, writing, or listening.

Power-ups you unlock

query = read · mutation = write
subscription = real-time stream
Mutations return the changed data
Same typed syntax across all three

The 401 Bandit attacks — common mistakes

Doing writes inside a query
Expecting subscriptions over plain HTTP
Not returning the updated object from a mutation

Boss battleWrite a mutation that creates a post and returns its id and title.

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre>mutation {
  createPost(title: "hi") {
    id
    title
  }
}</pre></body></html>

▶ Open the interactive comic issue

‹ Graphql · Query Language For Apis Graphql · Schema · Resolvers · Types ›