Exposing GraphQLs as Managed APIs
2 likes508 views
The document provides an overview of GraphQL, its advantages over REST, and WSO2 API Manager's support for GraphQL features in version 3.0. It discusses how GraphQL allows for more efficient data retrieval through a single query and the importance of API management for GraphQL services. Additionally, it highlights the roadmap for upcoming features and offers insights into use cases for API developers.
Exposing GraphQLs as Managed APIs
- 1. Exposing GraphQLs as Managed APIs Fazlan Nazeem, Associate Technical Lead, WSO2 Hiranya Abeyrathne, Software Engineer, WSO2
- 2. Agenda ● Introduction to GraphQL ● REST vs GraphQL ● Why API Management ● Graphql Support - WSO2 APIM 3.0.0 ● Demo ● Roadmap of upcoming GraphQL features. ● Q&A
- 4. GraphQL ● A query language for your API. Not a programming language. ● Ask what you need, and get exactly that. ● Developed internally by Facebook in 2012 before being publicly released in 2015. ● Specification : https://graphql.github.io/graphql-spec/June2018/ ● Reference Implementation: https://github.com/graphql/graphql-js ● Implementations of the GraphQL client, server in various languages are available. https://graphql.org/code/ ● GraphQL foundation : Airbnb, AWS, Apollo, Coursera, Facebook, GitHub, Prisma, Shopify, IBM and Twitter ● Typically served over HTTP via a single endpoint which expresses the full set of capabilities of the service.
- 5. Type System ● Defines the capabilities of an API ● All the types are exposed in an API, written down in a language called (SDL) GraphQL Schema Definition Language ● Contract between the client and the server. Once it is defined, both sides are aware of the data structure ● There are some special root types (Query,Mutation,Subscription) - operations
- 6. Query Fetching Data with Queries Ex1: Facebook
- 8. Mutation Writing data with Mutations (Making changes to the data stored in the backend - create/update/delete) ● POST : <Endpoint URL> payload: { query: “mutation createPerson {name: ‘Alice, age:36’}”} mutation { createPerson(name: "Alice",age: 36) { Id } } { "data": { "createPerson": { "id": "1234" } } }
- 9. Subscription Real time updates with Subscriptions (Have a real time connection to the server) subscription { submitComment { message } }
- 10. REST vs GraphQL
- 11. Rest vs GraphQL (Contd) Ex: An app needs to display the titles of the posts of a specific user. The same screen also displays the names of the last 3 followers of that user. How would that situation be solved with REST and GraphQL? REST : Accessing multiple Endpoints /users/<id> - Fetch initial user data /users/<id>/posts - Fetch all the posts for a user /users/<id>/followers - Returns a list of followers per user.
- 12. Rest vs GraphQL (Contd) GraphQL : Sends a single query Pass the query to the GraphQL server that includes the concrete data requirements. ( The client can specify exactly the data it needs in a query)
- 13. GraphQL Strengths and Weaknesses • No more Over-fetching and Under-fetching • Rapid Product Iterations on the Frontend • Insightful Analytics on the Backend • Benefits of a Schema & Type System • Queries send more bytes than REST • Caching is complicated • Server needs to do more processing • Extra cautions for GraphQL specific attacks
- 15. API Management for GraphQL Services • First class support for creating/publishing GraphQL APIs. • Different levels of permissions for each operation. • Different levels of rate limiting levels for each operation. • Threat Protection ( Malicious/unintentional/Poor Queries ) • Operational Level Analytics.
- 16. Graphql Support WSO2 APIM 3.0
- 17. What WSO2 APIM 3.0 Offers? ● First class support for Graphql APIs ○ Create a Graphql API by importing an SDL schema ○ Identify Graphql APIs automatically in the portals ○ Display operation list instead of resources ○ Display SDL schema instead of open API definition ○ Download option for SDL schema ○ Search option to Graphql type APIs ( type: GRAPHQL) ● Operational Level Security, Authorization and Rate limiting
- 18. Demo
- 19. Use Case - API Developer Mike needs to expose the “Countries” API with the following rules 1. Continents operation needs to be authorized only for managers 2. Continents operation should be allowed for only one request per minute 3. Languages operation needs to be available for everyone
- 20. Jane needs to invoke Countries API which has been published through WSO2 APIM 3.0.0 to retrieve the following. • Code, name of all languages. • Name of all countries, code, name of all languages in each country • Name of all continents, Name of all countries in each continent, Code, name of all languages of each country. Use Case - Application Developer
- 21. API Invocation
- 23. Roadmap ● Threat Protection ● Analytics support ● Websocket Subscription ● Micro-gw support
- 24. Q & A
- 25. ● Download and try out: https://wso2.com/api-management/ ● Slack Channel: https://app.slack.com/client/TLVKGQN84/CLVKGR3BN ● GitHub: https://github.com/wso2/product-apim/issues
- 26. Webinars to Follow ● November 14 - API Security in a Cloud Native Era ● November 19 - Cloud Native APIs: The API Operator for Kubernetes ● November 21 - Beautifying the Beautiful: Theming WSO2 API Manager ● December 03 - Mine Your APIs for Gold: API Monetization ● December 05 - Building a CI/CD Pipeline for APIs