GraphQL API

A read-only GraphQL endpoint over the same data as the REST API. For changes (create, update, delete) use REST under /v1; the GraphQL schema has no mutations.

Authentication and access

Same as REST: a session cookie or an API key, service-account key or personal token in Authorization: Bearer. Scoped keys need admin:read. Every field checks the same permissions as its REST twin and is limited to the project you pass. An object you cannot reach resolves to null with extensions.code = "not_found"; the API never answers forbidden, so a missing object and a hidden one look the same.

Queries

projects(org), project(id), services(project), service(project, name), issue, issues, alertRule, alertRules, alert, incident, incidents, monitor, dashboard, release(project, version), deployment, team(project, slug), entity.

Edges: service.issues, service.owner, service.dependencies and service.dependents (the last hour of the dependency map), issue.release, issue.assignee, alert.rule, alert.incident, incident.timeline, entity.links, entity.neighbors(depth: 1..3).

services lists services that have a catalog entry. service.issues returns issues recorded against that service name.

Pagination

Lists take first (1 to 200) and after, and return {nodes, pageInfo{hasNextPage, endCursor}}. endCursor is the REST next_cursor of the same page, so the two APIs are interchangeable mid-listing.

Limits

Depth 10, complexity 1,000 (a list field costs first), 10 s per request, 128 KiB body. Introspection is off unless WT_GRAPHQL_INTROSPECTION=1 (on in development builds); use the SDL endpoint instead. Edges load through per-request batching, so asking for the issues of many services costs one query.