---
title: GraphQL API
nav: GraphQL
group: Build your app
updated: 2026-11-13
description: Use your SashiDo app's GraphQL API. The endpoint and headers, queries and mutations generated from your classes, users and sessions, cloud functions, and the GraphQL console in the dashboard.
keywords: parse server graphql, sashido graphql, parse graphql api, graphql backend, parse server graphql queries, parse server graphql mutations
---

Every SashiDo app on Parse Server 3.5 or newer has a GraphQL API next to the REST API, with the same data, users and permissions. Its schema is generated from your classes: add a class or a field, and its queries and mutations are there.

## Endpoint and headers

The URL is in **App Settings › Security & Keys › GraphQL API URL**:

```text
https://pg-app-<id>.scalabl.cloud/graphql
```

Send the Application ID and a client key with each request, plus the user's session token once they've logged in:

| Header | Value |
|---|---|
| `X-Parse-Application-Id` | Application ID |
| `X-Parse-Javascript-Key` or `X-Parse-Client-Key` | the client key your app uses |
| `X-Parse-Session-Token` | after login: the user's session token |

Class-level permissions and ACLs apply exactly as with the REST API and the SDKs. The master key (`X-Parse-Master-Key`) bypasses them: use it only on a server.

## Try it in the dashboard

**Core › API Console › GraphQL Console** is a GraphQL playground already connected to your app, with your schema's documentation and autocompletion. It sends the master key, so everything is visible there; your clients see what their permissions allow.

## Queries

The examples are for Parse Server 4 and newer (SashiDo's 6.x). On 3.5 and 3.6 the schema has a different shape: check it in the console.

A class `Note` gives you `note(id:)` and `notes(...)`:

```graphql
query RecentNotes {
  notes(where: { done: { equalTo: false } }, order: [createdAt_DESC], first: 10) {
    count
    edges {
      node {
        objectId
        text
        createdAt
      }
    }
  }
}
```

```bash
curl -X POST https://pg-app-<id>.scalabl.cloud/graphql \
  -H "X-Parse-Application-Id: YOUR_APP_ID" \
  -H "X-Parse-Javascript-Key: YOUR_JAVASCRIPT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ notes(first: 10) { edges { node { objectId text } } } }"}'
```

## Mutations

```graphql
mutation AddNote {
  createNote(input: { fields: { text: "Buy milk", done: false } }) {
    note {
      objectId
      createdAt
    }
  }
}
```

`updateNote(input: { id: "...", fields: {...} })` and `deleteNote(input: { id: "..." })` work the same way.

## Users and sessions

```graphql
mutation SignUp {
  signUp(input: { fields: { username: "ada", password: "a-long-password", email: "ada@example.com" } }) {
    viewer {
      sessionToken
      user { objectId }
    }
  }
}
```

`logIn(input: { username: "...", password: "..." })` returns the same `viewer`. Send its `sessionToken` as `X-Parse-Session-Token` from then on; `query { viewer { user { username } } }` returns the logged-in user, and `logOut` ends the session.

## Cloud functions

```graphql
mutation Hello {
  callCloudCode(input: { functionName: hello, params: { name: "Ada" } }) {
    result
  }
}
```

## Next

- [Secure your app](/en/docs/developers/security): the permissions GraphQL respects.
- [Live Queries](/en/docs/developers/live-queries) for real-time updates.
- Parse's [GraphQL guide](https://docs.parseplatform.org/graphql/guide/) for the full schema: relations, files, pagination, custom resolvers.