GraphQL API

Every SashiDo app on Parse Server 3.5 or newer has a GraphQL API next to the REST API, with the same data, users and permissions. Its schema is generated from your classes: add a class or a field, and its queries and mutations are there.

Endpoint and headers

The URL is in App Settings › Security & Keys › GraphQL API URL:

https://pg-app-<id>.scalabl.cloud/graphql

Send the Application ID and a client key with each request, plus the user's session token once they've logged in:

Header	Value
X-Parse-Application-Id	Application ID
X-Parse-Javascript-Key or X-Parse-Client-Key	the client key your app uses
X-Parse-Session-Token	after login: the user's session token

Class-level permissions and ACLs apply exactly as with the REST API and the SDKs. The master key (X-Parse-Master-Key) bypasses them: use it only on a server.

Try it in the dashboard

Core › API Console › GraphQL Console is a GraphQL playground already connected to your app, with your schema's documentation and autocompletion. It sends the master key, so everything is visible there; your clients see what their permissions allow.

Queries

The examples are for Parse Server 4 and newer (SashiDo's 6.x). On 3.5 and 3.6 the schema has a different shape: check it in the console.

A class Note gives you note(id:) and notes(...):

query RecentNotes {
  notes(where: { done: { equalTo: false } }, order: [createdAt_DESC], first: 10) {
    count
    edges {
      node {
        objectId
        text
        createdAt
      }
    }
  }
}

curl -X POST https://pg-app-<id>.scalabl.cloud/graphql \
  -H "X-Parse-Application-Id: YOUR_APP_ID" \
  -H "X-Parse-Javascript-Key: YOUR_JAVASCRIPT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ notes(first: 10) { edges { node { objectId text } } } }"}'

Mutations

mutation AddNote {
  createNote(input: { fields: { text: "Buy milk", done: false } }) {
    note {
      objectId
      createdAt
    }
  }
}

updateNote(input: { id: "...", fields: {...} }) and deleteNote(input: { id: "..." }) work the same way.

Users and sessions

mutation SignUp {
  signUp(input: { fields: { username: "ada", password: "a-long-password", email: "ada@example.com" } }) {
    viewer {
      sessionToken
      user { objectId }
    }
  }
}

logIn(input: { username: "...", password: "..." }) returns the same viewer. Send its sessionToken as X-Parse-Session-Token from then on; query { viewer { user { username } } } returns the logged-in user, and logOut ends the session.

Cloud functions

mutation Hello {
  callCloudCode(input: { functionName: hello, params: { name: "Ada" } }) {
    result
  }
}

Next

• Secure your app: the permissions GraphQL respects.
• Live Queries for real-time updates.
• Parse's GraphQL guide for the full schema: relations, files, pagination, custom resolvers.