A mature GraphQL test suite should cover schema validation, resolver behavior, authorization, authentication, successful queries, invalid queries, mutations, pagination, filtering, DataLoader behavior, error responses, and important integration paths.

Test both positive and negative scenarios. A GraphQL API that only tests successful requests can still contain serious authorization and validation vulnerabilities.