1. What is GraphQL?

GraphQL is a query language for APIs and a runtime that executes those queries against a type system defined by the server.

2. Who originally developed GraphQL?

GraphQL was developed at Facebook and publicly released as an open-source project in 2015.

3. How is GraphQL different from REST?

REST commonly exposes multiple resource-oriented endpoints, while GraphQL commonly exposes a single endpoint through which clients specify the fields and relationships they need.

4. What is a GraphQL schema?

A schema defines the types, fields, arguments, relationships, and operations available through the GraphQL API.

5. What is SDL?

SDL stands for Schema Definition Language. It is the syntax used to define GraphQL types and schemas.

6. What are Query, Mutation, and Subscription?

Query is used to retrieve data, Mutation is used for state-changing operations, and Subscription represents an event stream for real-time updates.

7. What is a resolver?

A resolver is a function responsible for obtaining or computing the value of a GraphQL field.

8. What is a GraphQL type?

A GraphQL type defines the structure and allowed values for data exposed through the schema.

9. What is the difference between String and String!?

String may be null, while String! indicates that the field must return a non-null string.

10. What is an argument in GraphQL?

An argument allows a client to provide input to a field, such as an ID used to retrieve a specific resource.

11. What is the N+1 problem in GraphQL?

It occurs when resolving a collection causes one additional data-access operation for each item, resulting in excessive database requests.

12. How does DataLoader solve N+1?

It batches multiple requests for related resources and commonly caches repeated loads within the same request.

13. What is a GraphQL fragment?

A fragment is a reusable selection set that allows clients to define a group of fields once and reuse them across operations.

14. What is an inline fragment?

An inline fragment allows a query to select fields conditionally based on the runtime type of an interface or union.

15. What is an alias?

An alias allows a client to give a different response field name to a selected GraphQL field.

16. What are GraphQL variables?

Variables allow dynamic values to be supplied separately from the query document instead of embedding values directly in the query string.

17. What is an input object?

An input object groups structured arguments for queries or mutations and is especially useful for complex mutation inputs.

18. What is the difference between an interface and a union?

An interface defines common fields that implementing object types must provide, while a union represents multiple possible object types without requiring shared fields.

19. Why are mutations usually designed with input objects?

Input objects provide a structured contract that is easier to extend, validate, and evolve than a long list of independent mutation arguments.

20. What is GraphQL introspection?

Introspection allows clients and tools to query metadata about the GraphQL schema itself.

21. What is the purpose of GraphQL directives?

Directives provide metadata or instructions that can influence how fields, selections, or schema elements are handled.

22. What is the difference between authentication and authorization?

Authentication determines who the caller is, while authorization determines what that caller is permitted to access or perform.

23. Where is authentication information commonly placed in a GraphQL server?

It is commonly processed before resolver execution and made available through the GraphQL context.

24. What is cursor-based pagination?

Cursor pagination uses opaque positions representing locations in an ordered result set instead of relying only on numeric offsets.

25. Why can cursor pagination be better for large datasets?

It can provide more stable traversal when records are inserted or removed and can avoid some expensive large-offset database operations.

26. What causes the N+1 problem in nested GraphQL fields?

Independent nested field resolvers can each request related data separately. Without batching, a list of parent objects can therefore generate one related-data query per parent.

27. Why should DataLoader normally be request-scoped?

Request scoping prevents cached values from one user's operation being reused in another user's operation and keeps batching aligned with a single GraphQL execution.

28. Why must a DataLoader batch function preserve key order?

The loader associates returned values with requested keys positionally. Therefore, the batch function must return a result corresponding to every input key in the same order.

29. What happens when a non-null GraphQL field resolver fails?

GraphQL propagates null upward through non-null parent fields until it reaches a nullable boundary or the response root, while reporting the error.

30. Can GraphQL return both data and errors?

Yes. A GraphQL response can contain partial data together with an errors array when some fields fail while others succeed.

31. Why is nullability an architectural decision?

Nullability determines how failures propagate through the response tree. Making a field non-null can cause failures to remove larger portions of the response.

32. What is query complexity analysis?

It estimates the resource cost of a GraphQL operation and can reject operations that exceed an allowed complexity threshold.

33. Why is query depth limiting insufficient by itself?

Depth measures nesting but not necessarily actual resource cost. A shallow field can still execute an extremely expensive database query.

34. How can GraphQL APIs prevent clients from requesting unlimited data?

They can enforce pagination, maximum page sizes, query complexity limits, depth limits, rate limits, and persisted operations.

35. What is optimistic UI?

Optimistic UI updates the client interface before the server confirms a mutation, assuming the operation will succeed and rolling back if it fails.

36. What is normalized caching?

Normalized caching stores entities independently under stable identifiers so that updates to an entity can affect multiple cached query results.

37. Why can GraphQL subscriptions require distributed infrastructure?

When multiple server instances exist, an event published on one instance may need to reach clients connected to another instance. A shared event system can distribute those events.

38. How should GraphQL errors be handled in production?

Expected business errors should have stable, safe representations, while unexpected internal details should be logged server-side without exposing sensitive implementation information to clients.

39. How can GraphQL schema changes remain backward compatible?

Prefer additive changes, deprecate old fields, migrate clients, monitor usage, and remove deprecated fields only after confirming they are no longer needed.

40. What is the difference between schema-first and code-first GraphQL?

Schema-first explicitly defines the GraphQL contract and implements code against it, while code-first constructs the schema from application code and types.

41. When would you choose federation over a monolithic GraphQL server?

Federation is useful when independent teams need autonomous ownership and deployment of different domain areas and the organization is prepared to handle distributed execution and schema governance.

42. What is a GraphQL BFF?

A Backend for Frontend is an API layer tailored to the needs of a particular frontend or group of clients. GraphQL can act as a BFF by aggregating data from multiple backend services.

43. What are persisted GraphQL operations?

They are known GraphQL documents registered ahead of execution and referenced by an identifier. They can improve security, observability, and request efficiency.

44. Why should business logic generally not live directly in resolvers?

Keeping business logic in services or domain modules improves reuse, testing, maintainability, and separation of concerns.

45. How would you debug a slow GraphQL query?

Start with operation-level timing, identify slow resolvers, inspect database and downstream service latency, check for N+1 access, examine query complexity, and use tracing to locate the actual bottleneck.

46. How would you design GraphQL authorization for multi-tenant applications?

Tenant identity should be established from trusted authentication context and every resource access should verify tenant ownership or membership. Client-provided tenant IDs should never be treated as sufficient authorization evidence.

47. How can GraphQL APIs be protected against denial-of-service style expensive queries?

Use authentication-aware rate limits, pagination bounds, query depth and complexity controls, persisted operations where appropriate, timeouts, resource quotas, and infrastructure-level protection.

48. What are the challenges of using GraphQL over multiple microservices?

They include network latency, partial failures, distributed authorization, duplicated data access, schema ownership, query planning, observability, and consistency across services.

49. How should file uploads be handled in a production GraphQL system?

Large files are commonly uploaded directly to object storage using a controlled upload mechanism, while GraphQL manages authorization and metadata rather than carrying large binary payloads through normal API requests.

50. How would you design a production-ready GraphQL API from scratch?

Start with domain-oriented schema design, define clear ownership and nullability, implement authentication and authorization, separate resolvers from business logic, use efficient data access and DataLoader, add bounded pagination and query protection, introduce testing and observability, and establish a safe schema-evolution workflow before scaling infrastructure.

51. A query loads 500 posts and performs 501 database queries. What would you investigate first?

Look for an N+1 relationship, such as an author resolver querying the database independently for every post. DataLoader or a carefully designed batch query would be a likely solution.

52. A user can query another user's private profile by changing an ID. What is wrong?

The API is authenticating the user but failing resource-level authorization. Ownership or permission checks must occur on the server before returning the requested resource.

53. A GraphQL mutation succeeds but the UI still displays old data. What could cause this?

The client's cache may not have been updated or invalidated. The application may need a normalized entity update, explicit cache modification, or a refetch depending on the operation.

54. A deeply nested query causes the server CPU to reach 100 percent. What controls could help?

Query depth limits, query complexity analysis, pagination, rate limiting, persisted operations, timeouts, and resolver/data-access optimization can reduce the risk.

55. One field in a dashboard fails while all other fields work. Can GraphQL still return useful data?

Yes, if the schema's nullability permits the failing field to become null. GraphQL can return partial data together with an error describing the failed field.

56. Your GraphQL API has 20 million records and offset pagination becomes slow. What would you consider?

Cursor-based pagination backed by suitable indexed ordering is a strong candidate because large offsets can require the database to skip many records.

57. A GraphQL subscription works locally but fails with multiple server instances. Why?

An in-memory event publisher exists independently in each process. Events need to be distributed through shared infrastructure so all relevant server instances can deliver them to connected clients.

58. A team wants to rename a widely used field immediately. What should you recommend?

Add the replacement field, deprecate the old field, migrate clients, monitor usage, and remove the old field only after compatibility requirements are satisfied.

59. A resolver contains authentication, business rules, five database queries, and an external API call. What architectural problem does this suggest?

The resolver has too many responsibilities. Authentication/context handling and business/data-access logic should be separated into appropriate middleware, services, repositories, or domain modules.

60. When should you avoid introducing GraphQL federation?

Avoid it when a single service is sufficient and the organization does not need independent domain ownership or deployment. Federation introduces distributed-system and governance complexity that should be justified by real requirements.