GraphQL is an open-source query language for APIs and a runtime for fulfilling those queries with existing data. Developed by Facebook in 2012 and open-sourced in 2015, it provides a complete and understandable description of the data in your API.

Primary problems solved:
- **Over-fetching**: Clients receive only the specific fields they request.
- **Under-fetching**: Multiple nested resources can be retrieved in a single request instead of round-tripping to multiple endpoints.
- **Strong Typing**: The API schema serves as a strict contract between client and server.

Q1: What is GraphQL and what primary problem does it solve?

In REST, endpoints represent resources (e.g., `/users`, `/posts`), and data structure is fixed by the server. GraphQL uses a single endpoint (typically `/graphql`) where clients post a structured query specifying the exact response shape.

REST vs GraphQL Comparison

Q2: How does GraphQL differ from a traditional REST API?

The GraphQL Schema defines the hierarchy of types, fields, inputs, and operations available on the server. **Schema Definition Language (SDL)** is the standard human-readable syntax used to write GraphQL schemas.

```graphql
type User {
  id: ID!
  name: String!
  email: String
}
```

Q3: What is the GraphQL Schema and SDL?

GraphQL supports three primary root operations:
1. **Query**: Read-only fetches (analogous to HTTP GET).
2. **Mutation**: Write operations that create, update, or delete data (analogous to POST/PUT/DELETE).
3. **Subscription**: Event-driven real-time updates maintained over long-lived transport (e.g., WebSockets).

Q4: What are the three root operation types in GraphQL?

GraphQL includes five built-in primitive scalar types:
- `Int`: Signed 32‐bit integer.
- `Float`: Signed double-precision fractional value.
- `String`: UTF‐8 character sequence.
- `Boolean`: `true` or `false`.
- `ID`: Unique identifier serialized as a String, often used to re-fetch objects.

Q5: What are the built-in scalar types in GraphQL?

Basic JavaScript Resolver

A resolver is a function that populates the data for a specific field in a GraphQL schema. Every field on every type in GraphQL is backed by a resolver function on the server.

Q6: What is a GraphQL Resolver?

Standard GraphQL resolvers in JavaScript environments receive four positional arguments:
1. `parent` (or `obj`): The result returned from the resolver on the parent field.
2. `args`: The parameters/arguments passed into the field in the GraphQL query.
3. `context`: Shared contextual state across all resolvers in a request (e.g., auth user, DB instances).
4. `info`: AST and execution information regarding the query state.

Q7: What are the four standard arguments passed to a GraphQL resolver?

GraphQL Fragment Example

A fragment is a reusable unit of a GraphQL query. It allows developers to construct sets of fields and include them in multiple queries, preventing code duplication.

Q8: What are GraphQL Fragments and why are they used?

Querying with Aliases

Aliases allow you to rename the result of a field in a query. They are essential when you need to query the exact same schema field multiple times with different arguments in a single request.

Q9: What are GraphQL Aliases and when should you use them?

GraphQL variables allow query values to be dynamic without constructing queries via string manipulation. 

Benefits:
- **Security**: Prevents query injection attacks.
- **Caching**: Allows GraphQL servers/clients to compile and cache static query document structures.
- **Readability**: Keeps document text clean and re-executable.

Q10: Why should you use variables instead of inline string interpolation in queries?

Enum SDL Definition

Enumerations (Enums) are special scalar types restricted to a predefined set of allowed values. Enums ensure type safety when a argument or field must only take one of a small set of possible values.

Q11: How do Enum types work in GraphQL?

`input` object types define complex object structures passed as arguments into queries or mutations. 

Differences:
- **Object Types (`type`)**: Define output structures fetched from the server. They can contain fields with arguments.
- **Input Types (`input`)**: Define input structures sent to the server. Fields cannot accept arguments or contain output object types.

Q12: What is an Input Object type and how does it differ from an Object type?

Null Bubbling

Fields in GraphQL are nullable by default to handle distributed system errors gracefully. If a database query fails or a microservice is down, a single nullable field can evaluate to `null` while returning partial data for all valid fields without crashing the entire query.

Q13: Why are fields in GraphQL nullable by default?

Introspection is the ability of a GraphQL server to expose its own schema details to clients through special top-level fields like `__schema` and `__type`. IDEs (GraphiQL, GraphQL Playground) use introspection to auto-generate docs and autocomplete queries.

Q14: What is GraphQL Introspection?

Using Directive in Query

Directives modify query execution based on runtime conditions:
- `@include(if: Boolean)`: Includes a field/fragment only if the argument evaluates to `true`.
- `@skip(if: Boolean)`: Skips a field/fragment if the argument evaluates to `true`.

Q15: What are `@include` and `@skip` directives?

GraphQL Interface Syntax

An `interface` is an abstract type that defines a set of fields that any implementers must include. Object types can implement one or multiple interfaces.

Q16: How do Interfaces work in GraphQL SDL?

Union Definition and Querying

A `union` type represents a object choice across multiple concrete types, but members do **not** need to share common fields (unlike an interface).

Q17: What are GraphQL Union types and how do they differ from Interfaces?

`__typename` is a reserved introspection field accessible on any GraphQL type. It returns a string containing the exact runtime object type name. It is heavily utilized by client libraries (like Apollo Client and Relay) for cache normalization and type identification on unions and interfaces.

Q18: What is the `__typename` field used for?

The N+1 problem occurs when a query fetches a list of $N$ items, and for each item, an independent database call is executed to fetch a related field. This results in 1 initial query plus $N$ sub-queries ($1 + N$), crippling server performance.

N+1 Execution Flaw

Q19: What is the N+1 problem in GraphQL?

DataLoader (created by Facebook) solves N+1 through **batching** and **caching** during execution.

It defers individual load requests occurring within a single event loop tick, combines those IDs into a single batch array, and executes **one** consolidated batch query (e.g., `WHERE id IN (...)`).

Q20: How does DataLoader solve the N+1 problem?

When built-in primitives are insufficient, custom scalars (e.g., `Date`, `JSON`, `URL`) can be defined in SDL and provided custom logic for:
1. **`serialize`**: Converts back-end output to JSON.
2. **`parseValue`**: Parses variables sent in JSON requests.
3. **`parseLiteral`**: Parses inline AST literal values inside queries.

Q21: How do you implement a Custom Scalar in GraphQL?

Custom directives (prefixed with `@`) attach custom behavior or metadata to schema locations (fields, objects, arguments).

Common use-cases:
- Authentication/Authorization (`@auth(role: ADMIN)`)
- Input formatting (`@upperCase`, `@trim`)
- Deprecation markings or rate-limiting metadata

Q22: What are custom Schema Directives and what are common use-cases?

Standard GraphQL Error Format

Unlike REST (which uses HTTP status codes like 404 or 500), GraphQL usually returns `200 OK` with a payload containing a top-level `errors` array alongside partial `data` results.

Q23: How does error handling work in GraphQL responses?

- **Authentication** (who you are): Should occur in HTTP middleware *before* the GraphQL engine receives the request. The validated user context is then attached to the resolver `context`.
- **Authorization** (what you can do): Should ideally be enforced in the business/domain logic layer rather than inside individual GraphQL resolver functions to keep code maintainable and dry.

Q24: Where should Authentication and Authorization be handled in GraphQL?

- **Offset-based**: Uses `limit` and `offset`. Simple to write, but susceptible to missed/duplicate items when records are inserted or deleted during paging.
- **Cursor-based**: Uses opaque pointers (cursors) pointing to specific items. Highly consistent, performs better on massive datasets, and is formalized by the Relay Cursor Connections Specification.

Q25: What are offset-based vs. cursor-based pagination in GraphQL?

A standardized schema structure for paginating lists using cursors. It wraps list responses in `edges` and `pageInfo` metadata types.

Key components:
- **`edges`**: List containing node data and its unique `cursor` string.
- **`pageInfo`**: Flags (`hasNextPage`, `hasPreviousPage`) and boundary cursors (`startCursor`, `endCursor`).

Q26: What is the Relay Cursor Connections Specification?

REST leverages native HTTP caching primitives (like `Cache-Control`, `ETag`, 304 status codes) via resource URIs and GET requests. 

GraphQL uses POST requests to a single `/graphql` URL, rendering standard HTTP URL caching ineffective. Instead, GraphQL caching relies on:
1. **Client-side Normalized Caching** (by `__typename` + `id` inside Apollo/Relay).
2. **Persisted Queries / Automated Persisted Queries (APQ)** to allow HTTP GET caching.

Q27: How does HTTP Caching differ between REST and GraphQL?

Subscriptions use long-lived stateful connections (typically WebSockets via `graphql-ws` protocol). The client sends a subscription query once, and the server pushes incremental GraphQL response payloads whenever backend event publishers (e.g., Redis Pub/Sub, Kafka) emit relevant events.

Q28: How do GraphQL Subscriptions work under the hood?

- **Query Batching**: Combines multiple independent GraphQL requests triggered around the same time into a single HTTP POST request array.
- **Query Deduplication**: Automatically detects duplicate identical queries sent concurrently and executes only a single network request, sharing the promise response.

Q29: What is Query Batching vs Query Deduplication on client side?

Apollo Client flattens nested GraphQL query responses into a flat key-value dictionary. By default, it generates a unique key for every object using its `__typename` and `id` (or `_id`) field (e.g., `User:123`). If multiple queries return data for `User:123`, the cache updates the single source of truth.

Q30: How does Normalized Caching work in Apollo Client?

Because GraphQL allows circular relationship querying (e.g., `user -> posts -> author -> posts...`), malicious clients can send deeply nested queries designed to exhaust server memory and CPU, causing a Denial of Service (DoS). Depth limiting checks the query AST prior to execution and rejects documents exceeding a defined nesting depth threshold.

Q31: What is Query Depth Limiting and why is it crucial for security?

Query Complexity Analysis assigns numerical cost values to fields based on estimated computational cost (e.g., scalar field = 1, list field = 10 * limit argument). Before executing a request, the engine calculates total query complexity and rejects the operation if it exceeds a maximum complexity budget.

Q32: What is Query Complexity Analysis?

APQ optimizes network transfer and caching:
1. Client sends a cryptographic hash (SHA-256) of the query instead of the full string.
2. If the server recognizes the hash in its lookup cache, it executes the operation immediately.
3. If unknown, the server responds with `PersistedQueryNotFound`, prompting the client to send the full query text once to register the hash.

Q33: What are Automatic Persisted Queries (APQ)?

- **Schema Stitching**: Imperative backend approach where a gateway server merges multiple underlying GraphQL schemas by writing explicit code adapters and delegate resolvers.
- **Apollo Federation**: Declarative architecture where subgraphs declare entity types (`@key`) independently. A gateway automatically builds a unified supergraph schema without custom delegate resolver code.

Q34: What is the difference between Schema Stitching and Apollo Federation?

Federated Subgraph Schema

In Apollo Federation, an **Entity** is a type that can extend across subgraphs. The `@key` directive defines its primary key.

Subgraphs can resolve parts of an entity by referencing its key via an `__resolveReference` resolver function.

Q35: How do Federation Entities and `@key` directives work?

- **`@defer`**: Instructs the server to return non-critical query fragments asynchronously after delivering the initial payload frame.
- **`@stream`**: Allows list fields to yield individual items sequentially over an HTTP multipart response stream as they resolve.

Q36: How do `@defer` and `@stream` directives work?

GraphQL avoids `/v1` or `/v2` endpoints by providing an **ever-evolving schema**.

Strategy for changes:
1. Add new fields alongside existing fields.
2. Mark legacy fields using the `@deprecated(reason: "...")` directive.
3. Track field usage metrics in production logs/telemetry before removing unused deprecated fields.

Q37: Why doesn't GraphQL use traditional API versioning, and how are breaking changes avoided?

- **`@external`**: Marks a field as owned by another subgraph.
- **`@requires(fields: "...")`**: Specifies that a local computed field requires data from external fields owned by another subgraph.
- **`@provides(fields: "...")`**: Optimization where a subgraph promises to supply specific external fields to reduce extra gateway round-trips.

Q38: What are `@external`, `@requires`, and `@provides` in Apollo Federation?

Execution occurs in 4 distinct phases:
1. **Parsing**: Converts raw query string into an **Abstract Syntax Tree (AST)**.
2. **Validation**: Verifies AST against schema rules (type safety, depth limits, directive rules).
3. **Execution**: Traverses AST nodes, invoking resolver functions in execution trees.
4. **Formatting**: Formats errors/data into the standardized JSON structure.

Q39: How does the GraphQL Engine process a query from string to JSON response?

Two primary architectural approaches exist:
1. **GraphQL Multipart Request Spec**: Sends operations and file binaries in a single `multipart/form-data` request using custom `Upload` scalars.
2. **Direct-to-S3 / Signed URLs (Recommended)**: Client requests a pre-signed upload URL via a standard GraphQL mutation, uploads the binary file directly to cloud storage (S3/GCS), then passes the stored file URL back to GraphQL.

Q40: How should File Uploads be handled in a GraphQL environment?

Traditional IP/endpoint rate-limiting fails because all requests hit `/graphql`.

Effective approaches:
1. **Query Complexity Rate Limiting**: Deducts computed query complexity costs from a user token bucket.
2. **Resolver Level Limiting**: Enforces rate limits on sensitive underlying resolvers (e.g., login mutations).
3. **Client ID / API Key Tracking**: Limits total operation volume per key.

Q41: What rate-limiting strategies are effective for GraphQL APIs?

- **Schema-First**: SDL file is written first manually. Resolvers are then authored to implement the declared schema types.
- **Code-First (Resolver-First)**: Schema is generated programmatically using programming language constructs/decorators (e.g., Nexus, TypeGraphQL, Pothos).

Q42: What is the difference between Schema-First and Code-First development?

By overriding the `formatError` hook in GraphQL engines (e.g., Apollo Server, GraphQL Yoga), servers can intercept errors before delivery. In production, stack traces and database internal details are masked or logged centrally, returning clean, user-friendly codes.

Q43: How do you format errors or mask sensitive details in production?

Tools like **GraphQL Inspector** or **Apollo Rover/Studio** compare proposed SDL files against production schemas during CI builds. They detect breaking changes (e.g., removing a field, changing a non-nullable type) and fail pull requests before deployment.

Q44: How can schema breaking changes be caught in CI/CD pipelines?

Modern engines (e.g., Envelop, Apollo Plugins) offer lifecycle hooks: `requestDidStart`, `parsingDidStart`, `validationDidStart`, and `willSendResponse`. Plugins monitor metrics, inject context variables, or enforce custom validation rules at each step.

Q45: How do GraphQL Server Plugins hook into request lifecycles?

In Apollo Federation, entity requests cross network boundaries. Subgraph entity responses can include caching headers or directives (`@cacheControl`). The gateway can cache entity representations, skipping redundant calls to underlying subgraphs for shared entities.

Q46: How does federated entity caching work across gateway subgraphs?

Unlike APQ (which registers new queries dynamically at runtime), Strict Persisted Queries requires build-time registration of all client queries. The production GraphQL server rejects **any** incoming query string or hash that is not present in its pre-approved production whitelist.

Q47: What is Hard/Strict Persisted Queries (Query Whitelisting)?

Single-server WebSocket instances cannot scale horizontally alone. Distributed subscriptions require a pub/sub backbone (e.g., Redis Pub/Sub, NATS, Kafka). When an event occurs on any node, it publishes to the broker, which broadcasts the event to all connected WebSocket servers holding active subscriptions.

Q48: How do you scale GraphQL Subscriptions across distributed clusters?

WebSockets are bidirectional and stateful, introducing complexity with HTTP/2 proxies, firewalls, and load balancers. Since GraphQL subscriptions are unidirectional (server pushes to client), HTTP-based SSE provides a simpler, firewall-friendly, auto-reconnecting transport mechanism over standard HTTP/2 streams.

Q49: Why are Server-Sent Events (SSE) emerging as an alternative to WebSockets for GraphQL?

Standard `graphql-js` dynamically parses and interprets AST nodes on every incoming query. JIT engines compile incoming GraphQL documents into optimized, direct JavaScript V8 functions upon first receipt. Subsequent executions call these compiled functions directly, improving throughput up to 10-15x.

Q50: What is Just-In-Time (JIT) GraphQL Execution (e.g., `graphql-jit`)?

50 curated interview questions ordered strictly by difficulty from Easy to Expert covering core concepts, schema design, performance, security, and federation.

STAY UPDATED WITH BYTES!