GraphQL Discovery

GraphQL API Discovery

Vespasian detects GraphQL endpoints, runs tiered introspection queries, and generates GraphQL SDL schemas.

Classification Heuristics

Signal	Confidence
/graphql path	0.70
GraphQL query syntax in POST body	0.85
data/errors keys in response	0.80
Path + body combined	0.95

Tiered Introspection Strategy

Vespasian uses a tiered introspection strategy to handle WAF-protected GraphQL servers:

• Tier 1: Full introspection with descriptions, deprecation, and directives
• Tier 2: Minimal-complete query without descriptions, deprecation info, or directives
• Tier 3: Minimal last-resort query with the smallest payload
• Fallback: Traffic-based inference from observed queries and mutations when introspection is disabled

This tiered approach means Vespasian can discover GraphQL schemas even when servers block standard introspection queries.

Output Format

GraphQL APIs are output as GraphQL SDL (Schema Definition Language) schemas.

Example Workflow

# One-step GraphQL discovery
vespasian scan https://app.example.com --api-type graphql -o schema.graphql

# Two-stage workflow
vespasian crawl https://app.example.com -o capture.json
vespasian generate graphql capture.json -o schema.graphql

See Also

• REST API Discovery
• SOAP WSDL Discovery
• CLI Reference