47 / 65 · 14 API Testing Fundamentals · GraphQL Testing← prev⊞ allnext →☰ Read as one page
6.8Key Takeaways
- GraphQL returns HTTP 200 even for errors — always check the
errorsarray - Test both queries and mutations with valid and invalid inputs
- Introspection should be disabled in production (security risk)
- Query depth and complexity limits must be enforced (DoS prevention)
- Authorization must be tested at the field level, not just the query level
- Partial errors are valid in GraphQL — the response can have both
dataanderrors