GraphQL Testing
GraphQL is the API query language and runtime that has replaced REST APIs in many modern applications (GitHub, Shopify, Twitter). GraphQL APIs have a single endpoint and accept queries/mutations in the request body - which requires a different testing approach than REST. Every modern SDET must know how to test GraphQL endpoints.
GraphQL Testing with Postman and REST Assured
// ══════════════════════════════════════════════════════════════
// GRAPHQL FUNDAMENTALS FOR TESTERS
// URL: Always a single endpoint (e.g., /graphql or /api/graphql)
// Method: Always POST
// Body: JSON with "query" field
// ══════════════════════════════════════════════════════════════
// ── GRAPHQL QUERY (read data = GET equivalent) ────────────────
// Postman body (raw JSON):
{
"query": "query GetUser($id: ID!) { user(id: $id) { id name email orders { id total } } }",
"variables": { "id": "123" }
}
// Expected response:
{
"data": {
"user": {
"id": "123",
"name": "Alice Johnson",
"email": "alice@example.com",
"orders": [{ "id": "ORD-001", "total": 129.99 }]
}
}
}
// ── GRAPHQL MUTATION (write data = POST/PATCH/DELETE equivalent)
{
"query": "mutation CreateUser($input: CreateUserInput!) { createUser(input: $input) { id email } }",
"variables": {
"input": { "name": "Bob Smith", "email": "bob@test.com", "password": "Test@1234" }
}
}
// ── GRAPHQL TEST ASSERTIONS IN POSTMAN ────────────────────────
// Note: GraphQL ALWAYS returns HTTP 200, even for errors!
// Errors are in response.data.errors, not in HTTP status code.
pm.test("HTTP status is 200 (always for GraphQL)", () => {
pm.response.to.have.status(200);
});
const body = pm.response.json();
pm.test("No GraphQL errors in response", () => {
// If errors exist, GraphQL returns them in body.errors
pm.expect(body.errors).to.be.undefined;
});
pm.test("User data is returned correctly", () => {
const user = body.data.user;
pm.expect(user.id).to.equal("123");
pm.expect(user.name).to.be.a("string").and.exist;
pm.expect(user.email).to.include("@");
pm.expect(user).to.not.have.property("password"); // Security check
});
pm.test("Orders array is returned", () => {
pm.expect(body.data.user.orders).to.be.an("array");
});
// ── GRAPHQL ERROR TESTING ─────────────────────────────────────
// Test requesting non-existent user:
// { "query": "query { user(id: "99999") { id name } }" }
// Expected response:
// { "data": { "user": null }, "errors": [{ "message": "User not found" }] }
pm.test("Returns error for missing user (not HTTP 404)", () => {
const body = pm.response.json();
pm.expect(body.data.user).to.be.null;
pm.expect(body.errors[0].message).to.include("not found");
});Common Mistakes
- Checking HTTP status code for GraphQL errors - GraphQL always returns 200; errors are in body.errors, not HTTP status
- Not testing partial query failures - GraphQL partial success (some fields succeed, others fail) is a unique pattern that REST doesn't have
- Requesting too many fields - GraphQL allows over-fetching; test that minimal queries work correctly, not just kitchen-sink queries
- Not testing unauthorized field access - GraphQL must enforce field-level authorization; request sensitive fields as an unauthorized user
Tip
Tip
Practice GraphQL Testing in small, isolated examples before integrating into larger projects. Breaking concepts into small experiments builds genuine understanding faster than reading alone.
Technical diagram.
Practice Task
Note
Practice Task - (1) Write a working example of GraphQL Testing from scratch without looking at notes. (2) Modify it to handle an edge case (empty input, null value, or error state). (3) Share your solution in the Priygop community for feedback.
Quick Quiz
Common Mistake
Warning
A common mistake with GraphQL Testing is skipping edge case testing - empty inputs, null values, and unexpected data types. Always validate boundary conditions to write robust, production-ready software testing code.
Key Takeaways
- GraphQL is the API query language and runtime that has replaced REST APIs in many modern applications (GitHub, Shopify, Twitter).
- Checking HTTP status code for GraphQL errors - GraphQL always returns 200; errors are in body.errors, not HTTP status
- Not testing partial query failures - GraphQL partial success (some fields succeed, others fail) is a unique pattern that REST doesn't have
- Requesting too many fields - GraphQL allows over-fetching; test that minimal queries work correctly, not just kitchen-sink queries