---
title: "GraphQL Support"
description: ""
canonicalUrl: "https://zuplo.com/changelog/2026/06/12/graphql-support"
pageType: "changelog"
date: "2026-06-12"
tags: "runtime, dev-portal, policy"
---
Zuplo now supports GraphQL APIs end to end, from the runtime gateway to the
developer-facing Dev Portal. Put your existing GraphQL endpoint behind Zuplo to
apply the same authentication, rate limiting, and observability you already use
for your REST APIs, then give consumers a browsable schema and interactive
playground in the Dev Portal.

## GraphQL in the gateway

- **Proxy any GraphQL upstream**: create a `POST /graphql` route with the URL
  Rewrite handler pointing at your GraphQL server, tagged with the `x-graphql`
  extension (applied automatically when you pick "GraphQL Endpoint")
- **Operation-level security**: enforce query depth and complexity limits and
  control introspection so expensive or probing queries never reach your
  upstream
- **Observability**: the `graphql-analytics-outbound` policy reports operations
  to a dedicated analytics view alongside the rest of your API traffic

![Zuplo Portal route designer showing a POST /graphql endpoint with the GraphQL badge, URL Rewrite handler, and graphql-analytics-outbound response policy](../public/media/changelog/2026-06/graphql-route-setup.png)

Because a GraphQL endpoint is just a Zuplo route, every existing policy (rate
limiting, authentication, logging, custom code) works on GraphQL traffic too.

## GraphQL analytics

Once a route is marked as a GraphQL endpoint, a dedicated GraphQL section
appears in analytics with operation-aware metrics, not just HTTP status codes:

- **Summary KPIs**: total operations, success rate, p95 latency (with resolver
  p95 as a secondary metric), and error classes broken down into resolver,
  validation, and auth
- **Charts**: operations over time, an operation-type donut (query, mutation,
  subscription), and a total-vs-resolver latency comparison to spot whether
  latency lives upstream or in your policies
- **Per-operation table**: searchable and sortable by name, type, volume, error
  count and rate, average and maximum complexity, and p95 latency

![GraphQL analytics query documents table with operations, error rate, complexity, and p95 latency per query shape](../public/media/changelog/2026-06/graphql-analytics.png)

See the
[GraphQL analytics documentation](https://zuplo.com/docs/analytics/tabs/graphql)
for the full breakdown.

## GraphQL in the Dev Portal

Register the `@zudoku/plugin-graphql` plugin in your Dev Portal configuration,
pointing it at a live endpoint or a local schema file:

- **Interactive playground**: consumers browse your schema and run queries
  directly from the docs
- **Schema-aware reference**: a browsable type reference generated from your
  GraphQL schema

![Dev Portal GraphQL playground with a schema type explorer, query editor, and live response panel](../public/media/changelog/2026-06/graphql-playground.png)

## Getting started

See the [GraphQL documentation](https://zuplo.com/docs/articles/graphql) to add
a GraphQL API to your project, wire up the analytics and security policies, and
publish the schema to your Dev Portal.