Building a GraphQL Endpoint with PHP

A GraphQL endpoint connects a declared schema with resolvers that fetch authorized data.

What It Does

A GraphQL endpoint connects a declared schema with resolvers that fetch authorized data. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

PHP 8.x and a local test environment. Apply input validation, correct error handling and the requirements of any optional libraries.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Install a maintained GraphQL parser and executor (webonyx) to execute a real schema.

composer require webonyx/graphql-php

This is a command-line example; use it in its appropriate file or shell, not in the PHP source editor.

Example 2: Another Case

Execute a typed GraphQL query with a concrete schema and resolver; production queries require authentication and complexity limits.

<?php
require __DIR__ . '/vendor/autoload.php';
use GraphQL\GraphQL;
use GraphQL\Type\Schema;
use GraphQL\Type\Definition\Type;
use GraphQL\Type\Definition\ObjectType;
$productType = new ObjectType(['name' => 'Product', 'fields' => ['id' => Type::nonNull(Type::id()), 'name' => Type::string()]]);
$queryType = new ObjectType(['name' => 'Query', 'fields' => ['product' => ['type' => $productType, 'args' => ['id' => Type::nonNull(Type::id())], 'resolve' => static function ($root, array $args): ?array { $products = ['7' => ['id' => '7', 'name' => 'Notebook']]; return $products[$args['id']] ?? null; }]]]);
$schema = new Schema(['query' => $queryType]);
$result = GraphQL::executeQuery($schema, '{ product(id: "7") { id name } }');
echo json_encode($result->toArray(), JSON_THROW_ON_ERROR);

This example depends on an installed extension, third-party library or configured service and is not a standalone local test.

Practical Example: Putting It to Use

Use a real GraphQL parser and schema executor; validate the request body before passing it to the library.

<?php
$body = '{"query":"query($id: ID!) { product(id: $id) { id name } }","variables":{"id":"7"}}';
$input = json_decode($body, true, 16, JSON_THROW_ON_ERROR);
if (!is_string($input['query'] ?? null) || strlen($input['query']) > 4096) throw new InvalidArgumentException('Invalid GraphQL request');
if (!is_array($input['variables'] ?? null)) throw new InvalidArgumentException('Variables must be a map');
echo $input['variables']['id'];

Important Behavior and Edge Cases

Parsing a query or spotting a field name is not authorization; limit depth, cost and introspection policy.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• A GraphQL endpoint connects a declared schema with resolvers that fetch authorized data.
• Parsing a query or spotting a field name is not authorization; limit depth, cost and introspection policy.
• Use a maintained GraphQL schema and execution library.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.