HCL Commerce Version 9.1.20.0 or later

GraphQL introspection configuration

Describes the introspection configuration option for the HCL Commerce GraphQL server and how it affects schema discovery and client tooling.

The HCL Commerce GraphQL provider creates and hosts a GraphQL server endpoint that delegates requests to a set of REST services defined by OpenAPI 3 requirements. For more information about the provider, see HCL Commerce GraphQL extensions.

GraphQL introspection allows a client to query the schema, including types, fields, queries, and mutations, by using special fields such as schema and type. This capability is used by many GraphQL developer tools to provide auto-complete, schema exploration, and code generation.

The HCL Commerce GraphQL server exposes an introspection configuration setting in the main configuration file (opts.yaml) that is included in the container. For more information about the configuration file and how to obtain the default version, see Changing GraphQL server configuration.

By default, introspection remains enabled for backward compatibility:

  • introspection: true (default) — GraphQL introspection is enabled. Developer tools and clients that depend on runtime schema discovery can query the schema.
  • introspection: false — GraphQL introspection is disabled. Introspection queries that use schema or type no longer return schema details.

The introspection flag is provided so that customers can decide whether to disable introspection based on their own risk assessment and operational requirements. Disabling introspection can reduce schema discoverability from the endpoint, but it does not prevent schema information from being inferred through other means (for example, inspection of browser-based client code or network traffic).

For step-by-step instructions, see Disabling GraphQL introspection.

To learn about the potential impacts of disabling introspection and how to recover if issues occur, see GraphQL introspection: potential impacts and fallback options.