GraphQL API
Query the federated gateway with cursor or offset pagination. This guide follows version 3.1.7 (03acdf712c).
For credentials, see Authentication. For CMS examples, see Queries.
Endpoint
Core API and each plugin serve a federated subgraph at /graphql (Apollo Server v4 plus @apollo/subgraph). The gateway composes them with Rover into Apollo Router and exposes the federated /graphql on port 4000. Always call the gateway in production, not an individual service.
curl --fail http://localhost:4000/graphql \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer <team-token>" \
--data '{"query":"query Health { __typename }"}'
HTTP 200 with a GraphQL errors array is a failed call. Check errors separately from HTTP status.
Pagination
backend/erxes-api-shared/src/utils/apollo/constants.ts defines two incompatible styles:
- Cursor (
GQL_CURSOR_PARAM_DEFS):limit,cursor,cursorMode(inclusive|exclusive),direction(forward|backward),orderBy,sortMode,aggregationPipeline. The helper defaults to 20 items and rejects limits outside 1–100. - Offset (
GQL_OFFSET_PARAM_DEFS):page,perPage,sortField,sortDirection. In CMS onlycpPostListWithPaginationuses it.
List envelopes (for example PostList, PageList) carry pageInfo { hasNextPage, hasPreviousPage, startCursor, endCursor }; feed endCursor back as cursor. Bare-list operations (cpPosts, cpPages, cpMenus) return arrays with no totalCount.
Naming
Prefix operations with the plugin or module and keep names unique. CMS exposes cms* (admin, permission-wrapped, usually requires clientPortalId) and cp* (portal-derived context, bypasses the team-member wrapper). The prefix does not guarantee read-only or published-only behavior; enforce status filters explicitly.
