Ask for fields
GraphQL puts the whole API behind one endpoint. You POST a query naming the fields you want, and get exactly those back:
curl -s -H 'Content-Type: application/json' -d '{"query":"{ me { username } }"}' http://127.0.0.1:8080/graphqlIn the terminal
student@vulntech:~$ curl -s -H 'Content-Type: application/json' -d '{"query":"{ me { username } }"}' http://127.0.0.1:8080/graphql {"data": {"me": {"username": "guest", "isAdmin": false}}}
Clean and precise — but the client gets to name fields, so the real question is which fields the server will answer for.