GraphQL in Action: Building an API with .NET Core

Introduction: What is GraphQL?

GraphQL is:

• A query language used to request data
• A runtime that executes those queries
• An API design that usually works on one single endpoint

Instead of returning a fixed response like REST, the API provides flexible data fetching, allowing the client to request exactly what it needs. This makes the API more frontend-friendly and adaptable to changing UI requirements.

Why GraphQL?

Nowadays, applications like React apps, Angular apps, and mobile apps need APIs that are flexible and fast.
Frontend developers usually expect:

• Only required data
• Less number of API calls
• Faster UI development

But when we use traditional REST APIs, we often face problems like:

• API sends extra data that UI never uses
• Multiple APIs are needed for one screen
• Any UI change forces backend API changes

Because of these issues, GraphQL becomes a good solution.
It allows the client (frontend) to decide what data it wants, instead of backend forcing a fixed response.

REST vs GraphQL

REST API

 GET /api/products  

This returns many fields even if UI needs only product name and price.

GraphQL

 query {  
	  products {  
	   name  
	   price  
	  }  
	 }  
	

This returns only name and price, nothing extra.
This is the biggest advantage of GraphQL.

Why GraphQL is Better Than REST (Practical View)

• UI gets only required data
• One endpoint works for many clients
• No unnecessary payload
• Backend does not change for UI changes

This makes frontend and backend more independent.

When Should You Use GraphQL?

GraphQL is good when:

• Frontend has heavy UI logic
• Same backend is used by web and mobile apps
• UI keeps changing frequently
• You want to reduce network calls

GraphQL is not ideal when:

• Application is very simple CRUD
• API mainly handles file uploads/downloads
• Strong HTTP caching is a top requirement

Setting Up GraphQL in .NET Core (Working Example)

 Create a New Project

 dotnet new webapi -n GraphQLDemo  
 cd GraphQLDemo  

This creates a basic ASP.NET Core Web API project.

Install Required Packages

 dotnet add package GraphQL  
 dotnet add package GraphQL.Server.Transports.AspNetCore  
 dotnet add package GraphQL.Server.Ui.GraphiQL  

These packages help us:

• Define GraphQL schema
• Run GraphQL queries
• Use GraphQL GraphiQL UI

Product Model

What this code does

• Creates a simple C# class
• Represents a product entity

Why this is required

• GraphQL works with strongly typed objects
• This model acts as the data source
• In real projects, this usually maps to a database table

So this model is the base of our GraphQL response.

ProductType (GraphQL Object Type)

What this code does

• Converts the C# Product class into a GraphQL type
• Exposes fields like id, name, and price

Why this is required

• GraphQL does not directly expose C# models
• You must clearly define which fields are allowed

Security benefit

Only fields defined here can be queried, so sensitive data is automatically protected.

ProductQuery (Query Resolver)

What this code does

• Creates a GraphQL query named products
• Defines how product data is fetched
• Executes resolver logic when query runs

Why this is required

• GraphQL needs resolver logic to get data
• This is similar to a controller method in Web API

In real projects, resolver usually calls:

• Service layer
• EF Core
• External APIs

 Resolver acts as a bridge between query and data.

AppSchema (GraphQL Schema)

What this code does

• Registers all available queries
• Acts as the main entry point for GraphQL execution

Why this is required

• GraphQL cannot work without schema
• Schema defines:
  • Available queries
  • Available mutations (later)

Schema is the contract between frontend and backend.

Registering GraphQL Services (Dependency Injection)

What this code does

• Registers GraphQL components in ASP.NET Core DI
• Allows GraphQL to resolve dependencies properly

Why this is required

• GraphQL.NET depends on dependency injection.
• Without this:
  • Schema won’t load
  • Queries will fail

This follows normal ASP.NET Core best practices

Add GraphQL Configuration 

What this code does

• Enables GraphQL in ASP.NET Core
• Configures JSON serialization

Why this is required

• GraphQL responses are returned in JSON format
• Uses System.Text.Json for better performance
• Registers GraphQL middleware internally

Without this setup, GraphQL endpoint won’t work.

GraphQL Middleware Configuration

What this code does

• UseGraphQL<ISchema>() exposes /graphql endpoint
• UseGraphQLGraphiQL() provides UI to test queries

Why this is required

• GraphQL works over HTTP
• Middleware connects HTTP request to GraphQL engine

GraphiQL helps developers:

• Test queries
• Explore schema
• Debug responses

GraphiQL should be disabled in production.

GraphQL Query Example

 query {  
  products {  
   id  
   name  
   price  
  }  
 }  

What happens here

• Client requests only required fields
• products resolver is executed

Why this is powerful

• No over-fetching
• One backend supports multiple UIs
• Client controls response format

This is the core strength of GraphQL.

Testing Using GraphQL Playground

Open:

 https://localhost:{port}/ui/playground  

Run the query:

 query {  
  products {  
   id  
   name  
   price  
  }  
 }  

Response

 {  
  "data": {  
   "products": [  
    { "id": 1, "name": "Apple", "price": 120 },  
    { "id": 2, "name": "Banana", "price": 60 }  
   ]  
  }  
 }  

Security Considerations

GraphQL is not secure by default. You must implement:

• Authentication (JWT / OAuth)
• Query depth limit
• Disable schema introspection in production
• Rate limiting

Security depends on how you implement GraphQL, not GraphQL itself.

Real-World Architecture

Frontend (React / Mobile)

→ GraphQL Query

→ Resolver

→ Service Layer

→ Database

GraphQL acts as a smart data layer between UI and backend.

Conclusion

GraphQL is a strong API solution when:

• UI changes frequently
• Multiple clients use the same backend
• Performance and flexibility are important

But for simple CRUD applications, REST APIs are still a very good and simple choice.