Exploring GraphQL with GraphiQL

Kralis GraphiQL is the interactive explorer for the same GraphQL schema and SimpleJWT authentication used by /graphql/.

Area	What you can inspect
Query	Root queries, arguments, filters, connections, and return types
Mutation	Root mutations, input objects, arguments, responses, and descriptions
Types	Fields, nullability, enums, interfaces, and Relay connections
Variables	JSON values kept separate from operation text
Headers	The Bearer access token used for authenticated operations

Log in

mutation Login($input: LoginInput!) {
  login(input: $input) {
    access
    refresh
    user {
      id
      pk
      username
      fullName
      role
    }
    school {
      id
      pk
      schoolName
      schoolAcronym
      isActive
    }
  }
}

Variables:

{
  "input": {
    "username": "YOUR_USERNAME",
    "password": "YOUR_PASSWORD_OR_ACCESS_PIN"
  }
}

Add the returned access token in the Headers panel:

{
  "Authorization": "Bearer YOUR_ACCESS_TOKEN"
}

Confirm the identity and live academic context represented by that token:

query Viewer {
  viewer {
    user {
      id
      pk
      username
      fullName
      role
    }
    school {
      id
      pk
      schoolName
      schoolAcronym
    }
    accessContext {
      yearId
      termId
      classeId
      remainingPinUsage
      usesAccessPin
    }
  }
}

Verify, refresh, and revoke

mutation Verify($input: VerifyLoginTokenInput!) {
  verifyLoginToken(input: $input) {
    valid
  }
}

mutation Refresh($input: RefreshLoginTokenInput!) {
  refreshLoginToken(input: $input) {
    access
    refresh
  }
}

mutation Revoke($input: RevokeLoginTokenInput!) {
  revokeLoginToken(input: $input) {
    revoked
  }
}

Use { "input": { "token": "..." } } for verification and { "input": { "refresh": "..." } } for refresh or revocation. Always store both values returned by a refresh. When rotation is enabled by server policy, the previous refresh token becomes invalid.

Routes

Route	Intended use
`/graphiql/`	Interactive schema discovery and development
`/graphql/`	Application and integration requests

Both routes accept the same access token and expose the same schema. Production clients should normally send operations to /graphql/.

Use temporary test accounts in the browser explorer. Never put passwords or tokens in source control, screenshots, shared requests, URLs, or issue trackers.

​Log in

​Verify, refresh, and revoke

​Routes

Log in

Verify, refresh, and revoke

Routes