> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kralis.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Exploring GraphQL with GraphiQL

> Browse every Kralis query and mutation, run operations, and authenticate with Kralis SimpleJWT.

[Kralis GraphiQL](https://api.kralis.app/graphiql/) is the interactive explorer for the same GraphQL schema and SimpleJWT authentication used by `/graphql/`.

| Area      | What you can inspect                                                  |
| --------- | --------------------------------------------------------------------- |
| Query     | Root queries, arguments, filters, connections, and return types       |
| Mutation  | Root mutations, input objects, arguments, responses, and descriptions |
| Types     | Fields, nullability, enums, interfaces, and Relay connections         |
| Variables | JSON values kept separate from operation text                         |
| Headers   | The Bearer access token used for authenticated operations             |

```mermaid theme={null}
flowchart LR
    A[Open GraphiQL] --> B[Inspect schema]
    B --> C[Run login]
    C --> D[Add Bearer access token]
    D --> E[Run school-scoped operations]
```

## Log in

```graphql theme={null}
mutation Login($input: LoginInput!) {
  login(input: $input) {
    access
    refresh
    yearId
    termId
    user {
      id
      pk
      username
      fullName
      role
    }
    school {
      id
      pk
      schoolName
      schoolAcronym
      isActive
    }
  }
}
```

Variables:

```json theme={null}
{
  "input": {
    "username": "YOUR_USERNAME",
    "password": "YOUR_PASSWORD_OR_ACCESS_PIN"
  }
}
```

Add the returned access token in the **Headers** panel:

```json theme={null}
{
  "Authorization": "Bearer YOUR_ACCESS_TOKEN"
}
```

## Verify, refresh, and revoke

```graphql theme={null}
mutation Verify($input: VerifyLoginTokenInput!) {
  verifyLoginToken(input: $input) {
    valid
  }
}
```

```graphql theme={null}
mutation Refresh($input: RefreshLoginTokenInput!) {
  refreshLoginToken(input: $input) {
    access
    refresh
  }
}
```

```graphql theme={null}
mutation Revoke($input: RevokeLoginTokenInput!) {
  revokeLoginToken(input: $input) {
    revoked
  }
}
```

Use `{ "input": { "token": "..." } }` for verification and `{ "input": { "refresh": "..." } }` for refresh or revocation. Refresh rotation invalidates the previous refresh token.

## Routes

| Route        | Intended use                                 |
| ------------ | -------------------------------------------- |
| `/graphiql/` | Interactive schema discovery and development |
| `/graphql/`  | Application and integration requests         |

Both routes accept the same access token and expose the same schema. Production clients should normally send operations to `/graphql/`.

<Warning>
  Use temporary test accounts in the browser explorer. Never put passwords or tokens in source control, screenshots, shared requests, URLs, or issue trackers.
</Warning>