GraphQL and REST - Kralis Docs

GraphQL is the main Kralis product API. It provides onboarding, authentication, queries, mutations, schema discovery, filters, pagination, and typed responses. Kralis Web uses this GraphQL lifecycle too. REST authentication remains available as a compatibility surface.

Choose an API

Need	Recommended surface
Sign in, refresh, verify, or revoke through GraphQL	Auth mutations on `/graphql/`
Suggest or check an acronym and onboard a school	Public onboarding operations on `/graphql/`
Use interactive GraphQL documentation	`/graphiql/`
Query or update application data	`/graphql/` with a Kralis access token
Use REST authentication	`/auth/` with the same SimpleJWT token family
Inspect GraphQL types and operations	GraphiQL `/graphiql/`
Inspect REST request and response schemas	Swagger, ReDoc, or OpenAPI

GraphQL requests

Send a JSON body containing query, optional variables, and optionally operationName.

{
  "operationName": "ListStudents",
  "query": "query ListStudents($first: Int!, $after: String) { students(first: $first, after: $after) { edges { node { pk username fullName } } pageInfo { hasNextPage endCursor } totalCount } }",
  "variables": { "first": 20, "after": null }
}

Prefer variables over interpolating user input into query strings. Request only fields your client uses, give operations meaningful names, and generate types from the live schema where your toolchain supports it.

REST authentication requests

Use the method, path, body, and response documented for /auth/ in the live OpenAPI surfaces. This surface exists for compatible clients; new integrations should normally use the GraphQL lifecycle. Do not infer that a GraphQL product mutation has an equivalent REST endpoint.

Response differences

Surface	Success	Failure to handle
GraphQL	`data` for requested fields	Top-level `errors`, nullable partial data, authentication or transport failure
REST	Documented status and response body	`4xx`, `5xx`, validation body, authentication failure

GraphQL and REST authentication issue the same SimpleJWT token family. Use one lifecycle consistently and send product operations to /graphql/.