GraphQL Query Tester

Server assisted API Testing

A focused GraphQL client: write the query, supply JSON variables and auth headers, run it, and inspect data and errors. Includes query syntax validation and introspection helpers.

Privacy: Processing happens in your browser where possible. Network checks are relayed through the Mutqan backend and are not stored.

What is GraphQL?

GraphQL is a query language and runtime for APIs in which the client states exactly which fields it wants and receives a JSON response shaped like the query, from a single endpoint. A schema with types defines what can be asked; queries read, mutations write, and errors arrive in an errors array beside the data rather than as HTTP status codes.

How to use GraphQL Query Tester

  1. Enter the GraphQL endpoint URL.
  2. Write the query or mutation; press Validate to check syntax and see declared variables.
  3. Fill in Variables as a JSON object (and the operation name if the document has several operations).
  4. Send and inspect the data/errors summary, then the tree or raw JSON.

GraphQL Query Tester features

  • Query editor with syntax validation (braces, strings, fragments, variables) and a formatter
  • JSON variables and operation name, sent as POST (or GET) with correct headers
  • One-click introspection and root-field queries
  • Response summary: root fields, list sizes, null fields and GraphQL errors with locations and paths
  • Headers, auth and relay/direct settings shared with the request builder

GraphQL Query Tester example

Query a public GraphQL API

Input:

query CountryInfo($code: ID!) {
  country(code: $code) { name capital currency }
}
Variables: { "code": "SA" }

Output:

OK · 1 root field: country
{
  "data": { "country": { "name": "Saudi Arabia", "capital": "Riyadh", "currency": "SAR" } }
}

Frequently asked questions about GraphQL Query Tester

What does the validator catch?

Unbalanced braces and parentheses, single-quoted strings, missing selection sets, unknown top-level tokens, unnamed operations in multi-operation documents, undefined or unused fragments, and undeclared or unused variables.

How are variables sent?

The Variables box must be a JSON object. It is sent as the "variables" property of the POST body (or as a query parameter when you choose GET).

Can I run introspection?

Yes — the Introspection query button loads the standard IntrospectionQuery; the response summary then shows how many types and root fields the schema exposes.

Do I need to set Content-Type?

No. Content-Type: application/json and Accept: application/json are added automatically unless you override them in the Headers tab.

Technical notes

The validator is a lightweight tokenizer-based checker, not a full GraphQL parser: it verifies bracket balance, string syntax, operation/fragment structure, variable declarations and usage, and reports line/column positions. Full schema validation happens on the server.

References

  • GraphQL SpecificationGraphQL FoundationThe GraphQL query language and type system, validation rules and execution semantics.
  • OWASP Cheat Sheet Series: GraphQLOWASP FoundationGraphQL-specific risks: query depth and complexity limits, introspection in production, authorization per field.
  • RFC 9110: HTTP SemanticsIETF · 2022The meaning of HTTP methods, header fields, status codes and content negotiation, independent of the wire version.