# GraphQL

Send queries and mutations to any GraphQL API.

## Do things in GraphQL

Add a **GraphQL** step. Choose the row to see all its fields.

- [Execute Query](https://docs.gorunner.io/apps/graphql#fields-f-query): Send a GraphQL query or mutation to the specified endpoint.

Later steps read a step’s output by its name: see [Use data from earlier steps](https://docs.gorunner.io/build/use-data-from-earlier-steps).

## Limits

- GoRunner Cloud reaches servers on the public internet only. On a self-hosted installation, an admin can allow private addresses with `WORKFLOW_PRIVATE_NETWORKS`.

Not in your list? See [When an app isn’t here](https://docs.gorunner.io/apps/when-an-app-isnt-here#q-not-in-list).

## For developers

In the API, which calls apps pieces, GraphQL is `pieceId: "graphql"` with `actionId: "query"`, set by `operation_name`. [Get an app](https://docs.gorunner.io/api/apps/get-app) returns every field.

It can change something outside the run (`writes_external`). See [How versions and side effects work](https://docs.gorunner.io/apps#q-versions).

### GraphQL › Execute Query

Send a GraphQL query or mutation to the specified endpoint.

- **Endpoint URL · Required**: The full URL of the GraphQL API endpoint (such as https://api.example.com/graphql).
- **HTTP Method · Optional**: POST sends the query in the request body; GET sends it as URL query params (for cached/CDN read queries). Options: POST (default), GET (query in URL). Default: POST (default).
- **Query / Mutation · Required**: The GraphQL query or mutation to execute. Supports {{expressions}}.
- **Variables · Optional**: Optional JSON object of variables referenced by the query (such as {"id": "1"}).
- **Query Parameters · Optional**: Extra query-string parameters appended to the endpoint URL (such as apiKey).
- **Headers · Optional**: Additional HTTP headers to include with the request (such as X-Custom-Header).
- **Authentication · Optional**: Choose how to prove you have access to the API: none, or a Bearer Token you paste below. Options: None, Bearer Token. Default: None.
- **Bearer Token · Required**: The Bearer token to include in the Authorization header. Shows when **Authentication** is **Bearer Token**.
- **Error replies are results · Optional**: Return the reply (status, data, errors, or the raw body) as this step's output instead of failing the step on a non-2xx or non-JSON reply, or on errors with no data. Retries, the time limit and what happens on failure are under Error handling. Off by default.
- **Request Format · Optional**: JSON (default) sends {query, variables} as application/json. GraphQL sends the raw query string as application/graphql (variables and operation name are not applicable). Options: JSON (query + variables), GraphQL (raw query body). Default: JSON (query + variables).
- **Ignore SSL Issues (Insecure) · Optional**: Skip TLS certificate verification. Use it only for endpoints with a self-signed or otherwise invalid certificate. Off by default.

Source: https://docs.gorunner.io/apps/graphql