GraphQL Threat Protection policy

Updated 22 July 2026

GraphQL's relational structure can let malicious users exploit deep and cyclic queries to overload servers, causing denial-of-service (DoS) attacks. GraphQL threat protection mitigates this risk by enforcing query complexity limits based on Depth, Entries, and Operations. GraphQL API validates these limits in the query, and queries exceeding these limits result in a 400 Bad Request error.

note

GraphQL Threat Protection policy only supports the GET and POST methods.

Timing

On Request	On Request Content
	X

Configuration

Property	Required	Description	Type	Default
maxEntries	Yes	The maximum number of fields requested, including nesting in fragments.	Integer (no limit)	-1
maxDepth	Yes	The maximum allowed nesting levels of fields, including nesting in fragments.	Integer (no limit)	-1
maxQueryorMutationCount	Yes	The maximum number of allowed operations for a request.	Integer (no limit)	-1

HTTP status Code

Code	Message
400	Received in the following cases: Maximum entries exceeded. Maximum depth exceeded. Maximum operation exceeded.

Example

The following is a sample GraphQL query with 14 entries and 5 depths.

Request:

{
  company {                                    -------entry 1, -----depth 1
    ceo {                                      -------entry 2, -----depth 2
      name                                     -------entry 3
      age                                      -------entry 4
      department {                             -------entry 5, -----depth 3
        name                                   -------entry 6
        employees {                            -------entry 7, -----depth 4
          id                                   -------entry 8
          name                                 -------entry 9
          position {                           -------entry 10, ----depth 5
            title                              -------entry 11
            salary {                           -------entry 12
              amount                           -------entry 13
              currency                         -------entry 14
            }
          }
        }
      }
    }
  }
}