A GraphQL API is a web API style where clients ask for exactly the fields and actions they need, usually through queries and mutations. Unlike fixed REST endpoints, GraphQL can reduce overfetching and make complex apps easier to build, but it also concentrates access to many objects and operations behind one interface.
That flexibility makes server-side authorization critical. Every field, query, and mutation must be checked on the server, because the client can be modified or bypassed entirely. In real attacks, weak GraphQL authorization can lead to IDOR-style access, unauthorized record updates, excessive data exposure, or abuse of nested queries that reach objects the user should not control. Defenders often limit query depth, restrict introspection in production, validate inputs, and enforce object-level permissions in resolvers.