> For AI agents: this documentation is indexed at https://docs.united-security-providers.ch/usp-core-waap/llms.txt, and every page is available as markdown at its own address plus index.md.

# GraphQL Basic Usage

(This section assumes you have read the section [What is Coraza?](coraza/#what-is-coraza))

* By default, GraphQL validation is not active on any route.
* GraphQL related settings are at `spec.coraza.graphql` and
  `spec.routes[].coraza.graphql`, plus general Coraza settings
  at `spec.coraza` and `spec.routes[].coraza`
  in the [API Reference](../crd-doc/#corewaapservicespeccoraza).
* To activate GraphQL on a route, you have to first define
  a config and then reference it at a route,
  see the above settings.
* The GraphQL schema can be provided from a ConfigMap or from an OCI image.
* You can turn GraphQL validation off and on in various ways,
  by disabling Coraza and/or GraphQL globally or per route,
  see the above settings.
* You can configure limits for complexity, depth and batch size,
  and allow introspection or not,
  also with the above settings.
* Regarding size limits,
  see also the section [Large Payloads](../../operation/large-payloads.md).
* To use auto-learning,
  it is recommended to first use GraphQL in mode DETECT,
  and then auto-learn using the [Auto-Learning CLI](../../operation/autolearning.md)
  with processing argument `graphql`.

## Basic Example

Here's a basic example
with GraphQL with default maxima for complexity, depth and batch size
(and introspection not allowed by default),
active in mode BLOCK on the route `/anything`,
and some limits on request and response body,
and with CRS disabled.

```yaml
spec:
  [...]
  coraza:
    requestBodyAccess: true
    requestBodyLimitKb: 1024
    responseBodyAccess: false
    responseBodyLimitKb: 128
    crs:
      defaultEnabled: false
    graphql:
      configs:
      - name: "graphql-book"
        schemaSource:
          configMap: "graphql-book-config-map"
          key: "schema.graphql"
  routes:
    - match:
        path: /anything
        pathType: "PREFIX"
      coraza:
        graphql:
          enabled: true
          ref: "graphql-book"
          mode: "BLOCK"
      backend:
        address: httpbin
        port: 8000
        protocol:
          selection: h1
```