> ## Documentation Index
> Fetch the complete documentation index at: https://docs.world.org/llms.txt
> Use this file to discover all available pages before exploring further.

# GraphQL Proxy

> Proxy endpoint for Developer Portal GraphQL queries and mutations. Supports user JWTs and API keys. The example query requires authentication; an unauthenticated request returns HTTP 200 with a GraphQL `validation-failed` error (`field 'app' not found in type: 'query_root'`), not a 401.



## OpenAPI

````yaml /openapi/developer-portal.json post /api/v1/graphql
openapi: 3.0.3
info:
  title: Developer Portal API
  version: 1.0.0
  description: >-
    OpenAPI reference for Developer Portal endpoints used across Mini Apps and
    World ID.
servers:
  - url: https://developer.world.org
    description: Primary
  - url: https://developer.worldcoin.org
    description: Legacy domain
  - url: https://staging-developer.worldcoin.org
    description: Staging domain
security: []
paths:
  /api/v1/graphql:
    post:
      summary: GraphQL Proxy
      description: >-
        Proxy endpoint for Developer Portal GraphQL queries and mutations.
        Supports user JWTs and API keys. The example query requires
        authentication; an unauthenticated request returns HTTP 200 with a
        GraphQL `validation-failed` error (`field 'app' not found in type:
        'query_root'`), not a 401.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GraphQLProxyRequest'
            example:
              query: query MyApps { app { id name } }
              variables: {}
              operationName: MyApps
      responses:
        '200':
          description: GraphQL response payload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GraphQLProxyResponse'
        '400':
          description: >-
            Body isn't JSON: wrong `Content-Type` (`invalid_content_type`) or
            malformed JSON (`invalid_json`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                invalid_content_type:
                  value:
                    code: invalid_content_type
                    detail: Content-Type must be application/json.
                    attribute: content-type
                invalid_json:
                  value:
                    code: invalid_json
                    detail: Request body must be valid JSON.
                    attribute: null
        '401':
          description: 'Rejected `api_` API key: not found, inactive, or wrong secret.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                invalid_or_inactive:
                  value:
                    code: unauthenticated
                    detail: Invalid or inactive API key.
                    attribute: null
                invalid_secret:
                  value:
                    code: unauthenticated
                    detail: Invalid API key secret.
                    attribute: null
components:
  schemas:
    GraphQLProxyRequest:
      type: object
      required:
        - query
      properties:
        query:
          type: string
          description: GraphQL query or mutation string.
        variables:
          type: object
          additionalProperties: true
          description: Optional GraphQL variables object.
        operationName:
          type: string
          description: Optional operation name.
    GraphQLProxyResponse:
      type: object
      additionalProperties: true
      description: >-
        Pass-through GraphQL response. Usually includes `data` and optionally
        `errors`.
    ErrorResponse:
      type: object
      properties:
        code:
          type: string
        detail:
          type: string
        attribute:
          type: string
          nullable: true
        app_id:
          type: string
          description: Included when the request identifies an app.
        team_id:
          type: string
          description: Included when the route has resolved the app's team.

````