GraphQL API Testing — Queries, Mutations, Subscriptions (2026)

Last updated 2026-07-20 · 11 min read · By Avinash Kamble, reviewed by Priyanka G.

GraphQL testing is not REST testing with different syntax. Field-level failures, N+1 query bugs, schema drift, and subscription state are all new failure modes. This guide covers the patterns that actually work in 2026, plus the security tests every GraphQL API needs.

Key takeaways

• Query, mutation, and subscription test patterns.
• N+1 detection via query plans.
• Schema drift detection in CI.
• The 4 GraphQL security tests every QA runs.

const res = await request.post('/graphql', {
  data: {
    query: `query { user(id: "1") { id email orders { id total } } }`,
  },
});
const { data, errors } = await res.json();
expect(errors).toBeUndefined();
expect(data.user.email).toMatch(/@/);
expect(data.user.orders).toHaveLength(3);

Always assert errors === undefined first — GraphQL returns 200 even on partial failures.

Run a query that fetches a list with a nested relation. Enable query logging in the resolver. If you see N+1 SQL queries per row, the API is missing a DataLoader batch. Automate this in CI by asserting the query count is bounded (e.g. ≤5 for a 100-item list).

npx graphql-inspector diff schema.graphql http://localhost:4000/graphql --fail-on-breaking

Runs as a PR gate — any breaking schema change (removed field, changed type) fails the build. Non-breaking additions pass.

1. Introspection disabled in production ({__schema} returns error).
2. Query depth limit (deeply nested queries rejected).
3. Query cost analysis (expensive queries throttled).
4. Auth checked at field level, not just query entry.

Related: RBAC security checklist, REST Assured tutorial. Docs: graphql.org/learn/best-practices.