# GraphiQL Playground The GraphiQL Playground is an in-browser editor for the GraphQL API. In it, you write, validate, and run queries against the endpoint URL that serves it, and the editor checks the query for errors as you type. Use it to explore the datasets and fields of an endpoint, and to test a query before you send it from code. [Access GraphiQL Playground](/en/documentation/devtools/graphql/first-steps/#run-your-first-query) --- ## Open the Playground Each GraphQL API endpoint URL serves the Playground when you open it in a browser. The Playground of an endpoint runs only the datasets that endpoint serves: | Endpoint URL | Data | | ---------------------------------------------- | --------------------------------------------------------- | | `https://api.azion.com/v4/metrics/graphql` | Aggregated metrics, such as the `workloadMetrics` dataset | | `https://api.azion.com/v4/events/graphql` | Raw events, such as the `workloadEvents` dataset | | `https://api.azion.com/v4/billing/graphql` | Billing data | | `https://api.azion.com/v4/accounting/graphql` | Accounting data | | `https://api.azion.com/v4/consumption/graphql` | Consumption data | To open the Playground, sign in to [Azion Console](https://console.azion.com/), then go to the endpoint URL in the same browser. Without a signed-in session, the URL returns HTTP `401` with this body instead of the Playground: ```json {"detail": "Authentication credentials were not provided."} ``` --- ## Run a query To run a query, paste it into the Playground editor and run it. The Playground validates the query against the schema of its endpoint as you type and marks each error it finds. The response is JSON: a `data` object with one array per dataset in the query, or a `detail` message when the API refuses the query. A query for a dataset the endpoint does not serve is refused. For example, a `workloadEvents` query sent to the metrics endpoint returns HTTP `400`: ```json { "detail": "Cannot query field \"workloadEvents\" on type \"Query\". Did you mean \"workloadMetrics\" or \"workloadBreakdownMetrics\"?" } ``` To run that query, open the Playground of the events endpoint instead. > **Tip** > > After a query runs, the Playground adds the query to the page URL as an encoded parameter. Copy the URL and share it: whoever opens it gets the same query. --- ## Sample queries The queries in this section run in the Playground as written. Each one names the endpoint whose Playground runs it. Paste a query, then change its fields, filters, and dates to see how the response changes. ### Schema introspection This introspection query runs in the Playground of any of the five endpoints. It returns the schema of that endpoint: every type, with its fields, arguments, and enum values, including the deprecated ones and the reason each one is deprecated: ```graphql query IntrospectionQuery { __schema { queryType { name } mutationType { name } subscriptionType { name } types { ...FullType } directives { name description locations args { ...InputValue } } } } fragment FullType on __Type { kind name description fields(includeDeprecated: true) { name description args { ...InputValue } type { ...TypeRef } isDeprecated deprecationReason } inputFields { ...InputValue } interfaces { ...TypeRef } enumValues(includeDeprecated: true) { name description isDeprecated deprecationReason } possibleTypes { ...TypeRef } } fragment InputValue on __InputValue { name description type { ...TypeRef } defaultValue } fragment TypeRef on __Type { name ofType { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name } } } } } } } } ``` The response names `Query` as the query type and returns `null` for the mutation and subscription types: the GraphQL API reads data and has no mutations. ### Data transferred over time The `HttpCalculatedDataTransferred` query reads the `workloadMetrics` dataset in the Playground of the metrics endpoint. It selects `ts`, `dataTransferredIn`, `dataTransferredOut`, and `dataTransferredTotal` for the window in `tsRange`, groups the rows by `ts`, sorts them with `ts_ASC`, and sets `limit` to `2000`. The deprecated `httpMetrics` dataset takes the same query; use `workloadMetrics`. ### Top IPs behind attacks The `TOP5IPsWAFRequests` query reads the `workloadEvents` dataset, so it runs in the Playground of the events endpoint, `https://api.azion.com/v4/events/graphql`. It counts the requests [WAF](/en/documentation/platform/firewall/#waf) flagged as attacks, groups them by client IP address and attack family, and returns the five largest counts. In the Playground of the metrics endpoint, the same query returns HTTP `400`. The events endpoint keeps records for about 7 days. Replace the `begin` and `end` values with a window inside the last 7 days: ```graphql query TOP5IPsWAFRequests { workloadEvents( limit: 5 filter: { tsRange: { begin:"2026-09-26T14:00:00" end:"2026-10-03T14:00:00" }, wafMatchNe: "-" wafAttackFamilyNe: "-" } aggregate: { count: rows } groupBy:[remoteAddress, wafAttackFamily] orderBy:[count_DESC] ) { remoteAddress wafAttackFamily count } } ``` When WAF flagged no request in the window, the `workloadEvents` array comes back empty. For what each argument and field does, refer to [Find the IPs behind attack traffic](/en/documentation/guides/platform/observability/query-top-ips-attack-traffic-with-graphql/). ### Top attack families The `Top5Attacks` query reads the `workloadMetrics` dataset in the Playground of the metrics endpoint. It groups the requests by attack family, ranks the families by `wafRequestsThreat`, the number of requests WAF flagged as threats, and returns the five highest. Replace the `begin` and `end` values with your window: ```graphql query Top5Attacks { workloadMetrics( limit: 5 filter: { tsRange: { begin:"2026-09-26T14:00:00" end:"2026-10-03T14:00:00" } } groupBy:[wafAttackFamily] orderBy:[wafRequestsThreat_DESC] ) { wafAttackFamily wafRequestsThreat } } ``` For a window in which WAF flagged no request, the response holds one row, with `-` as the attack family and `0` threat requests: ```json { "data": { "workloadMetrics": [ { "wafAttackFamily": "-", "wafRequestsThreat": 0 } ] } } ``` For what each argument and field does, refer to [Find the top attacks with GraphQL](/en/documentation/guides/platform/observability/query-top-attacks-with-graphql/). --- ## Related resources - [GraphQL API](/en/documentation/devtools/graphql.md): Every page of the GraphQL API documentation, from the quickstart to the fields of each dataset. - [GraphQL API guides and tutorials](/en/documentation/devtools/graphql/guides.md): More queries to adapt, each one in a guide that covers one task. - [Queries](/en/documentation/devtools/graphql/queries.md): The raw, aggregated, financial, and usage query shapes, each with its response. - [Datasets and query arguments](/en/documentation/devtools/graphql/features.md): The datasets of each endpoint and the filter, sort, and pagination arguments a query accepts.