GraphiQL Playground

Open GraphiQL on a GraphQL API endpoint URL, run queries in the browser, and adapt sample queries for the schema, attacks, and attack IPs.

Last updated

View as Markdown Agent setup

The GraphiQL Playground is an in-browser editor for the GraphQL API. In it, you write, validate, and run queries against the endpoint URL that serves it, and the editor checks the query for errors as you type. Use it to explore the datasets and fields of an endpoint, and to test a query before you send it from code.

Access GraphiQL Playground

Open the Playground

Each GraphQL API endpoint URL serves the Playground when you open it in a browser. The Playground of an endpoint runs only the datasets that endpoint serves:

Endpoint URLData
https://api.azion.com/v4/metrics/graphqlAggregated metrics, such as the workloadMetrics dataset
https://api.azion.com/v4/events/graphqlRaw events, such as the workloadEvents dataset
https://api.azion.com/v4/billing/graphqlBilling data
https://api.azion.com/v4/accounting/graphqlAccounting data
https://api.azion.com/v4/consumption/graphqlConsumption data

To open the Playground, sign in to Azion Console, then go to the endpoint URL in the same browser. Without a signed-in session, the URL returns HTTP 401 with this body instead of the Playground:

{"detail": "Authentication credentials were not provided."}

Run a query

To run a query, paste it into the Playground editor and run it. The Playground validates the query against the schema of its endpoint as you type and marks each error it finds. The response is JSON: a data object with one array per dataset in the query, or a detail message when the API refuses the query.

A query for a dataset the endpoint does not serve is refused. For example, a workloadEvents query sent to the metrics endpoint returns HTTP 400:

JSON
01{
02 "detail": "Cannot query field \"workloadEvents\" on type \"Query\". Did you mean \"workloadMetrics\" or \"workloadBreakdownMetrics\"?"
03}

To run that query, open the Playground of the events endpoint instead.

After a query runs, the Playground adds the query to the page URL as an encoded parameter. Copy the URL and share it: whoever opens it gets the same query.

Sample queries

The queries in this section run in the Playground as written. Each one names the endpoint whose Playground runs it. Paste a query, then change its fields, filters, and dates to see how the response changes.

Schema introspection

This introspection query runs in the Playground of any of the five endpoints. It returns the schema of that endpoint: every type, with its fields, arguments, and enum values, including the deprecated ones and the reason each one is deprecated:

GraphQL
01query IntrospectionQuery {
02 __schema {
03 queryType { name }
04 mutationType { name }
05 subscriptionType { name }
06 types {
07 ...FullType
08 }
09 directives {
10 name
11 description
12 locations
13 args {
14 ...InputValue
15 }
16 }
17 }
18}
19
20fragment FullType on __Type {
21 kind
22 name
23 description
24 fields(includeDeprecated: true) {
25 name
26 description
27 args {
28 ...InputValue
29 }
30 type {
31 ...TypeRef
32 }
33 isDeprecated
34 deprecationReason
35 }
36 inputFields {
37 ...InputValue
38 }
39 interfaces {
40 ...TypeRef
41 }
42 enumValues(includeDeprecated: true) {
43 name
44 description
45 isDeprecated
46 deprecationReason
47 }
48 possibleTypes {
49 ...TypeRef
50 }
51}
52
53fragment InputValue on __InputValue {
54 name
55 description
56 type {
57 ...TypeRef
58 }
59 defaultValue
60}
61
62fragment TypeRef on __Type {
63 name
64 ofType {
65 kind
66 name
67 ofType {
68 kind
69 name
70 ofType {
71 kind
72 name
73 ofType {
74 kind
75 name
76 ofType {
77 kind
78 name
79 ofType {
80 kind
81 name
82 ofType {
83 kind
84 name
85 }
86 }
87 }
88 }
89 }
90 }
91 }
92}

The response names Query as the query type and returns null for the mutation and subscription types: the GraphQL API reads data and has no mutations.

Data transferred over time

The HttpCalculatedDataTransferred query reads the workloadMetrics dataset in the Playground of the metrics endpoint. It selects ts, dataTransferredIn, dataTransferredOut, and dataTransferredTotal for the window in tsRange, groups the rows by ts, sorts them with ts_ASC, and sets limit to 2000. The deprecated httpMetrics dataset takes the same query; use workloadMetrics.

Top IPs behind attacks

The TOP5IPsWAFRequests query reads the workloadEvents dataset, so it runs in the Playground of the events endpoint, https://api.azion.com/v4/events/graphql. It counts the requests WAF flagged as attacks, groups them by client IP address and attack family, and returns the five largest counts. In the Playground of the metrics endpoint, the same query returns HTTP 400.

The events endpoint keeps records for about 7 days. Replace the begin and end values with a window inside the last 7 days:

GraphQL
01query TOP5IPsWAFRequests {
02 workloadEvents(
03 limit: 5
04 filter: {
05 tsRange: {
06 begin:"2026-09-26T14:00:00"
07 end:"2026-10-03T14:00:00"
08 },
09 wafMatchNe: "-"
10 wafAttackFamilyNe: "-"
11 }
12 aggregate: {
13 count: rows
14 }
15 groupBy:[remoteAddress, wafAttackFamily]
16 orderBy:[count_DESC]
17 )
18 {
19 remoteAddress
20 wafAttackFamily
21 count
22 }
23}

When WAF flagged no request in the window, the workloadEvents array comes back empty. For what each argument and field does, refer to Find the IPs behind attack traffic.

Top attack families

The Top5Attacks query reads the workloadMetrics dataset in the Playground of the metrics endpoint. It groups the requests by attack family, ranks the families by wafRequestsThreat, the number of requests WAF flagged as threats, and returns the five highest. Replace the begin and end values with your window:

GraphQL
01query Top5Attacks {
02 workloadMetrics(
03 limit: 5
04 filter: {
05 tsRange: {
06 begin:"2026-09-26T14:00:00"
07 end:"2026-10-03T14:00:00"
08 }
09 }
10 groupBy:[wafAttackFamily]
11 orderBy:[wafRequestsThreat_DESC]
12 )
13 {
14 wafAttackFamily
15 wafRequestsThreat
16 }
17}

For a window in which WAF flagged no request, the response holds one row, with - as the attack family and 0 threat requests:

JSON
01{
02 "data": {
03 "workloadMetrics": [
04 {
05 "wafAttackFamily": "-",
06 "wafRequestsThreat": 0
07 }
08 ]
09 }
10}

For what each argument and field does, refer to Find the top attacks with GraphQL.

GraphQL API

Every page of the GraphQL API documentation, from the quickstart to the fields of each dataset.

GraphQL API guides and tutorials

More queries to adapt, each one in a guide that covers one task.

Queries

The raw, aggregated, financial, and usage query shapes, each with its response.

Datasets and query arguments

The datasets of each endpoint and the filter, sort, and pagination arguments a query accepts.