GraphQL v26.7+

Maho exposes the same resources over GraphQL as over REST, via API Platform's built-in GraphQL support. Every resource's fields, arguments, and types are introspectable from the schema.

Endpoint: POST /api/graphql Admin GraphQL: POST /api/admin/graphql (requires a fully-authenticated admin session)

Both are opt-in: enable the graphql / admin_graphql protocols under System → Configuration → Services → API → API Protocols. Authentication is the same JWT bearer token as REST (see Authentication); send it in the Authorization header.

# Query: fetch a product by its node IRI
query {
  product(id: "/api/rest/v2/products/123") {
    id
    sku
    name
    price
  }
}

# Mutation: update stock for a SKU
mutation {
  updateStock(input: {sku: "ABC-123", qty: 50}) {
    sku
    qty
    previousQty
    success
  }
}

Field naming

API Platform derives every custom GraphQL field name as lcfirst(operationName + ResourceShortName) - the resource noun is always appended. Only the reserved item/collection queries escape this and yield the clean singular/plural (product / products, order / orders). So a custom operation named setPaymentMethodOn on the Cart resource becomes the field setPaymentMethodOnCart; operations are named with a natural qualifier (a verb, or on / to / from / my / guest / current) so the appended noun reads well rather than stuttering (setPaymentMethodCart).

Two consequences worth knowing:

• The signed-in customer is currentCustomer (not me), a guest cart/order is guestCart / guestOrder, and a caller's own collections are myAddresses / myReviews / myWishlistItems / myRevocationRequests.
• Natural-key lookups are collection filter arguments, not separate by<X> queries. Filter the collection to fetch by a key: products(sku:), products(barcode:), categories(urlKey:), productAttributes(code:), cmsPages(identifier:), cmsBlocks(identifier:) - each returns the 0-or-1 match.

Reference

Item queries take a node IRI (id: "/api/rest/v2/products/123"); collection queries are plural and accept pagination plus any listed filter arguments. Admin-only queries/mutations require an admin or service token with the relevant permission (see Authentication).

Catalog

Cart & checkout

Gift messages have no separate resource - they are the setGiftMessageOnCart / removeGiftMessageFromCart mutations above.

Customers

Sales

Inventory & promotions

checkBalanceGiftCard(code:) is the public balance check (returns balance + status with the code masked, no recipient/sender PII).

Content

Marketing

Store, directory & tax

resolveUrlResolveResult resolves a storefront path to its target entity. The doubled noun is unavoidable under the naming rule - naming it resolveUrl would force a Url type and a nonsense url / urls list query - so it's kept as-is.