Postgraphile

PostGraphile turns a Postgres schema into a GraphQL API with zero resolver code: tables become query types and mutations (with CRUD operations), views become read-only types, foreign keys become relationship fields, and Postgres functions become custom mutations or queries. Row-Level Security (RLS) policies integrate natively — PostGraphile sets session variables (jwt.claims.role, jwt.claims.user_id) from JWT tokens, and Postgres enforces data access at the row level. PostGraphile v5 (Grafast engine) delivers significantly improved query planning performance. Strong for teams already using Postgres who want a GraphQL API without building a custom resolver layer. Self-hosted; MIT license. Confidence is docs-derived.

GraphQL endpoint at /graphql. Introspection: GET /graphiql (interactive playground). Standard GraphQL: POST /graphql with {query, variables}. Auto-generated operations: query { allPosts(condition: {authorId: 1}, orderBy: CREATED_AT_DESC, first: 10) { nodes { id title body } totalCount } }. Mutations: createPost(input: {post: {title, body, authorId}}) { post { id } }. deletePost(input: {nodeId: ...}) { post { id } }. Relationships: post.authorByAuthorId { name email }. Functions exposed as: query { myCustomFunction(arg1: ...) }. Subscriptions: subscription { listen(topic: "my-topic") { relatedNode { ... } } } (via PG LISTEN/NOTIFY). Node IDs: global node IDs for relay-compatible pagination.

JWT auth: PostGraphile validates JWT and sets Postgres role + session variables for each request. pgSettings callback: set role = jwt.claims.role; set jwt.claims.user_id = ...; — RLS policies in Postgres use these session vars. Default role (unauthenticated_user) for requests without JWT. JWT secret configured at startup. Authorization: Bearer {jwt} header. HTTPS enforced via reverse proxy (PostGraphile is typically behind Nginx/Caddy). No OAuth2 built-in — pair with an auth provider that issues JWTs (e.g., Supabase Auth, Auth0).

Standard HTTP status codes; GraphQL errors in {errors} array. RLS denial: query returns empty results (not 403) — rows are simply filtered by RLS policy. Permission errors (schema access): error in GraphQL response. Connection pool: PostGraphile uses pg pool; configure pool size for concurrency. Subscriptions: WebSocket-based via PG LISTEN/NOTIFY — reliable for low-to-moderate event rates; high event rates may require tuning. Self-hosted reliability: operator-managed. PostGraphile itself is stateless — horizontal scaling is straightforward. Grafast (v5) significantly reduces DB query count via intelligent query planning.

graphile.org/postgraphile is comprehensive — getting started guide, schema design guide (how to structure Postgres for best GraphQL output), RLS integration guide, subscriptions docs, and Grafast migration guide. Getting started: npx postgraphile -c postgres://... — running GraphQL server in one command. Express middleware for embedding in existing apps. Smart comments (Postgres COMMENT ON) for customizing generated GraphQL types. Community via Graphile Discord (active) and GitHub (graphile/crystal, formerly graphile-engine). Benjie Gillam (maintainer) is very active in community discussions. MIT license; Graphile Pro for additional features.