영속 쿼리와 자동 영속 쿼리

Every GraphQL request normally carries the entire query string. Large queries mean larger payloads, more bandwidth, and repeated parsing and validation on the server.

Persisted queries reduce this overhead by sending a short hash instead.

A persisted query is a query string the server already knows, stored under a unique ID (usually a SHA-256 hash). Clients send the ID, and the server looks up the full query.

APQ automates registration. The client first sends only the hash. If the server does not recognize it, the client resends with the full query, which the server then caches under that hash.

The flow has two possible steps:

• Client sends hash only -> if known, server responds
• If unknown, server returns PersistedQueryNotFound
• Client resends hash + full query -> server caches and responds

APQ travels in the request's extensions field, carrying the hash and protocol version.

Once a query is persisted, the server can skip parsing and validating its document, and the network carries only a small hash. This lowers latency and CPU for hot queries.

Because a persisted query is just a hash, it fits in a URL. Sending it as a GET request lets a CDN cache the response, offloading the server entirely for repeated reads.

Add an AutomaticPersistedQueriesProvider backed by a cache (such as Caffeine) when building the GraphQL source.

You can run APQ in safelist mode: only pre-approved queries are allowed, and unknown hashes are rejected outright. This blocks arbitrary client queries, shrinking your attack surface.

APQ shines for stable, repeated queries from your own apps. For ad-hoc tooling, exploratory queries, or constantly changing documents, the handshake overhead may outweigh the savings.

Get the most from persisted queries:

• Size the cache to hold your hot queries
• Use GET + CDN for cacheable reads
• Consider safelist mode for production security
• Monitor cache hit rates to tune

You optimized with persisted queries:

• Send a hash instead of the full query string
• APQ registers queries automatically via a handshake
• Skips re-parsing and enables GET + CDN caching
• Safelist mode adds security; enable via a document provider

Persisted queries cut payload, latency, and attack surface for hot queries.