---
schema_version: "1"
id: 4139d8fd62bc89adfba939e8247f10ccc0867fe0c266cf9a32f7663354a3876b
title: GraphQL Operation Limits Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-graphql-operation-limits.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-graphql-operation-limits
source_site: docs.mulesoft.com
content_type: documentation
content_hash: dd67bec03495ad7d7c5430dd43800740523048536932ce6048620715560e167f
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: graphql, operation limits, api gateway, flex gateway, gateway, policy
---

# GraphQL Operation Limits Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>GraphQL Operation Limits</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Limits GraphQL operation depth, aliases, root fields, and directives</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.13.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/graphql-operation-limits-release-notes">GraphQL Operation Limits</a></p></td></tr><tr><td><p><strong>Returned status codes</strong></p></td><td><p>400 - Operations that exceed a configured limit. The response follows the standard GraphQL error format and lists each violation. For example, <code>Query depth of 7 exceeds the maximum allowed depth of 5</code></p></td></tr></tbody></table>

## Summary

The GraphQL Operation Limits policy restricts the depth, aliases, root fields, and directives in
incoming requests. If an operation exceeds a limit, Omni Gateway returns a 400 error with a JSON
`errors` array detailing each violation.

Omni Gateway evaluates limits at parse time from the document text. Because fragment spreads don’t
expand, metrics reflect the written document instead of a fully expanded query plan that the gateway
builds at runtime.

For persisted queries, the gateway resolves the document without inline query text. The policy
bypasses these requests and allows them to pass to the upstream service.

If the parser can’t read the query, the policy logs a debug message and doesn’t block the request,
so upstream validation or other policies can still run.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: graphql-operation-limits-flex config: maxDepth: <integer> // OPTIONAL, use -1 or
omit to disable maxAliases: <integer> // OPTIONAL, use -1 or omit to disable maxRootFields:
<integer> // OPTIONAL, use -1 or omit to disable maxDirectives: <integer> // OPTIONAL, use -1 or
omit to disable

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>maxDepth</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Omit or set to <code>-1</code> to disable</p></div></div></td><td><div><div><p>Maximum depth of nested fields in a single document.</p></div></div></td></tr><tr><td><div><div><p><code>maxAliases</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Omit or set to <code>-1</code> to disable</p></div></div></td><td><div><div><p>Maximum number of field aliases.</p></div></div></td></tr><tr><td><div><div><p><code>maxRootFields</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Omit or set to <code>-1</code> to disable</p></div></div></td><td><div><div><p>Maximum number of top-level fields.</p></div></div></td></tr><tr><td><div><div><p><code>maxDirectives</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Omit or set to <code>-1</code> to disable</p></div></div></td><td><div><div><p>Maximum number of directives across the document.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

This example caps depth and aliases while leaving root fields and directives unrestricted.

```yaml
- policyRef:
    name: graphql-operation-limits-flex
  config:
    maxDepth: 8
    maxAliases: 20
    maxRootFields: -1
    maxDirectives: -1
```

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Required</th></tr></thead><tbody><tr><td><div><div><p>Maximum Depth</p></div></div></td><td><div><div><p>Deepest level of field nesting in a document. For example, <code>{ hero { name } }</code> has a depth of 2.</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Maximum Aliases</p></div></div></td><td><div><div><p>Maximum number of field aliases in the document.</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Maximum Root Fields</p></div></div></td><td><div><div><p>Maximum number of top-level fields that an operation can declare.</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Maximum Directives</p></div></div></td><td><div><div><p>Maximum number of directives across the document.</p></div></div></td><td><div><div><p>No</p></div></div></td></tr></tbody></table>

## See Also

- [Inbound Policies Directory](https://docs.mulesoft.com/gateway/1.13/policies-included-directory)

- [Securing Omni Gateway Instances with Policies](https://docs.mulesoft.com/gateway/1.13/gateway-secure-apis)