---
schema_version: "1"
id: b26ad75868c4f96916493aa26c49a91059f6e925a80715b73f4727866fbf7f16
title: GraphQL Introspection Control Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-included-graphql-introspection-control.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-included-graphql-introspection-control
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ab64c1d6638c98e987fef899868050fac875e4072421be077140b8e729b14615
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
# GraphQL Introspection Control Policy

<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 25%;">
<col style="width: 75%;">
</colgroup>
<tbody>
<tr>
<td class="tableblock halign-right valign-top"><p class="tableblock"><strong>Policy Name</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">GraphQL Introspection Control</p></td>
</tr>
<tr>
<td class="tableblock halign-right valign-top"><p class="tableblock"><strong>Summary</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Blocks or allows requests that  access the <code><em>schema</em></code><em>, <code></code></em><code>type</code>, and <code>__typename</code> GraphQL meta fields</p></td>
</tr>
<tr>
<td class="tableblock halign-right valign-top"><p class="tableblock"><strong>Category</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Security</p></td>
</tr>
<tr>
<td class="tableblock halign-right valign-top"><p class="tableblock"><strong>First Omni Gateway version available</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">v1.13.0</p></td>
</tr>
<tr>
<td class="tableblock halign-right valign-top"><p class="tableblock"><strong>Release Notes</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="https://docs.mulesoft.com/release-notes/gateway/policies/graphql-introspection-control-release-notes" class="xref page">GraphQL Introspection Control</a></p></td>
</tr>
<tr>
<td class="tableblock halign-right valign-middle"><p class="tableblock"><strong>Returned status codes</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">403 Forbidden — The response follows the standard GraphQL error format, including a message such as <code>Introspection field '__schema' is not allowed</code>.</p></td>
</tr>
</tbody>
</table>

## [](#summary)Summary

GraphQL servers include built-in introspection fields that allow clients to discover your API’s types and structure. Configure The GraphQL Introspection Control policy inspects incoming operations blocks requests that reference restricted fields.

Use the introspection policy to block requests to a combination of these fields:

- `__schema`, used to discover the full API schema.
- `__type`, used to look up details for a specific type by name.
- `__typename`, used to read the concrete type name of an object.

Blocking `__typename` can affect GraphQL client libraries that rely on it for result caching.

After Omni Gateway resolves the GraphQL query, the policy evaluates the operation text. Omni Gateway doesn’t inspect the operation text for persisted queries and passes them through without introspection checks.

## [](#configuring-policy-parameters)Configuring Policy Parameters

### [](#local-mode)Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy definition and table of parameters:

\- policyRef:
    name: graphql-introspection-control-flex
  config:
    blockSchema: <boolean> // OPTIONAL, default: false
    blockType: <boolean> // OPTIONAL, default: false
    blockTypename: <boolean> // OPTIONAL, default: false

<table class="tableblock frame-all grid-all fit-content spread">
<colgroup>
<col>
<col>
<col>
<col>
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Parameter</th>
<th class="tableblock halign-left valign-top">Required</th>
<th class="tableblock halign-left valign-top">Default Value</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><code>blockSchema</code></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>No</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><code>false</code></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>If <code>true</code>, Omni Gateway blocks queries that use the <code>__schema</code> field for full schema discovery.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><code>blockType</code></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>No</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><code>false</code></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>If <code>true</code>, Omni Gateway blocks queries that use the <code>__type</code> field to look up a type by name.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><code>blockTypename</code></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>No</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><code>false</code></p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>If <code>true</code>, Omni Gateway blocks queries that use the <code>__typename</code> field to read an object’s concrete type name.</p>
</div></div></td>
</tr>
</tbody>
</table>

#### [](#resource-configuration-example)Resource Configuration Example

This example blocks schema and type introspection, but allows the use `__typename`:

```yaml
- policyRef:
    name: graphql-introspection-control-flex
  config:
    blockSchema: true
    blockType: true
    blockTypename: false
```

### [](#connected-mode)Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table class="tableblock frame-all grid-all fit-content spread">
<colgroup>
<col>
<col>
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Field</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>Block</strong> <code>__schema</code> (<code>blockSchema</code>)</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>If enabled, Omni Gateway blocks queries that use the <code>__schema</code> field for full schema discovery.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>Block</strong> <code>__type</code> (<code>blockType</code>)</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>If enabled, Omni Gateway blocks queries that use the <code>__type</code> field to look up a type by name.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>Block</strong> <code>__typename</code> (<code>blockTypename</code>)</p>
</div></div></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>If enabled, Omni Gateway blocks queries that use the <code>__typename</code> field to read an object’s concrete type name.</p>
</div></div></td>
</tr>
</tbody>
</table>