> ## Documentation Index
> Fetch the complete documentation index at: https://docs.boxpressd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GraphQL

> Query curated Boxpressd catalog and OAuth-scoped user data through GraphQL.

Send GraphQL operations to `POST https://api.boxpressd.com/graphql`. Every request requires a developer key.

```bash theme={null}
curl "https://api.boxpressd.com/graphql" \
  --header "content-type: application/json" \
  --header "x-boxpressd-key: $BOXPRESSD_DEVELOPER_API_KEY" \
  --data '{"operationName":"SearchCigars","query":"query SearchCigars($query: String!, $first: Int!) { searchCigars(query: $query, first: $first) { edges { cursor node { id name brand { id name } origin wrapper } } pageInfo { hasNextPage endCursor } } }","variables":{"query":"liga privada","first":20}}'
```

## Available queries

Public catalog queries include:

* `node`, `cigar`, and `searchCigars`
* `brand` and `brands`
* `product`, `products`, and `productByBarcode`
* `venue` and `venues`
* `event` and `events`
* `user`, with public profile fields only unless you query your own scoped profile

Connected-user queries require an OAuth Bearer token and the corresponding scope:

| Query             | Required scope     |
| ----------------- | ------------------ |
| `me`              | `profile:read`     |
| `myCollections`   | `collections:read` |
| `myHumidors`      | `humidor:read`     |
| `mySmokeSessions` | `sessions:read`    |
| `myCheckIns`      | `checkins:read`    |

```graphql theme={null}
query MyCollections($first: Int!, $after: String) {
  myCollections(first: $first, after: $after) {
    edges {
      cursor
      node { id name type updatedAt private }
    }
    pageInfo { hasNextPage endCursor }
  }
}
```

Send both credentials for this operation:

```http theme={null}
x-boxpressd-key: bxp_test_replace_me
Authorization: Bearer eyJ...
```

## Pagination and limits

Connections use `first` and opaque `after` cursors. The default page size is `20`; the maximum is `100`.

The API rejects operations that exceed these limits before resolver execution:

* Maximum depth: `8`
* Maximum aliases: `20`
* Maximum root fields: `10`
* Default maximum calculated cost: `1,000`

Batched GraphQL HTTP operations are disabled. The initial schema has no mutation root. Introspection exposes only the curated public schema.

<Info>
  Mutations that write data on behalf of a connected user are coming soon. Requesting a write-oriented OAuth scope does not make a mutation available today.
</Info>