GraphQL

GraphQL reads the same content as the Delivery API, with the same keys. Use it when one page needs several things at once, such as the page, its menu and its banners, in a single request.

Try queries in Configuration › API playground. It opens on GraphQL, lists every query and type beside the editor, and shows the curl command for what you run.

Requests

Send a delivery key as Authorization: Bearer <key> or x-api-key: <key>, and POST a JSON body:

1curl 'https://api.bifrostorbit.com/cms/graphql' \2  -H 'Authorization: Bearer cms_pk_…' \3  -H 'Content-Type: application/json' \4  -d '{"query":"query ($url: String!) { page(url: $url, region: \"de\") { name url } }","variables":{"url":"/products/hiking-boots"}}'

GET works too, with query, variables (as JSON text) and operationName in the query string. URL-encode them:

curl -G 'https://api.bifrostorbit.com/cms/graphql' \  -H 'Authorization: Bearer cms_pk_…' \  --data-urlencode 'query={ regions { key name } }'

Answers are JSON with data, and errors when something went wrong:

{ "data": { "page": { "name": "Hiking boots", "url": "/products/hiking-boots" } } }

Browser code on any website may call it with a public key; a secret key only works from a server. See From a browser in the Delivery API.

Queries

Every query that reads content takes region and locale, which work as in the Delivery API: a region key or code such as germany or de, and a language code such as de-DE. Leave them out for the defaults. draft: true reads drafts and needs a secret key.

locale and region are String, and draft is Boolean, everywhere. references: true replaces Reference and References values in fields and components with the entries they point at, as include=references does in REST. See References in the Delivery API. sitemap, banners and popups answer with the same JSON as their REST endpoints, under serverTime and items for campaigns.

Some options exist only in REST: sorting, filtering, tag, category and q for lists, strict for globals and addresses, and loggedIn for banners. Use the Delivery API for those.

Types

JSON holds content shaped by your space, such as fields and components, and cannot be selected into. DateTime is an ISO 8601 timestamp such as 2026-10-01T09:30:00.000Z.

Page

PageList and Summary

Summaries leave the page body out on purpose. Ask page for one. Select fields to read entries without an address, such as FAQ entries, in one request.

Global

Navigation and NavItem

Select children again for each level of the menu you want.

Region and Locale

Resolution and Redirect

Unlike REST, resolve answers 200 for every kind. Read kind to decide what to do.

Examples

A page with its menus and banners

One request for everything a page template needs. Aliases fetch two menus at once.

1query PageView($url: String!, $region: String) {2  page(url: $url, region: $region) {3    name4    url5    locale6    fallbackApplied7    components8    seo9  }10  header: navigation(key: "main", region: $region) {11    items {12      label13      href14      children {15        label16        href17      }18    }19  }20  footer: navigation(key: "footer", region: $region) {21    items {22      label23      href24    }25  }26  banners(path: $url, region: $region)27}

{ "url": "/products/hiking-boots", "region": "de" }

A paged list

1query Products($page: Int) {2  pages(type: "product", region: "de", page: $page, perPage: 12) {3    items {4      url5      name6      publishedAt7    }8    total9    page10    hasMore11  }12}

Ask for the next page while hasMore is true.

Entries without an address

FAQ entries, authors and other entries without a page of their own are read through pages with their fields:

1{2  pages(type: "faqEntry", region: "de", perPage: 50) {3    items {4      id5      name6      fields7    }8  }9}

A page with the entries it references

1{2  page(url: "/pricing", region: "de", references: true) {3    components4  }5}

A References field in a component then holds the entries, each with id, url, name, contentType, publishedAt and fields, instead of their ids.

A global entry

1{2  global(key: "footer", region: "de") {3    name4    locale5    fields6    components7  }8}

Before rendering an address

1query Route($url: String!) {2  resolve(url: $url, region: "de") {3    kind4    redirect {5      destination6      statusCode7    }8    page {9      name10      components11      seo12    }13  }14}

Drafts and preview

Add draft: true to each query that should read drafts, and send a secret key (cms_sk_…). Secret keys exist only for staging environments. A public key asking for drafts gets 401.

1query Preview($url: String!) {2  page(url: $url, region: "de", draft: true) {3    name4    version5    components6  }7}

See Set up the live preview.

From the SDK

1const data = await cms.graphql<{ page: { name: string; components: unknown[] } }>(2  'query ($url: String!) { page(url: $url, region: "de") { name components } }',3  { variables: { url: '/products/hiking-boots' } },4)

cms.graphql(query, options) answers with data. The options are variables, operationName, preview and signal. Pass the expected shape as the type.

• preview: true sends the client's preview key instead of its public key. It does not add draft: true; put that in the query.
• GraphQL requests are never cached by the SDK and are not retried.
• Any error in the answer is thrown, not returned beside partial data: CmsAuthError for 401, CmsRateLimitError for 429, CmsUnavailableError for 500 or when the API cannot be reached, and CmsError with the status and message for anything else, such as a missing page.

See the SDK.

Errors

Errors come in errors, each with a message, a code under extensions, and the path and locations of the field that failed when there is one:

1{2  "data": { "page": null },3  "errors": [4    {5      "message": "Content not found",6      "locations": [{ "line": 1, "column": 3 }],7      "path": ["page"],8      "extensions": { "code": "not_found" }9    }10  ]11}

• When page, global or navigation fails, that field is null and the other fields still answer, so a missing menu does not lose the page.
• pages, regions, resolve, sitemap, banners and popups never answer null, so when one of them fails the whole data is null.
• When several fields fail, the HTTP status comes from the first error.
• page, global and navigation report a missing item as an error rather than a quiet null. Check errors before using data.

Limits

• Each request counts once against the rate limit of 15,000 requests a minute per key and per IP address, shared with the REST endpoints. See the Delivery API.
• perPage in pages is at most 100.
• A query may be at most 20,000 characters long.
• A query may nest at most 10 levels, counting from the top field, and ask for at most 300 fields. Each alias and each use of a fragment counts. Split a bigger read into several requests.
• Introspection is on, so GraphQL tools can read the schema from the address, and introspection fields do not count towards the limits. The API playground shows the schema too.
• Persisted queries are not supported. Send the full query each time.

Caching

Every GraphQL answer has Cache-Control: no-store and Vary: Authorization, so nothing between your website and the API keeps it. Cache in your website instead, and refresh on publish webhooks. See Refresh the website when content changes. For pages a CDN should cache, the REST endpoints carry cache headers.