
Research
/Security News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.
graphql-api
Advanced tools
Documentation | PyPI | GitHub
A powerful and intuitive Python library for building GraphQL APIs, designed with a code-first, decorator-based approach.
graphql-api simplifies schema definition by leveraging Python's type hints, dataclasses, and Pydantic models, allowing you to build robust and maintainable GraphQL services with minimal boilerplate.
async and await for high-performance, non-blocking resolvers.pip install graphql-api
Create a simple GraphQL API in just a few lines of code.
# example.py
from graphql_api.api import GraphQLAPI
# 1. Initialize the API
api = GraphQLAPI()
# 2. Define your root type with decorators
@api.type(is_root_type=True)
class Query:
"""
The root query for our amazing API.
"""
@api.field
def hello(self, name: str = "World") -> str:
"""
A classic greeting.
"""
return f"Hello, {name}!"
# 3. Define a query
graphql_query = """
query Greetings {
hello(name: "Developer")
}
"""
# 4. Execute the query
if __name__ == "__main__":
result = api.execute(graphql_query)
print(result.data)
Running this script will produce:
$ python example.py
{'hello': 'Hello, Developer'}
Leverage Pydantic for data validation and structure. graphql-api will automatically convert your models into GraphQL types.
from pydantic import BaseModel
from typing import List
from graphql_api.api import GraphQLAPI
class Book(BaseModel):
title: str
author: str
@api.type(is_root_type=True)
class BookAPI:
@api.field
def get_books(self) -> List[Book]:
return [
Book(title="The Hitchhiker's Guide to the Galaxy", author="Douglas Adams"),
Book(title="1984", author="George Orwell"),
]
api = GraphQLAPI()
graphql_query = """
query {
getBooks {
title
author
}
}
"""
result = api.execute(graphql_query)
# result.data will contain the list of books
Define async resolvers for non-blocking I/O operations.
import asyncio
from graphql_api.api import GraphQLAPI
api = GraphQLAPI()
@api.type(is_root_type=True)
class AsyncAPI:
@api.field
async def fetch_data(self) -> str:
await asyncio.sleep(1)
return "Data fetched successfully!"
# To execute async queries, you'll need an async executor
# or to run it within an async context.
async def main():
result = await api.execute("""
query {
fetchData
}
""")
print(result.data)
if __name__ == "__main__":
asyncio.run(main())
Use dataclasses to define the structure of your data, and mark fields as mutable to automatically separate them into the GraphQL Mutation type.
from dataclasses import dataclass
from graphql_api.api import GraphQLAPI
@dataclass
class User:
id: int
name: str
# A simple in-memory database
db = {1: User(id=1, name="Alice")}
api = GraphQLAPI()
@api.type(is_root_type=True)
class Root:
@api.field
def get_user(self, user_id: int) -> User:
return db.get(user_id)
@api.field(mutable=True)
def add_user(self, user_id: int, name: str) -> User:
new_user = User(id=user_id, name=name)
db[user_id] = new_user
return new_user
GraphQL automatically separates queries and mutations - you don't need separate classes. Fields marked with mutable=True are placed in the Mutation type, while regular fields go in the Query type. Fields with AsyncGenerator return types are automatically detected as subscriptions. This automatic mapping means you can define all your operations in a single class and let graphql-api handle the schema organization for you.
See the documentation for advanced schema patterns, federation, remote GraphQL, and more.
Visit the official documentation for comprehensive guides, tutorials, and API reference.
To contribute or run the test suite locally:
# Install dependencies
uv sync
# Run tests
uv run pytest
FAQs
A framework for building Python GraphQL APIs.
We found that graphql-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

Research
/Security News
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise.

Product
Stay on top of alert changes with filtered subscriptions, batched summaries, and notification routing built for triage.