Read-only mode for GraphQL API tokens

User API access tokens now have an explicit GraphQL access mode. You can create tokens that can run GraphQL queries but not mutations.

When creating or editing a user API access token, the GraphQL permission offers three options:

• Disabled: No GraphQL API access
• Read-only: Can run queries, but mutations are rejected
• Full access: Can run both queries and mutations

Key details

• Existing tokens are unaffected: All previously created GraphQL-enabled tokens continue to work with full access.
• Mutation guard: Read-only tokens are blocked before any mutation code runs, so there is no risk of partial side effects.
• Audit visibility: The selected GraphQL access mode is displayed in the token summary and the organization API access audit view.

For more information, see the API access tokens documentation.