GraphQLConf 2026

How do you power a product where every page layout, module, and slice of content can change daily—across hundreds of millions of devices—without shipping a new client every time? In this talk, we’ll dive into how Netflix evolved its GraphQL APIs from traditional “data fetching” into a server‑driven UI platform, enabling rapid product innovation and page updates without requiring app releases across a massive device ecosystem. We’ll walk through the architecture that lets servers describe dynamic page structure and behavior, how those contracts scale across many product surfaces and experiments, and the performance and reliability lessons we learned operating this at Netflix scale. When we built this system, we found almost no public examples of similar patterns, so this session is intentionally practical: we’ll share concrete schema patterns, client rendering strategies, and tips you can apply to your own feeds, homepages, and highly dynamic experiences—whether you’re working at Netflix scale or just starting to stretch GraphQL beyond CRUD.

GraphQL isn't just an API technology—it's the perfect foundation for AI agents and LLM-powered applications. At Starbucks, we built GraphQL platforms at massive scale (180M+ queries/day, 10,000 stores, 31M+ app users) before GenAI became mainstream. Now, as we explore AI integration, we're discovering that GraphQL provides fundamental advantages for AI that are impossible with REST.

This talk explores the AI systems we're building on our existing GraphQL infrastructure:

In-store AI assistant (planned for Order Engine GraphQL BFF)
Mobile/web AI platform (exploring on Apollo Supergraph)
On-call automation using Model Context Protocol (MCP) servers
You'll learn how GraphQL reduces AI token costs by 75x, enables zero-configuration AI tool discovery, provides built-in guardrails through type systems, and why federation is the perfect architecture for enterprise AI agents. Real demos, proven patterns, lessons from building GraphQL at scale.

Retirement data is surprisingly complicated, from provisions to participant payroll data to plan sponsor's unique needs. This presents a complicated and heavy requirement to fetch data points that provide the value, and regulatory requirements, that third party administrators require. GraphQL provides this, it allows specific data to be fetched at each stage of the plan lifecycle, without requiring us to fetch all of the data that we have. This allowed our platform to decrease latency by 30%, load time by 1 second, and server load by 50%.

What if your GraphQL API could understand what developers need and generate valid operations from plain English? This talk introduces graphql-embedding, an open-source toolkit that parses GraphQL schemas into vector embeddings, stores them in a vector store, and uses a multi-agent LLM pipeline to generate validated GraphQL operations from natural language input.

The architecture is fully modular: swap vector stores between PGLite for local development and PostgreSQL for production, choose from Ollama, OpenAI, or Anthropic as LLM providers, and extend with your own. A key design decision was bundling a lightweight embedding model directly in the package, enabling local CPU inference with no external API calls, cloud dependencies, or GPU required. The entire pipeline to generate a operation works with small, efficient models like QWen 2.5 running locally via Ollama.

Everything ships as a VS Code extension called GraphQL Workbench, putting schema embedding and natural language operation generation directly in the developer's workflow. All packages, models, and the extension are fully open source under the MIT license.

Viaduct, Airbnb's unified data access layer, hosts over 1.5M lines of application code from 500+ tenants, with 200+ changes merged daily—all operating as a single service. At this scale, enabling teams to independently monitor and troubleshoot their code is essential.
This talk describes how we approach observability with multitenancy at the core:
- Establishing clear ownership of modules and attributing metrics, spans, and errors to those owners
- Providing alerts and dashboards at multiple levels: system, operation, tenant, and field
- Enabling schema-driven alerting, where tenants declaratively specify monitoring requirements directly in the schema and the platform implements them automatically
- Using execution traces to visualize query execution and core-tenant interactions, tackling challenges like:
- Representing batched dataloader calls (where N field requests become 1 RPC)
- Instrumenting downstream service clients across all data-fetching code
- Managing observability costs via selective sampling and cardinality-aware metrics

Our goal: empower tenants to manage their portion of Viaduct as a standalone service—without bottlenecking on the platform team.

At Airbnb, our GraphQL gateway is a multi-tenant serverless platform hosting 500+ tenants and 1.5M+ lines of application code. Like many large GraphQL systems, it operated as a "shared fate" architecture. To mitigate this risk, we embarked on a multi-year journey to implement traffic sharding at different levels of sophistication. We started with shuffle sharding to reduce the blast radius of any single bad operation. We then added targeted sharding to separate online from asynchronous traffic, to rapidly quarantine misbehaving operations, and to improve the signal-to-noise ratio for our automated canary analysis. Most recently, to mitigate the risk posed by tenants that are used by lots of operations (and thus could bring down lots of shards), we have been working on tenant-aware sharding that minimizes the blast radius of such tenants.

We will cover how we architected our sharding solution and how it improved our operational abilities. You will gain a clear understanding of how our implementation tradeoffs have fared over time, key production insights gathered since rollout, and strategies to evolve a GraphQL gateway towards greater isolation without fragmenting the API surface.

Producing valid and realistic mock data for prototyping and testing has been an unsolved challenge for years. Mock data is tedious to write and maintain, but attempts to improve the process such as random value generation and field stubbing fall short as they lack essential domain context to make test data realistic and meaningful.
In this talk, I’ll share how we’ve reimagined GraphQL mocking at Airbnb by combining existing GraphQL infrastructure, rich product and schema context, and LLMs to generate convincing, type-safe mock data simply by adding a directive (@generateMock) to a field or operation:
- How integrating LLMs that are highly contextualized by a schema, documentation, and UX design into existing GraphQL tools drives a leap forward in the speed and quality of mock data creation.
- How a directive-driven approach lets engineers generate production-like, schema-conformant mock data without writing code.
- How integrating generated mock data into the GraphQL client runtime can enable engineers to build and test clients before server implementation.
- How this strategy guarantees that generated mock data is correct, deterministic, and stays in-sync with the server schema.

Trusted documents (persisted queries) are one of the most powerful tools in the GraphQL security and performance toolkit. By restricting your API to only pre-approved operations, you eliminate entire classes of attacks, reduce payload sizes, and gain full visibility into client behavior. Yet most struggle to adopt them – the tooling is fragmented, the workflow is manual, and the deployment story is an afterthought.

What if your entire platform natively supported trusted documents from end to end? In this talk, I’ll show what becomes possible when persisted queries are first-class citizens of your GraphQL platform – from registration and version through CI/CD validation to production deployment and rollback. But trusted documents aren’t just for GraphQL clients. I’ll explore how they unlock new capabilities: exposing GraphQL operations as simple REST endpoints, and even powering MCP tools for AI agents – all built on the same foundation of pre-approved, governed operations.

You’ll leave with a clear picture of what a complete trusted documents platform looks like and practical steps to get there.

Fragments—an indispensable tool for modularizing data requirements alongside client code, but also a denial-of-service attack vector for servers. Security guides will tell you to mitigate by validating queries and performing cost analysis, usually via field costs and list sizes. However, this focus on field execution can distract from how fragments affect the rest of the server stack. In this lightning talk, we explore the attack patterns and mitigation strategies for the fragment-based vulnerabilities at the core of CVE-2025-31496, CVE-2025-32030, CVE-2025-32033, and CVE-2025-32034.

GraphQL has always been a community driven project. In this closing keynote, we will look at what the GraphQL Working Groups have been building and the progress made across the specification and ecosystem. We will also highlight the GraphQL GAP proposal and explore how it can open new opportunities for collaboration. Join us as we reflect on how far GraphQL has come and how the community can help shape what comes next.