Graph health turnaround for a high-traffic SaaS
:::note Sample content Placeholder structure — swap in the real engagement details, with client approval on all numbers. :::
The situation
A scale-up whose GraphQL API had grown organically for four years: no pagination standard, resolver N+1s on every list, business errors thrown as exceptions, and an alerting stack blind to failures because everything returned HTTP 200.
What we did — the two-week Graph Health Check
Fixed-price diagnostic, exactly as productized:
- Schema review against our best-practices baseline — nullability, pagination, error lanes, deprecation hygiene.
- Performance profile — traced the top 20 operations, found 6 resolver-level N+1s and one uncapped
first:argument being exploited by a customer's misbehaving script. - Security posture — no depth/complexity limits, introspection open in production, no persisted operations.
- Prioritized fix list — plain-English report, sequenced by impact vs effort, with effort estimates their own team could execute against.
The result
- Report delivered in 2 weeks, fixes executed by the client's team over the following quarter
- p95 on list-heavy endpoints down ~60% after the N+1 and pagination fixes
- Field-level error alerting installed — the "200-with-errors" blind spot closed
- Depth limits + persisted operations shipped; the runaway-script incident class eliminated
What made it work
The client's engineers did the implementation — the audit just told them exactly where to dig, in what order, and gave them the patterns to follow. That's the model: we're expensive for finding the problems, cheap for you to fix them.