It is with either doing it in multiple queries and logically combining the results on client side, or doing it in a custom DQL query using variable blocks. Note, that doing it with DQL bypasses any auth rules that you otherwise have in place in your GraphQL schema. There is a RFC over here that may interest you: