# Restrict visibility of graphql mutation and queries

**URL:** <https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094>\
**Category:** GraphQL\
**Created:** [July 29, 2020, 1:43pm UTC](https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094 "2020-07-29T13:43:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidLeonardi](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/davidleonardi/32/3683_2.png) [@davidLeonardi](https://discuss.dgraph.io/u/davidLeonardi)\
**Post date:** [July 29, 2020, 1:43pm UTC](https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094/1 "2020-07-29T13:43:54Z")

</div>

I would like to whitelist [or whatever the politically correct wording of that is nowadays] access to specific graphql mutations/queries for all users.

As Dgraph autogenerates CRUD interfaces for everything, I’d like to clamp down on that and only expose things i decide should be exposed.

How would i go about doing that?

---

<div class="post-metadata">

**Author:** ![amaster507](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/amaster507/32/4123_2.png) [@amaster507](https://discuss.dgraph.io/u/amaster507)\
**Post date:** [July 29, 2020, 11:14pm UTC](https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094/2 "2020-07-29T23:14:35Z")

</div>

Look at the docs for the @auth directive.

---

<div class="post-metadata">

**Author:** ![davidLeonardi](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/davidleonardi/32/3683_2.png) [@davidLeonardi](https://discuss.dgraph.io/u/davidLeonardi)\
**Post date:** [July 30, 2020, 7:12am UTC](https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094/3 "2020-07-30T07:12:21Z")

</div>

Which part, specifically? I seem to have missed it.

---

<div class="post-metadata">

**Author:** ![ajeet](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/ajeet/32/4161_2.png) [@ajeet](https://discuss.dgraph.io/u/ajeet)\
**Post date:** [July 30, 2020, 7:41am UTC](https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094/4 "2020-07-30T07:41:29Z")

</div>

Hey @davidLeonardi,

The docs about the @auth directive can be found [here](https://graphql.dgraph.io/doc/authorization/directive/).

---

<div class="post-metadata">

**Author:** ![abhimanyusinghgaur](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/abhimanyusinghgaur/32/2980_2.png) [@abhimanyusinghgaur](https://discuss.dgraph.io/u/abhimanyusinghgaur)\
**Post date:** [July 30, 2020, 7:49am UTC](https://discuss.dgraph.io/t/restrict-visibility-of-graphql-mutation-and-queries/9094/5 "2020-07-30T07:49:55Z")

</div>

[Here](https://graphql.dgraph.io/doc/authorization/) are the `@auth` docs.

You can form appropriate JWT token, and pass it to the GraphQL API, which will decide based on that token whether someone can perform the query/mutation they are trying to do. So, if you don’t want all your users to have access to certain queries/mutations, then you can have a schema with auth rules like this:

```auto
type Country @auth(
	query: { rule: "{$ROLE: { eq: \"ADMIN\"}}"},
	add: { rule: "{$ROLE: { eq: \"ADMIN\"}}"},
	update: { rule: "{$ROLE: { eq: \"ADMIN\"}}"},
	delete: { rule: "{$ROLE: { eq: \"ADMIN\"}}"}
){
	id: ID!
	name: String! @search(by: [hash])
}

```

Then just don’t issue your users a JWT token containing `ROLE` as `ADMIN`, and they won’t be able to perform any query/mutation for type `Country`.

We are in the process of updating our docs at present, so expect better docs in a couple of days.