GraphQL Complexity Limit

Context
GraphQL queries offer flexibility and customization to users, allowing them to define their own queries.
However, this advantage can also be a potential drawback, as users may execute queries that consume significant resources.

Limit Enforcement
To prevent overloading the GraphQL engine with excessively complex and resource-intensive queries, a complexity limit is enforced on the public GraphQL API.
This limit defines the maximum allowed complexity for a query.

Result when Limit is Reached
If a query exceeds the complexity limit, the API response will contain an error message indicating that the maximum allowed operation complexity has been exceeded.
The response may include additional information such as the actual complexity of the query and the allowed complexity.

{
  "errors": [
    {
      "message": "The maximum allowed operation complexity was exceeded.",
      "extensions": {
        "complexity": 900000,
        "allowedComplexity": 400000,
        "code": "HC0047"
        }
    }
  ]
}

Maximum Complexity Limit

400000

In order to ensure optimal performance and prevent potential overload situations, a maximum complexity limit of 400,000 has been chosen for Sage Active Public API V2 queries.

This value is defined to allow a wide range of queries to be executed within the GraphQL API while still maintaining a manageable level of complexity.
This recommended value helps strike a balance between query flexibility and system resource utilization.

Default Complexity Calculation

The default calculation algorithm in HotChocolate considers the complexity of the query fields and their child fields.
Each field has a default complexity, and the total cost is the sum of the individual field complexities.

Changes in Complexity Calculation with HotChocolate v15

Starting from HotChocolate v15, the complexity system has been simplified.
The directive @cost now only uses a single weight argument to indicate the cost of resolving a field.
The previous arguments (complexity, defaultMultiplier, and multipliers) have been removed from the framework and are no longer supported.
This change makes cost management more predictable and easier to configure.

Example of GraphQL query complexity calculation:

query {
    paymentTerms (
        first: 2
        after: null
    ){
        edges {
            node {
                id
                name
                lines {
                    day
                    order
                }
            }
        }
    }
}

Let’s break down the complexity calculation for this query:

• Each field has a default complexity value assigned to it.
• When a field is annotated with @cost(weight: "X"), its base complexity becomes X instead of the default 1.
• The total complexity is the sum of the field complexities and their nested children.

The unit complexity of the selection set for one PaymentTerm is 21.

Since the query requests first: 2, the total query complexity is:

21 × 2 = 42

If the query requested first: 100, the total query complexity would be:

21 × 100 = 2100

HotChocolate Official Documentation

For more detailed information on operation complexity and its configuration, refer to the official HotChocolate documentation:
HotChocolate Operation Complexity