Making requests

All API operations are sent as POST requests to the /graphql endpoint.

Request format

POST /graphql HTTP/1.1
Host: api.example.com
Content-Type: application/json
X-Token-Auth: lise-apikey_<login>_<secret>

{
  "query": "query { ... }",
  "variables": { ... },
  "operationName": "MyOperation"
}

Field	Required	Description
`query`	Yes	The GraphQL query or mutation string
`variables`	No	JSON object of variable values
`operationName`	No	Name of the operation to execute (useful when sending multiple operations)

Queries

Queries are read-only operations. Example — list accounts with pagination:

query Accounts($first: Int, $after: String) {
  accounts(first: $first, after: $after) {
    edges {
      cursor
      node {
        id
        status
        createdAt
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
    totalCount
  }
}

curl -X POST https://sandbox.lise.com/graphql \
  -H "Content-Type: application/json" \
  -H "X-Token-Auth: lise-apikey_<login>_<secret>" \
  -d '{
    "query": "query Accounts($first: Int) { accounts(first: $first) { edges { node { id status } } pageInfo { hasNextPage endCursor } totalCount } }",
    "variables": { "first": 10 }
  }'

Mutations

Mutations change server state. They require authentication and an idempotency key.

mutation UpdateAccountStatus($input: UpdateAccountStatusInput!) {
  updateAccountStatus(input: $input) {
    account {
      id
      status
    }
  }
}

Idempotency

All mutations require an Idempotency-Key header containing a UUID v4:

Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000

If you retry a mutation with the same idempotency key, the server returns the result of the original request instead of executing it again. This protects against network failures and duplicate submissions.

👍
Generate a fresh UUID for each distinct mutation attempt. Reuse the same UUID only when retrying a failed request.

Response format

Successful responses return HTTP 200 with a JSON body:

{
  "data": {
    "account": {
      "id": "account|abc123",
      "status": "ACTIVE",
      "createdAt": "2025-01-15T10:30:00Z"
    }
  }
}

When GraphQL encounters errors, the response still returns HTTP 200 but includes an errors array. See Error handling for details.

Selecting fields

GraphQL lets you request exactly the fields you need. Request only what your integration uses — this reduces payload size and improves performance.

# Minimal — only the fields you need
query {
  account(id: "account|abc123") {
    id
    status
  }
}

Content type

Always send Content-Type: application/json. The API does not support application/graphql or GET requests for queries.