GraphQL UI is a powerful web-based interface (Banana Cake Pop, Nitro) for exploring and interacting with GraphQL APIs. It allows users to browse schemas, write queries, and test them live — all in a clean, developer-friendly environment.

GraphQL UI URLs

You can access the GraphQL UI for each environment here:

https://api.dev.xoap.io/graphql/ui

Create a New Document

Once the GraphQL UI loads, click on the “Create Document” button to begin.

Note: If your browser blocks pop-ups, be sure to allow them when prompted.

Configure Authentication

Before you can query the API, you’ll need to authenticate your session.

Open Settings

Click the Settings icon in the top-right corner to configure the connection. You’ll set both the endpoint and OAuth2 credentials.

HTTP Endpoint

Under the “HTTP Endpoint” section, enter the correct URL for your environment:

https://api.dev.xoap.io/graphql

Authorization Setup (OAuth2)

Under the “Authorization” section, configure the following:

Field	Value
Type	OAuth 2
Grant Type	Authorization Code
Authorization URL	https://auth.dev.xoap.io/auth/realms/my.dev.xoap.io/protocol/openid-connect/auth
Access Token URL	https://auth.dev.xoap.io/auth/realms/my.dev.xoap.io/protocol/openid-connect/token
Client ID	graphql
Use PKCE	Yes
Code Challenge Method	SHA-256
Redirect URL	https://api.dev.xoap.io/graphql/ui/
Scope	email profile roles web-origins
Credentials	As Basic Auth Header (default)

Authenticate & Apply

1. Click the Fetch button.
2. You will be redirected to the XOAP login page.
3. Enter your credentials.
4. Once authenticated, you’ll be redirected back to the GraphQL UI.
5. Click “Apply” to confirm the token — it will be added to your request headers.

Add Tenant Header

As with Swagger, the API requires a Tenant ID to be passed in the headers.

We’ll cover how to set this header next.

Add the Tenant Header

In order for your API calls to be accepted, you must include a valid Tenant ID in the request headers.

This step is required — our API uses the Tenant header to identify the workspace making the request. Tenant ID (also referenced as Workspace ID in some cases) can be obtained from app.dev.xoap.io  dashboard as shown here:

To do this:

1. Scroll to the bottom-left HTTP Headers area of the GraphQL UI (below the authentication token section).
2. Click on “Header”.
3. Enter the following values:

• Name: Tenant
• Value: Your Tenant ID

This header is required for all authenticated requests to be valid.

Once added, the Tenant header will be included in all future GraphQL requests sent from the UI.

Load the Schema

Once authenticated and the headers are set, you need to load the schema so the UI can provide query assistance and autocompletion.

You can do this by either:

• Pressing Ctrl + Alt + R
• Clicking the Reload Schema button in the UI

This will fetch the full schema from the server and enable features like field suggestions, type info, and validation.

After the schema loads, try typing a query — the UI will provide IntelliSense-style suggestions based on the available types and fields.

Run a Test Query

Now you’re ready to write and execute GraphQL queries.

• Use the editor panel to enter your query.
• Click the Run () button or press Ctrl + Enter to execute.
• The response will be shown in the right-hand panel.

This is a great way to:

• Explore the API without needing frontend access
• Quickly test custom queries or troubleshoot issues
• Copy working queries into your own scripts or tools

You’ve now completed setup and successfully tested the XOAP GraphQL API.

Optional: You can now combine this with Swagger UI for complete REST + GraphQL coverage in your development or automation setup.

The post GraphQL UI appeared first on XOAP.

Swagger UI is an interactive documentation tool for REST APIs. It allows users to explore available endpoints, see required parameters, and test API calls directly from the browser — without writing any code.
What is it used for?

• Viewing available API endpoints and their request/response structures
• Understanding how to call the API (e.g., required headers, query params)
• Testing endpoints in real-time with actual data
• Getting auto-generated curl and request examples

Why is it useful?

• No frontend required: Backend developers, QA engineers, or integration partners can test APIs even if the frontend isn’t available yet.
• Script-friendly: You can test an API call in Swagger, then use the same request format in tools like Postman, curl, or scripts (e.g., Python, PowerShell).

Swagger URLs

You can access the Swagger UI below:
https://api.dev.xoap.io/swagger/index.html

Authenticating in Swagger UI

Once you’re on the Swagger UI page, follow these steps to authenticate and gain access to protected endpoints.

Select the API Server

At the top of the Swagger UI, there’s a dropdown menu to select the API server.
Choose the option usually labeled: XOAP API SSL

Click the Authorize button near the top right of the page. This opens a popup containing two sections:

• OAuth2 Authorization
• Tenant (apiKey) Header

Under the OAuth2 section:

1. Click the Authorize button.
2. You’ll be redirected to the XOAP login page.
3. Enter your username and password.
4. Upon successful login, you’ll be redirected back to Swagger, and the Authorization header will be automatically included in all requests.

Below the OAuth2 section, there’s a field for setting the Tenant header:

• Paste your Tenant ID into the input box.
• Click the Authorize button next to it.

This step is required — our API uses the Tenant header to identify the workspace making the request. Tenant ID (also referenced as Workspace ID in some cases) can be obtained from app.dev.xoap.io  dashboard as shown here:

Once both authorizations are complete:

• The UI will show green checkmarks.
• You can now click “Close” on the authorization dialog.
• All your requests will now include the correct Authorization and Tenant headers.

You’re now ready to start using the authenticated API in Swagger!

Testing an API Endpoint

Once authenticated, you’re ready to start exploring and testing the API. Find any available endpoint from the list (e.g., under a tag like Devices, Users, etc.), expand it, and click the “Try it out” button. After entering any required parameters (path, query, or body), click “Execute”.

Swagger will show both the request sent and the response received from the server.

What you’ll see:

• The full request URL
• Headers (including Authorization and Tenant)
• Request body (if applicable)
• HTTP response status (e.g., 200 OK, 401 Unauthorized)
• JSON response body from the API

This is a great way to verify that your credentials are working and to understand the structure of requests and responses before integrating into a script or application.

Now that you’ve tested the REST API in Swagger UI, you’re ready to integrate those calls into your own tools and workflows — whether via Postman, curl, or custom scripts.

This enables advanced users to experiment, test, and build their own automation or integration scripts using both API styles as needed.

The post API access documentation (Swagger) appeared first on XOAP.

Get a list of all applications installed on your nodes

The following GraphQL query returns a list of all applications installed across all nodes (systems) in your environment:

query NodesWithSoftware($skip: Int = 0, $take: Int = 500) {
  configMngt_Nodes(skip: $skip, take: $take) {
    totalCount
    pageInfo { hasNextPage }
    items {
      id
      nodeName
      lastSystem {
        software {
          displayName
          displayVersion
          publisher
        }
      }
    }
  }}

Notes:
• If you are managing more than 500 nodes, increase the value of $take accordingly.
• Pagination is supported using skip and hasNextPage.

Get a list of all applications available in XOAP’s Application Management module

This is useful for reporting, validation, or automation tasks involving application definitions. You can use the following GraphQL query for this:

query ListAllApplications($skip: Int = 0, $take: Int = 100) {
  appMngt_Applications(skip: $skip, take: $take) {
    totalCount
    pageInfo { hasNextPage }
    items {
      id
      name
      vendor
      version
      packageName
      operatingSystem
      architecture
      language
      createdAt
      updatedAt
    }
  }
}

This query also returns the metadata for all applications, including details like vendor, version, target OS, and architecture.

Notes:
• You can increase the $take value if more than 100 applications are expected.
• Use the hasNextPage field to implement pagination if needed.

Get a list of all systems from a specific hardware manufacturer

This query allows you to retrieve all nodes from a specific manufacturer (e.g., Lenovo) registered within your XOAP workspace.

This can be useful for inventory audits, hardware lifecycle management, or vendor-specific patching and compliance activities. Use the following GraphQL query:

query LenovoFlatNodes($skip: Int = 0, $take: Int = 5) {
  configMngt_FlatNodes(
    skip: $skip
    take: $take
    where: { csManufacturer: { eq: "LENOVO" } }
    order: [{ nodeName: ASC }]
  ) {
    totalCount
    pageInfo { hasNextPage }
    items {
      id
      nodeName
      csManufacturer
      csModel
      osName
      osVersion
    }
  }
}

Notes:
• Manufacturer Name is case-sensitive.
• To filter for a different vendor (e.g., HP, DELL), change the value of csManufacturer: { eq: "..." } accordingly.
• Increase the $take value to retrieve more records or implement pagination using the hasNextPage field.
• This example sorts results by nodeName in ascending order.

How to know what you can query

XOAP collects a vast amount of data from your nodes, along with additional metadata from your workspace. With such a large data set, it can be difficult to determine which fields are available for querying.

The most effective way to explore available query options is by reviewing the SDL (Schema Definition Language). The SDL provides a complete overview of all objects, fields, and types that can be queried via GraphQL.

By inspecting the SDL, you can:

• Discover all available data structures
• Identify relationships between entities
• Understand the full potential of GraphQL queries within XOAP

This approach ensures you’re not limited by predefined queries and can fully leverage the data collected in your environment.

Need more queries or want to add your own?

The github.com/xoap-io/queries repository is your go‑to collection of reusable GraphQL queries tailored for hardware and application management within XOAP and related platforms.

How to use it:

1. Navigate to the applications/ or hardware/ folders.
2. Copy the relevant .graphql file into your API or GraphQL client.
3. Adjust parameters as needed to fit your environment.

Under the MIT License and with zero stars or forks so far, this project is still blossoming. We highly welcome your contributions—whether it’s by submitting issues, enhancing queries, or opening pull requests to enrich this shared resource. Let’s grow together!

The post What you can do with GraphQL appeared first on XOAP.