Hive introduces persisted documents for GraphQL API security

Hive has introduced support for persisted documents through app deployments, now available in preview. This feature allows developers to pre-register GraphQL operations, enabling clients to send a hash of an operation rather than a full query. This approach reduces upstream traffic and enhances security by limiting the API to only known, authorized operations.

To manage the complexity of multiple active application versions, Hive allows users to publish persisted documents to the Hive registry via the Hive CLI, which then distributes them to the Hive CDN. This ensures that all GraphQL API replicas can resolve operation hashes to the correct documents without requiring a new API deployment for every app update.

Additionally, the Hive Router supports persisted documents, allowing it to resolve document IDs from configured storage. The router can extract these IDs from various request locations, such as JSON payloads, URL query parameters, or URL path segments. The system also includes schema check capabilities that identify which active app deployments might be affected by breaking changes, helping developers assess the impact of schema updates before deployment.