> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drpn.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GraphQL API overview

> Read-only GraphQL API for agents and integrations: audit runs and reconciliation results for one tenant.

The GraphQL API is Darpan's external, read-only API. An API key belongs to one tenant, and every query reads only that tenant's data.

| | |
| - | - |
| Endpoint | `POST https://<your-instance>/rest/s1/graphql/public` |
| Schema (SDL) | `GET https://<your-instance>/rest/s1/graphql/sdl`, no key needed |
| Authentication | An API key in the `Authorization: Bearer dgql_…` header. See [Authentication](/graphql/authentication) |
| Operations | Queries only. A mutation is rejected |

> [!NOTE]
>
> The audit queries (`auditReport`, `auditFinding`) and API key rotation arrive on an instance with its next Darpan release. Until then, `GET /rest/s1/graphql/sdl` on your instance shows exactly what it serves.

## What you can read

* [`auditReport`](/graphql/queries/audit-report): one audit's report for one morning. Whether the checks can be trusted, what is open, and every statement by category with its checks and findings.
* [`auditFinding`](/graphql/queries/audit-finding): one finding. Its records in each system, evidence, how to fix it, how Darpan confirms the fix, and its history.
* [`reconciliationResults`](/graphql/queries/reconciliation-results) and [`reconciliationResult`](/graphql/queries/reconciliation-result): reconciliation run results.

The audit queries return the same documents as Darpan's JSON (`darpan.audit.report/v1`, `darpan.audit.finding/v1`), with one difference: GraphQL has no maps with dynamic keys, so a keyed object in the JSON is a list here, and each element carries its key (`categories: [{ id: "orders", … }]`).

## Make a request

```bash theme={null}
curl -s https://<your-instance>/rest/s1/graphql/public \
  -H "Authorization: Bearer $DARPAN_GQL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ auditReport(audit: \"month-close\") { health { complete summary } summary { open pending } } }"}'
```

Every response has the same envelope: `data`, `errors` and `extensions.cost`. See [Errors](/graphql/errors) and [Cost and throttling](/graphql/cost-and-throttling).

## Fixing what a finding reports

The API has no mutations. Fix a record in the system it lives in (NetSuite, the OMS, Shopify) with your own tools. Darpan's next scheduled check looks at the record again and closes the finding when the check no longer reports it.

## JSON-RPC

`/rpc/json` is the API of Darpan's own app. Integrations should use GraphQL. See [API overview](/api-reference/overview).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.