Games & Comics — entry 031 of 75
GraphQL Pokemon
GraphQL-Pokemon is an open-source GraphQL API pulling deep Pokémon data — stats, abilities, learnsets, sprites, and Smogon competitive tiers — from Pokémon Showdown, Serebii, and Bulbapedia, kept current within days of new game releases. It's keyless and hosted as a live serverless endpoint with an interactive in-browser playground, distinct from the plain GitHub repo kept as the project's `url`.
GraphQL-Pokemon is a keyless GraphQL API for deep Pokemon data — stats, types, and more — with exactly one endpoint and no GET-a-URL equivalent. A live POST this run against /v8 with a getPokemon(pokemon: dragonite) query returned a genuine 181 B result at HTTP 200, content-type: application/json; charset=utf-8, access-control-allow-origin: *.
GreatAPIs Score
Embed this badge
<a href="https://greatapis.com/api/graphql-pokemon/"><img src="https://greatapis.com/badge/graphql-pokemon.svg" alt="Scored 88 on greatapis.com"></a>Auth quickstart
- No API key, signup, or credit card required — but a plain
GETto/v8(no body, noContent-Type) is refused by Apollo's built-in CSRF prevention with HTTP 400, confirmed live this run:{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header ... or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight...","extensions":{"code":"BAD_REQUEST"}}]}. SendPOSTwith a realContent-Type: application/jsonheader, as in the example below, and it's accepted keylessly.
Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.
Look up a Pokemon's key stats by name
POSThttps://graphqlpokemon.favware.tech/v8
Content-Type: application/json
{"query":"{ getPokemon(pokemon: dragonite) { key num species types { name } baseStats { hp attack defense speed } } }"}{"data":{"getPokemon":{"key":"dragonite","num":149,"species":"dragonite","types":[{"name":"Dragon"},{"name":"Flying"}],"baseStats":{"hp":91,"attack":134,"defense":95,"speed":80}}}}The entry's url field points at the GitHub source repo, while this seed's baseUrl is the live serverless endpoint at favware.tech — two different hosts for two different purposes, not a stale link.
Try it
Developer reference
Gotchas & limits
- The version segment in the path is mandatory and old ones are hard-removed, not redirected — a live POST this run against bare
/,/v6, and/v7all returned HTTP 410 Gone with a JSON body:{"error":"REMOVAL NOTICE! This version of the API is no longer supported. For the latest version please use https://graphqlpokemon.favware.tech/v8..."}. A live probe against the not-yet-existing/v9returned the identical 410 body pointing back at/v8— so a 410 here means "not this version," not necessarily "this version used to exist." pokemon:takes a bare GraphQL enum, not a quoted string, and the failure message actively suggests the value you already passed — a live POST this run withgetPokemon(pokemon: "dragonite")(quoted) returned HTTP 400:Enum "PokemonEnum" cannot represent non-enum value: "dragonite". Did you mean the enum value "dragonite", "dragonair", or "dragonitemega"?. The quotes are the actual bug, not the spelling.- A genuinely unknown enum value is a separate, clearer 400 — a live POST this run with
getPokemon(pokemon: notarealpokemon)returned HTTP 400:{"errors":[{"message":"Value \"notarealpokemon\" does not exist in \"PokemonEnum\" enum.",...,"extensions":{"code":"GRAPHQL_VALIDATION_FAILED"}}]}. - Validation failures are HTTP 400, not the 200-with-an-
errors-array shape many GraphQL clients assume — confirmed live this run on both gotchas above, each carrying"code":"GRAPHQL_VALIDATION_FAILED"at HTTP 400. A client that only checks the response body for anerrorskey, and ignores the status code, will treat these as successful responses.