[fire_lake]

A GraphQL schema is a contract though.

And the REST API can still get hammered by the client - they could do an N + 1 query on their side. With GraphQL at least you can optimize this without adding a new endpoint.

[dudeinjapan]

Yes, GraphQL is a "contract" in the sense that a blank check is also a "contract".

[arcticfox]

You can whitelist queries in most systems though. In development mode allow them to run whatever query, and then lock it in to the whitelist for production. If that type of control is necessary.