hasura-graphql-engine_skill

Overview

This skill is a complete guide to Hasura GraphQL Engine for building production-ready GraphQL APIs from PostgreSQL. It covers instant API generation, granular permissions, authentication strategies, event triggers, Actions for custom business logic, remote schemas, and deployment considerations. The content focuses on practical patterns you can apply to real projects. It aims to help developers move quickly from prototype to secure, maintainable production APIs.

How this skill works

Hasura inspects your PostgreSQL schema and automatically exposes queries, mutations, and subscriptions without writing resolvers. It uses declarative metadata (tracked tables, relationships, permissions, remote schemas, Actions, event triggers) that you manage via the console, metadata API, or CLI. Authentication is delegated to your auth provider (JWT or webhook) while Hasura enforces role-based authorization using session variables. Event triggers and Actions let you integrate external services and custom logic asynchronously or synchronously.

When to use it

• Create instant CRUD GraphQL APIs from an existing PostgreSQL schema
• Build real-time apps with subscriptions and live queries
• Enforce row-level and column-level access controls for multi-tenant apps
• Integrate multiple data sources or stitch remote GraphQL schemas
• Implement event-driven workflows with reliable database triggers
• Extend API surface with custom business logic via Actions

Best practices

• Model permissions around session variables and minimal default roles to reduce blast radius
• Keep metadata in version control and manage migrations with the Hasura CLI
• Prefer JWT claims for scalable auth; use webhook mode only when per-request custom logic is required
• Use Actions for business logic and remote schemas for service composition to keep database layer focused
• Design event triggers for idempotent handlers and configure retry/timeouts for reliability
• Limit exposed columns per role and audit permission changes regularly

Example use cases

• Admin dashboard exposing full columns for admins and limited views for end users via column-level security
• Realtime collaborative dashboard using subscriptions for live updates
• User signup flow triggering a welcome email via an event trigger webhook
• Payment or file-processing flows implemented as Actions that call external services
• Migrating a monolithic REST backend by stitching legacy GraphQL services and exposing a unified API