# GraphQL

Support for GraphQL is available in private beta for select customers. To gain access to the beta, email us at [support@satoricyber.com](mailto:support@satoricyber.com).

To add the GraphQL API Server Data Store to Satori perform the following steps:

## Adding a GraphQL API Server Data Store to Satori

Perform the following steps to add a API Server data store to your Satori account:

1. Login to the [**Satori Management Console**](https://app.satoricyber.com/).
2. In the **Data Stores view**, click the plus button to **add a new data store**.
3. Select the **API Server** option.
4. Provide an **informative name** for the data store, for example: _Prod API Server_.
5. Choose a **Data Access Controller** to use for this data store by selecting the **Cloud provider** and **Region**.
6. Click the **Add New Data Store** button.
7. You will be redirected to the **Data Stores list view**.
8. Consult with your Satori technical representative regarding additional properties such as reverse proxy mode, authentication URL and more.

## Known Limitations

Data Classification and Data Filtering on GraphQL API Server data stores are not supported.

## Connecting to GraphQL APIs via Satori

Satori Data Access Controller supports two connection modes for GraphQL APIs.

### Forward Proxy Mode

When in **Forward Proxy** mode, Satori generates a new hostname for your API server, for example: `abc123.us-east1.g.p0.satoricyber.net`. Clients using the API must change their calls to the new hostname. No further action is required on the backend to support this forward proxy mode.

### Reverse Proxy Mode

In Reverse Proxy mode, clients do not need to change their call to a new hostname. The existing hostname is configured with a CNAME record to point to the Satori generated hostname. For example:

```
api.acme.com CNAME abc123.us-east1.g.p0.satoricyber.net
```

To enable reverse proxy mode, Satori needs to supply clients with a TLS certificate that matches `api.acme.com`. Satori supports several integration options for customer-provided TLS certificates, contact [support@satoricyber.com](mailto:support@satoricyber.com) for more details.

## Network Policy Settings

Satori provides you with the ability to define your network security policy for your data store.

Simply, specify which IP addresses and subnet masks should be allowed access to the Data Store and which IP addresses and subnet masks should be blocked. Note: Satori allows all IP address ranges if you leave the form empty by default.

### Example 1

**To allow all IP addresses** - Leave the form blank.

### Example 2

**To block specific IP addresses** - Add them to the blocked IP address list.

### Example 3

**To only allow access to specific IP addresses** - Add them to the allow list. Note: Access from all other IP addresses will be blocked.

### Example 4

**To allow access from a specific IP address range while blocking parts of the range** - Add the IP range to the list of allowed IP addresses and add the IP address that you wish to block to the Block list.