Queries, keys and limits
URLs
| URL | Serves |
|---|---|
https://query.atlas.thymelabs.io/subgraphs/<subgraph-id> | The production release. Returns 403 until a release is promoted. |
https://query.atlas.thymelabs.io/subgraphs/<subgraph-id>/versions/<version-id> | That release, promoted or not |
Send GraphQL as POST with a JSON body ({"query": "…", "variables": {…}}). Request bodies are limited to 1 MiB. Responses are compressed with zstd, brotli or gzip when the client sends Accept-Encoding.
Keys
| Key | Prefix | Used for |
|---|---|---|
| Query key | atlas_qk_ | GraphQL queries |
| Deployment key | atlas_dk_ | graph create, graph deploy and artifact uploads |
Create and revoke keys on the console's Keys page; they belong to a project. Send a query key as Authorization: Bearer <key> or X-API-Key: <key>. Revoked keys stop working within seconds.
CORS allows any origin, so browsers can call the query URL directly. If you do, restrict the key with a policy.
Key policies
A query key can be limited with a policy, set when you create it or later with Edit key policy. A key without a policy is unrestricted.
| Rule | Limit | Effect |
|---|---|---|
| Subgraphs | up to 50 | The key queries only these subgraphs. |
| Allowed origins | up to 20 | Browser requests must come from one of these origins. |
| Allowed IPs | up to 20 addresses or CIDR ranges | Requests must come from one of these addresses. |
Origins are written as browsers send them, https://app.example.com or http://localhost:3000, with no path; up to 128 characters each. A leading *. matches any subdomain (https://*.example.com) but not the domain itself. A request from another origin, or with Origin: null, gets 403.
A request without an Origin header is allowed, because server-side clients don't send one. An origin policy therefore stops other websites from using your key in a browser, but it does not make a public key secret: a script can send any Origin or none. The rate limits below bound what such a key can do.
Rate and concurrency limits
| Scope | In flight | Per second |
|---|---|---|
| Query key | 16 | 150 |
| Workspace | 32 | 300 |
A request over a limit waits up to 1 second for a free slot. If none frees up, it gets 429 with Retry-After: 1. Responses that Graph Node can serve from its cache, such as repeated identical queries at the same block, are faster than the rest.
GraphQL limits
| Limit | Value |
|---|---|
| Query timeout | 30 seconds |
first | up to 1000 |
| Query depth | 100 |
| Query complexity | 1,100,000 |
Errors
| Status | Meaning |
|---|---|
| 401 | Missing, invalid or revoked key |
| 403 | The key's policy denies the request, the key can't access this subgraph or release, the subgraph has no production release, or the release isn't queryable (not ready yet, or indexing failed) |
| 404 | Unknown path. Query URLs start with /subgraphs/. |
| 429 | Over a rate or concurrency limit after waiting 1 second; retry after Retry-After |
| 503 | Temporarily unavailable; retry with backoff |
Plan allowances
The free plan includes 100,000 queries per month and 100,000 stored entities. Indexing pauses above the entity allowance. To go beyond them, turn on pay-as-you-go on the console's Usage page and pay by card or from dBank.