How does GraphQL and Scoping work?

[10618071]

I have developed an LTI that I am using at several schools. I am trying to convert to GraphQL for my queries. Also, some of the API calls I am using require includes.

Many of the schools I work with are asking if they can scope my developer token, and I'd prefer to switch to global token which also requires a scoped token.

But, my understanding from about a year ago is that scoping does not work with GraphGL and includes in API calls

So, this is really a two part question.

1. Does scoping work with GraphQL yet? If not, is there an ETA (a dangerous question I know ) and if so, is there a reference some where?
2. Does scoping work with includes yet?  If not, is there an ETA (a dangerous question I know ) and if so, is there a reference some where?

Thanks so much for your help!

[chelista]

I also have the same question/problem. The problem I need to solve is retrieving all courses and sections. So far I am retrieving a course and then looping through each school to retrieve the sections. I would like to only make a single request and trim down the field set to minimize the network overhead. GraphQL is the perfect solution but not at the expense of permissions.

[10618071]

I thought I'd give this question a little bump to see if I get any responses. Understanding the security model around GraphQL is important to anyone who wants to use it.

[michaelfowles]

Most recent reply from Instructure regarding graphql and dev key scoping: 

"Currently developer key scoping is incompatible with Graphql api calls do (sic) to lack of support for scoping being available for Graphql calls. We started prohibiting the use of Graphql with scoped tokens for that reason in our 2019-10-09 deploy.  We do not currently have anything on our short term roadmap to change this behavior, though I can tell you that the current state of this disparity in functionality has been reviewed fairly recently by members of our product team."