We want to get to a point where we use our GraphQL API for as much development as possible. This gives us a number of advantages: 1. Greater decoupling of frontend and backend work. In many cases, frontend work will be possible without backend work, assuming that the relevant resources are already exposed. 2. Single source of truth for accessing a resource on the backend side. We can get subtle bugs or changes in behaviour when the REST API has two endpoints that do almost, but not quite, the same thing; or where an internal controller API does something different to the REST API, even though users can technically use the internal APIs themselves. 3. Move faster on API development. With GraphQL, we're not writing specific endpoints, which means we don't need to consider things like adding a new parameter to an existing endpoint to expose more fields, or coming up with a new endpoint instead. We always have to support the existing behaviour for the same call and so the API design can accrete some weirdness over time. 4. Only public APIs. Right now we have the REST API and the internal controller APIs. The former is documented but hard to change quickly (as per the above point), and the latter is easy to change but completely undocumented. Getting to that point means: 1. Not using internal APIs inside Rails controllers. 2. Not adding new REST API endpoints (unless they are backed by GraphQL). 3. Replacing existing cases of the above two to either: 1. Use GraphQL directly from the frontend. 2. Wrap the backend implementation to use the GraphQL API. (For example, frontend -> Rails controller -> GraphQL). - - - There are child epics on the way to this point: we have a GraphQL API with monitoring, logging, and reasonably complexity limits set up; some resources in the REST API are already backed by GraphQL; and we have built several features using the GraphQL API. https://gitlab.com/groups/gitlab-org/-/epics/1367 describes adding commonly-used resources to our GraphQL API, and making our REST API for those resources use the GraphQL code internally. This epic is for the remaining tasks, which should be created and owned by the relevant group.