I've not even touched graphql, but based on the 101 versions and variations of the same concept before it, theoretically, yes, practically, hell no. I've seen

I've not even touched graphql, but based on the 101 versions and variations of the same concept before it, theoretically, yes, practically, hell no. I've seen it done with SOAP queries, XML schemas, strict REST interfaces, OData APIs, etc., etc. It just doesn't, ever, work. You'll end up making the code crazy convoluted jumping through tons of hoops to get it to work with the invariable plethora of edge case, or worse, you'll leave a ton of easily exploitable security holes. No new programmer joining your team will have a clue how it works, people will come up with different 'fixes' to get around the limitations meaning there's 101 ways to do things, badly, and ultimately you'll regret it. Maybe I'm being an old cynic, but it seems to always turn into a nightmare, the flexibility of a simple HTTP POST seems much better than these inflexible and often impenetrable query languages. They're great for hooking up to datatables though.