Once your api query parameters reach a certain level of complexity, like such nested lookups, one should just consider giving direct proxied read access to the

Once your api query parameters reach a certain level of complexity, like such nested lookups, one should just consider giving direct proxied read access to the DB for clients that need it. Why reinvent your own query language. I Don’t know enough about graphql to compare it. Databases have access controls also.