Enhance customer experiences with Apollo GraphOS


<p>In today&#8217;s FinTech world, customers have high expectations for their online experiences. However, providing a consistent, frictionless experience for customers across all channels is much easier said than done, especially when integrating various internal and external data sources to develop captivating experiences that enhance customer satisfaction.</p>



<p>Luckily, a supergraph can increase client engineering teams’ development velocity and help them ship new features faster by providing a singular and consistent API that can be used across different platforms. At the same time, backend teams can enjoy the flexibility of independently managing relevant portions of a schema with the safety provided by Apollo GraphOS.</p>



<h2 class="wp-block-heading"><a href="#what-does-a-financial-services-supergraph-look-like" aria-hidden="true" class="aal_anchor" id="what-does-a-financial-services-supergraph-look-like"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>What does a financial services supergraph look like?</h2>



<p>A supergraph-based architecture ultimately exposes a one-stop shop for frontend developers to get the data that they need and rapidly build out new product features as those capabilities are iteratively exposed by backend engineering teams in the supergraph schema:</p>



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="960" height="540" src="https://wp.apollographql.com/wp-content/uploads/2023/03/Design-Slides-for-Diagrams-1.png" alt="" class="wp-image-20399" srcset="https://wp.apollographql.com/wp-content/uploads/2023/03/Design-Slides-for-Diagrams-1.png 960w, https://wp.apollographql.com/wp-content/uploads/2023/03/Design-Slides-for-Diagrams-1-300x169.png 300w, https://wp.apollographql.com/wp-content/uploads/2023/03/Design-Slides-for-Diagrams-1-768x432.png 768w" sizes="auto, (max-width: 960px) 100vw, 960px" /></figure>



<h2 class="wp-block-heading"><a href="#get-started-with-a-financial-services-supergraph-today" aria-hidden="true" class="aal_anchor" id="get-started-with-a-financial-services-supergraph-today"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Get started with a financial services supergraph today</h2>



<p>The best way to see the possibilities of a supergraph is to try one out. <a href="https://studio.apollographql.com/public/apollo-financial-supergraph/explorer?explorerURLState=N4IgzghgbgpgJgYQPYBsUwMYBcCWSB2AknCAFwgwQBmEARgJyYC0ArCwIwZMAs8ET9DDADsTDAyoAmdsIDMcYXAwgANOGjxkaTLgIBRfFgBOAT2JkQtbhgAckmPW5MADHG42eLDPSYQYVKiZZSUlaCAA2WRsbdl4QAF8gA&amp;referrer=operation_collections&amp;variant=prod">You can explore a financial services supergraph schema and run real queries against it here.</a></p>



<p>We also have a series of best practices that dive into different elements of this schema to illustrate how Apollo GraphOS helps power essential features of modern financial service applications:</p>



<ul class="wp-block-list">
<li><a href="https://www.apollographql.com/blog/platform/financial-services/deliver-a-personalized-customer-experience-with-graphql/" data-type="URL">Deliver a personalized customer experience with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/directive-based-authorization-for-financial-services/" data-type="URL">Securing APIs declaratively with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/adopt-a-customer-360-approach-to-prevent-fraud-with-graphql/" data-type="URL">Adopt a Customer 360 approach to prevent fraud with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/ensure-compliant-and-secure-third-party-access-using-graphos/" data-type="URL">Ensure compliant and secure third-party access using GraphOS</a></li>
</ul>



<p>If you’d like to talk to an Apollo expert about how a supergraph can power your financial services, <a href="https://www.apollographql.com/contact-sales/?referrer=finserv-solutions-page" data-type="URL">please reach out to us</a>.</p>


How to power modern financial services apps with Apollo GraphOS


<p>This post is a part of our <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">&#8220;How to power modern financial services apps with Apollo GraphOS&#8221;</a> series. Also in this series:</p>



<ul class="wp-block-list">
<li><a href="https://www.apollographql.com/blog/platform/financial-services/directive-based-authorization-for-financial-services/">Securing APIs declaratively with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/adopt-a-customer-360-approach-to-prevent-fraud-with-graphql/" data-type="URL">Adopt a Customer 360 approach to prevent fraud with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/ensure-compliant-and-secure-third-party-access-using-graphos/" data-type="URL">Ensure compliant and secure third-party access using GraphOS</a></li>
</ul>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p>Modern customers are increasingly knowledgeable about finance—they demand faster and more personalized services that require financial services organizations to reconsider how they leverage data and technology to offer a holistic customer experience across all digital touch points. Unfortunately, many companies and institutions face obstacles to scaling developer velocity due to legacy architecture decisions and inefficient development processes.&nbsp;</p>



<p>A GraphOS-powered supergraph can be used to aggregate customer data from multiple sources to provide a singular, strongly-typed API that can power all client applications that deliver personalized experiences to customers.</p>



<h2 class="wp-block-heading"><a href="#a-unified-interface" aria-hidden="true" class="aal_anchor" id="a-unified-interface"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>A unified interface</h2>



<p>Mobile clients—often developed as follow-ups to the original web offering—may require data that are scattered across a complex array of services. These services may expose their data via rigid APIs that, more often than not, return additional data that the clients do not need. By using GraphQL&#8217;s flexible querying capabilities, teams can easily retrieve and combine customer data from different systems and present it in a way that is tailored to specific users&#8217; needs.&nbsp;</p>



<p>Consider the need to show the user all of their accounts on iOS, Android, and web. One approach would be to call all of the necessary backend services to build the UI:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">GET /api/users?userID=123
GET /api/accounts?userID=123
…</code></pre>



<p>Using this approach, we will likely generate many requests, get data that we did not ask for, and ultimately waste time and compute resources. Another approach could be to introduce facades (also called backends-for-frontends or BFFs) in front of the backend services for each client so that a consolidate call can be made like this:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">GET /api/getUserAccounts?client=iOS&amp;userID=123</code></pre>



<p>But, this too introduces challenges, such as the need to maintain duplicate code between discrete facades.</p>



<p>Let&#8217;s take a look at the GraphQL alternative. The <code>GetAllUserAccounts</code> query retrieves specific user and account data. Behind the scenes, the <code>user</code> and <code>accounts</code> objects live in two subgraphs thus encouraging the design principle of separation of concerns.  </p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">query GetAllUserAccounts {
  user {
    id
    name
    accounts {
      id
      name
    }
  }
}</code></pre>



<p>With GraphQL, developers can use a single query to retrieve only the necessary data for a feature, which can significantly reduce the number of requests required and improve the performance of mobile applications. This can help to ensure that all users, regardless of the device they are using, have a consistent and reliable experience.</p>



<h2 class="wp-block-heading"><a href="#smart-resolvers" aria-hidden="true" class="aal_anchor" id="smart-resolvers"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Smart resolvers</h2>



<p>In order to respond to client requests, GraphQL servers need to retrieve the relevant data. To achieve this, they leverage <a href="https://www.apollographql.com/docs/apollo-server/data/resolvers/">resolvers</a> that are defined for each field in the schema and are executed in a specific order based on the relationships between fields. A resolver can retrieve data from a database, a REST API, or any other data source.&nbsp;</p>



<p>Resolvers can provide personalized results as well. For example, in this <code>user</code> query, the user ID is accessed via a <code>context</code> object that&#8217;s available as a parameter in all field resolver functions. This ID value would have been exposed in an HTTP header and manually applied to the <code>context</code> object when the GraphQL request initially reached the server. In a real production application, this would come from an auth provider and would be extracted from a JWT or a similar mechanism.</p>



<p>The ID value can then be used to retrieve the user from the relevant data source (or throw and error if the ID is invalid) and a client developer can use the data in the GraphQL response to tailor that user&#8217;s experience in a front-end application:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">export const resolvers = {
  Query: {
    user(_, __, context) {
      const userId = context.headers[&quot;x-user-id&quot;];
      const user = getUserById(userId);

      if (!user) {
        throw new GraphQLError(&quot;Could not locate user by id. Please specify a valid `x-user-id` header like `user:1`&quot;);
      }

      return user;
    },
  },
};</code></pre>



<p>GraphQL resolvers provide a flexible and efficient way to retrieve and aggregate customer data from multiple sources—they don’t always have to return the same data and can be customized with additional functionality.</p>



<h2 class="wp-block-heading"><a href="#get-started-with-a-financial-services-supergraph-today" aria-hidden="true" class="aal_anchor" id="get-started-with-a-financial-services-supergraph-today"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Get started with a financial services supergraph today</h2>



<p>Beyond onboarding third-party partners to supergraph, the best way to see the possibilities of a supergraph is to try one out. <a href="https://studio.apollographql.com/public/apollo-financial-supergraph/explorer?explorerURLState=N4IgzghgbgpgJgYQPYBsUwMYBcCWSB2AknCAFwgwQBmEARgJyYC0ArCwIwZMAs8ET9DDADsTDAyoAmdsIDMcYXAwgANOGjxkaTLgIBRfFgBOAT2JkQtbhgAckmPW5MADHG42eLDPSYQYVKiZZSUlaCAA2WRsbdl4QAF8gA&amp;referrer=operation_collections&amp;variant=prod">You can explore a financial services supergraph schema and run real queries against it here.</a></p>



<p>We also have additional posts in this <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">series of financial services best practices</a> that dive into different elements of this schema to illustrate how Apollo GraphOS help power essential features of modern financial applications.</p>



<p>If you’d like to talk to an Apollo expert about how a supergraph can power your financial services experience, <a href="https://www.apollographql.com/contact-sales/?referrer=finserv-solutions-page" data-type="URL">please reach out to us</a>.</p>


Deliver a personalized customer experience with GraphQL


<p>This post is a part of our <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">&#8220;How to power modern financial services apps with Apollo GraphOS&#8221;</a> series. Also in this series:</p>



<ul class="wp-block-list">
<li><a href="https://www.apollographql.com/blog/platform/financial-services/deliver-a-personalized-customer-experience-with-graphql/" data-type="URL">Deliver a personalized customer experience with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/directive-based-authorization-for-financial-services/">Securing APIs declaratively with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/ensure-compliant-and-secure-third-party-access-using-graphos/" data-type="URL">Ensure compliant and secure third-party access using GraphOS</a></li>
</ul>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p>Customers are the cornerstone of any business, but many companies don’t truly know who their customers are. KYC, or Know Your Customer, is an important process for financial institutions and businesses to verify their customers’ identities and assess the associated risk factors. As part of a larger Anti-Money Laundering (AML) program, KYC helps prevent financial crimes.&nbsp;&nbsp;</p>



<p>A single customer view (SCV) provides a complete picture of a customer’s data, including personal and financial information, transaction history, and behavior patterns. SCV can help businesses comply with KYC and AML regulations; however, one of the common challenges associated with implementing SCV is data integration. Aggregating data from multiple sources, such as disparate internal systems and third-party services, can be complex and time-consuming. But GraphQL and Apollo GraphOS can help.</p>



<h2 class="wp-block-heading"><a href="#assigning-a-risk-rating-to-customers" aria-hidden="true" class="aal_anchor" id="assigning-a-risk-rating-to-customers"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Assigning a risk rating to customers</h2>



<p>A financial institution often needs to assess the risk associated with each customer. A KYC risk rating is a calculation based on a number of factors, including the customer’s identity. In an organization, basic customer metadata might be owned by the Identity team, while the ownership of risk assessments might be under the remit of the Compliance team. How do you create a holistic view of a customer?</p>



<p>In a federated graph, an entity is an object type that can resolve its fields across multiple subgraphs. Consider a users subgraph owned by the Identity team that contains the following type definition for <code>User</code>:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql"># Users subgraph

type User @key(fields: “id”) {
  id: ID!
  name: String
}</code></pre>



<p>By setting the <code>id</code> as the key field using the <code>@key</code> directive, we have turned the <code>User</code> object type into an entity so any other subgraph can now add fields to the <code>User</code> type.</p>



<p>We now need to add a <code>riskRating</code> field to the <code>User</code> type. To accommodate this, the Compliance team can create a new subgraph and extend the <code>User</code> like so:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql"># Risk subgraph

type User @key(fields: “id”) {
  id: ID!
  riskRating: Int
}</code></pre>



<p>Once this new subgraph is composed into a GraphOS-powered supergraph, any developer will be able to retrieve the needed customer metadata, including their risk rating. The Compliance team can continue to make improvements to risk assessment without impacting the Identity team or other using the supergraph.</p>



<h2 class="wp-block-heading"><a href="#simplifying-aml-checks" aria-hidden="true" class="aal_anchor" id="simplifying-aml-checks"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Simplifying AML checks</h2>



<p>By creating a unified data experience, financial institutions can simplify execution of AML procedures. To create a comprehensive view of the customer’s financial behavior, data such as transactions, credit reports, and public records must be gathered and examined. This data set can then provide insights into the customer’s spending patterns and financial history. Based on the results, appropriate actions can be taken to mitigate risks.&nbsp;</p>



<p><br>Using GraphQL, we are able to craft a single query that retrieves the needed data from three discrete subgraphs (i.e. users, accounts, transactions). Each subgraph is powered by a <a href="https://www.apollographql.com/docs/federation/building-supergraphs/supported-subgraphs">Federation-compatible</a> GraphQL server which in turn can fetch data from any underlying source, such as a legacy REST API or a database. For example:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">query GetAllUserAccountsTransactions {
  user {
    id
    name
    accounts {
      id
      type
      balance
      transactions {
        id
        description
        amount
      }
    }
  }
}</code></pre>



<p>One of the biggest advantages of GraphQL is that it allows developers to specify exactly the data they need. This means that clients avoid overfetching (receiving more data than they need) and underfetching (not receiving enough data to fulfill their needs). The result is increased developer velocity and improvement of network usage.</p>



<h2 class="wp-block-heading"><a href="#get-started-with-a-financial-services-supergraph-today" aria-hidden="true" class="aal_anchor" id="get-started-with-a-financial-services-supergraph-today"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Get started with a financial services supergraph today</h2>



<p>Beyond onboarding third-party partners to supergraph, the best way to see the possibilities of a supergraph is to try one out. <a href="https://studio.apollographql.com/public/apollo-financial-supergraph/explorer?explorerURLState=N4IgzghgbgpgJgYQPYBsUwMYBcCWSB2AknCAFwgwQBmEARgJyYC0ArCwIwZMAs8ET9DDADsTDAyoAmdsIDMcYXAwgANOGjxkaTLgIBRfFgBOAT2JkQtbhgAckmPW5MADHG42eLDPSYQYVKiZZSUlaCAA2WRsbdl4QAF8gA&amp;referrer=operation_collections&amp;variant=prod">You can explore a financial services supergraph schema and run real queries against it here.</a></p>



<p>We also have additional posts in this <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">series of financial services best practices</a> that dive into different elements of this schema to illustrate how Apollo GraphOS help power essential features of modern financial applications.</p>



<p>If you’d like to talk to an Apollo expert about how a supergraph can power your financial services experience, <a href="https://www.apollographql.com/contact-sales/?referrer=finserv-solutions-page" data-type="URL">please reach out to us</a>.</p>


Adopt a Customer 360 approach to prevent fraud with GraphQL


<p>This post is a part of our <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">&#8220;How to power modern financial services apps with Apollo GraphOS&#8221;</a> series. Also in this series:</p>



<ul class="wp-block-list">
<li><a href="https://www.apollographql.com/blog/platform/financial-services/deliver-a-personalized-customer-experience-with-graphql/" data-type="URL">Deliver a personalized customer experience with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/directive-based-authorization-for-financial-services/" data-type="URL">Securing APIs declaratively with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/adopt-a-customer-360-approach-to-prevent-fraud-with-graphql/" data-type="URL">Adopt a Customer 360 approach to prevent fraud with GraphQL</a></li>
</ul>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p>In recent years, GraphQL has gained popularity as a powerful alternative to REST APIs for building modern web applications. One area where GraphQL shines is in providing compliant and secure third-party access to data.</p>



<p>Financial services companies gather extremely sensitive information from their customers and must comply with data privacy regulations such as the <a href="https://gdpr-info.eu/">General Data Protection Regulation (GDPR)</a>, the <a href="https://oag.ca.gov/privacy/ccpa">California Consumer Privacy Act (CCPA)</a> and other federal and state privacy laws. In addition, they must protect data from unauthorized access and can do so ensuring compliant and secure third-party access with the help of <a href="https://www.apollographql.com/docs/graphos/">Apollo GraphOS</a>.</p>



<h2 class="wp-block-heading"><a href="#compliance" aria-hidden="true" class="aal_anchor" id="compliance"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Compliance</h2>



<p>GraphOS provides out of the box features to help protect against unintended data leaks and can help to narrow the scope of data which can be exposed through the use of schema contracts.</p>



<p><a href="https://www.apollographql.com/docs/graphos/delivery/contracts/" data-type="URL" data-id="https://www.apollographql.com/docs/graphos/delivery/contracts/">Schema contracts</a> allow developers to specify exactly which fields and types within a schema that applications are allowed to access. By using the <code>@tag</code> directive provided by Apollo Federation, developers can expose specific capabilities from the supergraph to individual use cases.</p>



<p>Most often financial companies use contracts to separate functionality between their customer use cases such as web and mobile, internal applications, and external partners.</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">type Account {
  id: ID!
  balance: Int @tag(name: &quot;mobile&quot;)
  transactions: [Transaction] @tag(name: &quot;mobile&quot;) @tag(name: &quot;partners&quot;)
  user: User
}</code></pre>



<p>The flexibility of schema contracts allows for fine-grained control over data exposure, which is crucial for compliance. With GraphOS, a schema can be defined that specifies the exact fields and types of data that can be queried or mutated. This means that third-party applications can only access data that is explicitly allowed by the contract, making it easier to comply with regulations such as GDPR&#8217;s &#8220;data minimization&#8221; principle.</p>



<p>GraphOS further enhances the security which can be applied to a schema with Apollo Studio by enforcing user roles, restricting access to protected variants and limiting the visibility of graphs within the  organization.</p>



<h2 class="wp-block-heading"><a href="#graphos-security" aria-hidden="true" class="aal_anchor" id="graphos-security"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>GraphOS Security</h2>



<p>Security is at the core of GraphOS and leverages built-in enterprise authentication features in Apollo Router and Apollo Studio. </p>



<p>Apollo Router supports multiple identity providers, and JWT (JSON Web Token) verification to ensure that only authenticated clients can access the supergraph. With built-in support for JWT claim extraction which removes the need for subgraphs to be extracting, parsing and validating claims on each subgraph request. </p>



<p>Schema contracts are derived from a source <a href="https://www.apollographql.com/docs/graphos/graphs/overview/#variants">schema variant</a> and enforce inclusion/exclusion policies on the fields and types which are exposed through the contracts. Different authentication configurations can be deployed for each schema contract through its own instance of Apollo Router, which makes GraphOS capable of supporting many different use cases all powered by a single unified schema.</p>



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="960" height="540" src="https://wp.apollographql.com/wp-content/uploads/2023/03/FinancialSupergraphContracts-2.png" alt="" class="wp-image-20448" srcset="https://wp.apollographql.com/wp-content/uploads/2023/03/FinancialSupergraphContracts-2.png 960w, https://wp.apollographql.com/wp-content/uploads/2023/03/FinancialSupergraphContracts-2-300x169.png 300w, https://wp.apollographql.com/wp-content/uploads/2023/03/FinancialSupergraphContracts-2-768x432.png 768w" sizes="auto, (max-width: 960px) 100vw, 960px" /></figure>



<p>Enterprise users of GraphOS can enforce user roles within Apollo Studio both at the organization and graph levels which can be used to restrict write access to different graphs by role. While graph variants can also be protected to ensure only authorized users can make changes to the schema. GraphOS Enterprise also enables additional roles for billing managers, technical document writers, and other members of the organization. These features can be used together to provide multiple security layers to your graph for development, management and operations. </p>



<p>GraphOS provides a secure, compliant solution for financial companies to enable third-party access to customer data while remaining compliant with regulations like GDPR and CCPA. GraphOS Enterprise features provide fine-grained control over data exposure through schema contracts and built-in authentication features to protect sensitive data.</p>



<h2 class="wp-block-heading"><a href="#get-started-with-a-financial-services-supergraph-today" aria-hidden="true" class="aal_anchor" id="get-started-with-a-financial-services-supergraph-today"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Get started with a financial services supergraph today</h2>



<p>Beyond onboarding third-party partners to supergraph, the best way to see the possibilities of a supergraph is to try one out. <a href="https://studio.apollographql.com/public/apollo-financial-supergraph/explorer?explorerURLState=N4IgzghgbgpgJgYQPYBsUwMYBcCWSB2AknCAFwgwQBmEARgJyYC0ArCwIwZMAs8ET9DDADsTDAyoAmdsIDMcYXAwgANOGjxkaTLgIBRfFgBOAT2JkQtbhgAckmPW5MADHG42eLDPSYQYVKiZZSUlaCAA2WRsbdl4QAF8gA&amp;referrer=operation_collections&amp;variant=prod">You can explore a financial services supergraph schema and run real queries against it here.</a></p>



<p>We also have additional posts in this <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">series of financial services best practices</a> that dive into different elements of this schema to illustrate how Apollo GraphOS help power essential features of modern financial applications.</p>



<p>If you’d like to talk to an Apollo expert about how a supergraph can power your financial services experience, <a href="https://www.apollographql.com/contact-sales/?referrer=finserv-solutions-page" data-type="URL">please reach out to us</a>.</p>


Ensure compliant and secure third-party access using GraphOS


<p>This post is a part of our <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">&#8220;How to power modern financial services apps with Apollo GraphOS&#8221;</a> series. Also in this series:</p>



<ul class="wp-block-list">
<li><a href="https://www.apollographql.com/blog/platform/financial-services/deliver-a-personalized-customer-experience-with-graphql/" data-type="URL">Deliver a personalized customer experience with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/adopt-a-customer-360-approach-to-prevent-fraud-with-graphql/" data-type="URL">Adopt a Customer 360 approach to prevent fraud with GraphQL</a></li>



<li><a href="https://www.apollographql.com/blog/platform/financial-services/ensure-compliant-and-secure-third-party-access-using-graphos/" data-type="URL">Ensure compliant and secure third-party access using GraphOS</a></li>
</ul>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
<h2 class="wp-block-heading"><a href="#update-auth-now-available-in-apollo-router" aria-hidden="true" class="aal_anchor" id="update-auth-now-available-in-apollo-router"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Update: Auth now available in Apollo Router</h2>



<p>Apollo has shipped our new authentication and authorization features as built-in Router features. Checkout the launch post: <a href="https://www.apollographql.com/blog/graphql/security/enforcing-graphql-security-best-practices-with-graphos/">https://www.apollographql.com/blog/graphql/security/enforcing-graphql-security-best-practices-with-graphos/</a></p>
</blockquote>



<p>In the financial services industry, securing access to APIs and data is of the utmost importance. These are not just best practices but regulatory standards enforced by governments across the world. GraphQL helps developers create flexible APIs that allow clients to query for exactly what they need, which may lead to the question of whether GraphQL can be just as secure as other API technologies? </p>



<p>The good news is that you can absolutely secure your data using a declarative approach with GraphQL directives. What&#8217;s more, this approach can be self documenting for API clients and run any at scale to serve all types of FinTech customers.</p>



<h2 class="wp-block-heading"><a href="#what-are-directives-in-graphql" aria-hidden="true" class="aal_anchor" id="what-are-directives-in-graphql"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>What are Directives in GraphQL?</h2>



<p><a href="https://www.apollographql.com/docs/apollo-server/schema/directives/" target="_blank" rel="noreferrer noopener">GraphQL schema directives</a> are special annotations that can be added to a GraphQL schema to modify or add additional logic to the runtime behavior. Directives can be used to control things like data retrieval, schema metadata, and even security. For example:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">directive @myDirective(arg1: String = ‘foo’) on FIELD_DEFINITION

type Query {
  hello: String @myDirective
}</code></pre>



<p>By defining <code>@myDirective</code> in the schema with a valid location of <code>FIELD_DEFINITION</code>, this directive can be applied to an object field like the <code>hello</code> field on the root <code>Query</code> type. At runtime, custom logic can be applied to the <code>hello</code> field now to alter its output. And just like field definitions, directives can accept typed arguments with optional defaults (like <code>arg1</code> above) to further alter the runtime output of any field where it&#8217;s applied.</p>



<h2 class="wp-block-heading"><a href="#authentication" aria-hidden="true" class="aal_anchor" id="authentication"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Authentication</h2>



<p>Authentication is the process of verifying that a user is who they claim to be. A schema might have some fields that require authentication and some that do not, so GraphQL directives can be used to enforce authentication for specific fields in the schema. </p>



<p>A common approach to doing this requires the use of a custom type system directive that checks for the presence of a valid token in the request header, typically a <a href="https://jwt.io/">JWT</a>. If a token is present, it can be decoded to determine the user&#8217;s identity, and the request can be processed as normal. If no token is present, the directive can return an error, indicating that an authentication header is required.</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">directive @authenticated repeatable on OBJECT | FIELD_DEFINITION

type Query {
  bankAccounts: BankAccountsResponse @authenticated
}
</code></pre>



<h2 class="wp-block-heading"><a href="#authorization" aria-hidden="true" class="aal_anchor" id="authorization"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Authorization</h2>



<p>Authorization is the process of determining whether a specific user is allowed to access a specific set of data. GraphQL directives can also be used to enforce authorization for specific fields or types in the schema. </p>



<p>Similar to authentication, a custom schema-defined directive can be used to check the user&#8217;s role and permissions from the user token before executing the field resolver. If the current user&#8217;s role matches the one specified in the directive&#8217;s <code>role</code> argument, then the request will be processed normally, otherwise, the directive can throw an error and indicate that the user is not authorized to access the specific field or type. For example:</p>



<pre class="wp-block-prismatic-blocks"><code class="language-graphql">directive @hasRole(role: Role) on FIELD_DEFINITION

enum Role {
  ADMIN
  USER
}

type Query {
  bankAccounts: [BankAccount] @authenticated @hasRole(role: ADMIN)
}</code></pre>



<p>In this example, the <code>@hasRole</code> directive is added to the accounts field and the required role is set to <code>ADMIN</code>. This means that any request to this field must include a valid token in the request header <em>AND</em> the user must have the <code>ADMIN</code> role. If the user is authenticated but their role is less privileged than an <code>ADMIN</code>, then the directive can throw an error.</p>



<p>These directive names are just examples. You can find many other similar implementations or create your own, but if you want to see a working example, check out the Apollo Solutions <a rel="noreferrer noopener" href="https://github.com/apollosolutions/simple-auth-directive" target="_blank">simple-auth-directive GitHub repository</a>.</p>



<h2 class="wp-block-heading"><a href="#benefits-of-a-directive-based-authn-z" aria-hidden="true" class="aal_anchor" id="benefits-of-a-directive-based-authn-z"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Benefits of a Directive-Based AuthN/Z</h2>



<p>By using directives to implement authentication and authorization, the security logic is centralized in the same repeatable directive, making it easier to manage, maintain, and enforce across your entire API surface area. Because the logic is abstracted into reusable directives, there&#8217;s no need to replicate it field-by-field where escalated privileges are required to view the resolved data. Securing your API is as simple as annotating the fields that require AuthN/Z. </p>



<p>Implementing a standard directive library in conjunction with a <a href="https://www.apollographql.com/docs/federation">Federated architecture</a> allows teams to implement the same logic across fields in multiple subgraph services that run behind Apollo Router. This means that bug fixes can be shipped faster when security incidents are identified and new capabilities can be added centrally while allowing subgraph teams to incrementally adopt the new requirements when they are ready. This pattern is also generic enough that you can abstract the validation logic to any existing 3rd-party identity provider (IdP) but keep the schema-based annotations as a common abstraction layer.</p>



<h2 class="wp-block-heading"><a href="#self-documenting-policies" aria-hidden="true" class="aal_anchor" id="self-documenting-policies"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Self-Documenting Policies</h2>



<p>Using a declarative, schema-based authentication flow also facilitates sharing that policy with other teams. Using the <a href="https://www.apollographql.com/docs/federation/federated-types/federated-directives/#composedirective">@composeDirective</a>, we can expose this metadata to our supergraph so it is visible in Apollo Studio and instead of doing an in-depth code audit, you can bring in other internal teams from Security, IT, or DevOps to view the currently defined rules and invite them to review new additions with much less effort. From the client developer&#8217;s perspective, it also empowers them to understand API access requirements as they work with the schema and without relying on additional internal documentation or meetings.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<h2 class="wp-block-heading"><a href="#get-started-with-a-financial-services-supergraph-today" aria-hidden="true" class="aal_anchor" id="get-started-with-a-financial-services-supergraph-today"><svg aria-hidden="true" class="aal_svg" height="16" version="1.1" viewBox="0 0 16 16" width="16"><path fill-rule="evenodd" d="M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"></path></svg></a>Get started with a financial services supergraph today</h2>



<p>Beyond securing your data, the best way to see the possibilities of a supergraph is to try one out. <a href="https://studio.apollographql.com/public/apollo-financial-supergraph/explorer?explorerURLState=N4IgzghgbgpgJgYQPYBsUwMYBcCWSB2AknCAFwgwQBmEARgJyYC0ArCwIwZMAs8ET9DDADsTDAyoAmdsIDMcYXAwgANOGjxkaTLgIBRfFgBOAT2JkQtbhgAckmPW5MADHG42eLDPSYQYVKiZZSUlaCAA2WRsbdl4QAF8gA&amp;referrer=operation_collections&amp;variant=prod">You can explore a financial services supergraph schema and run real queries against it here.</a></p>



<p>We also have additional posts in this <a href="https://www.apollographql.com/blog/platform/financial-services/how-to-power-modern-financial-services-apps-with-apollo-graphos/" data-type="URL">series of financial services best practices</a> that dive into different elements of this schema to illustrate how Apollo GraphOS help power essential features of modern financial applications.</p>



<p>If you’d like to talk to an Apollo expert about how a supergraph can power your financial services experience, <a href="https://www.apollographql.com/contact-sales/?referrer=finserv-solutions-page" data-type="URL">please reach out to us</a>.</p>


GraphOS

How to power modern financial services apps with Apollo GraphOS

Deliver a personalized customer experience with GraphQL

Adopt a Customer 360 approach to prevent fraud with GraphQL

Ensure compliant and secure third-party access using GraphOS

Securing APIs declaratively with GraphQL

Stay in our orbit