GraphOS Agent ServicesPreview
Overview
Guides
Connect ServicesClassify Fields using TagsConfigure Access RulesCommon Rule ScenariosManage Access RequestsAudit Agent Activity
Products
Apollo GraphOS PlatformManage, observe, and scale your graph.GraphOS Agent ServicesPreviewGovern how agents access your graph.Apollo ConnectorsConnect REST APIs to your graph declaratively.Apollo FederationFederate multiple subgraphs into a single supergraph.Rover CLIInteract with your graph from the command line.Apollo RouterRun and configure your graph gateway.Apollo OperatorDeploy and manage Apollo Router on Kubernetes.
Open source
Apollo Client (Web)Simplify GraphQL data management in web apps.Apollo iOSSwift-first GraphQL client for iOS.Apollo KotlinKotlin-first GraphQL client for Android and JVM.Apollo ServerBuild GraphQL servers with Node.js.Apollo MCP ServerExpose GraphQL tools to AI agents with MCP.IDE SupportEnhance your development workflow with IDE support.GraphOS Router Support ToolDiagnose and troubleshoot your GraphOS Router.
Resources

Connect Services

Connect a service for agents to access

Preview Feature
PREVIEW
GraphOS Agent Services is in private preview. You need an Apollo team member to help you onboard. Use this documentation for reference only.
note
To connect a service, you need an Org Admin role.

GraphOS Agent Services provides a catalog of services for agents to access. For each service, you can tag fields and create rules to control access.

note
To request more services to be added to the catalog, reach out to your Apollo contact.

Choose a service

  1. In GraphOS Agent Services, open Services and select Add service.

  2. Search by name or description. Filter to Disconnected to hide services this graph already has.

  3. Select the service.

Configure the service

Configure opens with the service's defaults filled in. Keep the defaults unless your Apollo contact gives you different values.

  1. In Name, keep the prefilled identifier. Use lowercase letters, numbers, and hyphens. The name must be unique in your account.

  2. In Base URL, keep the service's root. The base URL must be HTTPS.

  3. In Default rule effect, choose either:

    • Deny by default: all fields are denied to everyone, unless a rule is created to allow access.

    • Allow by default: all fields are allowed to everyone, unless a rule is created to deny access.

  4. Under Authentication, keep the environment variable name for the API key. If the service requires authentication, you set that variable in the runtime environment later.

  5. Leave Per-user OAuth off. Turn Per-user OAuth on only when each person is required to connect with their own account.

  6. Select Continue.

Add tags

In this step, you manage tags for the service's fields. All services in the service catalog include default tags.

For more information on how to add tags to fields, go to Classify Fields using Tags.

When the service's default tags are enough for now, select Skip. Otherwise, select Continue.

Create rules

In this step, you create rules to control access to tagged fields in the service.

For each tag in the service, you can choose to deny, mask, or allow access to the tagged fields.

  • Deny: fields with the tag are denied to everyone until another rule allows those fields.

    • You can also choose to hide the field from the response (Hidden), return an error (Error), or allow the client to request access (Requestable).

  • Mask: fields with the tag stay masked until another rule says otherwise.

  • Allow: fields with the tag stay visible unless another rule overrides the allow.

Select Skip to write the rules later. Otherwise, select Add rules to save your rules. You can edit or add more rules later.

Review and connect

The last step lets you review the service's configuration. Select Apply and finish to finish connecting the service.

Edit a service's configuration

  1. Open the service and select the Settings tab.

  2. You can change the service's base URL and Authentication settings from here.