September 2025 Summaries

Apollo Federation, GraphQL Federation, and Cosmo Connect are three distinct approaches to building a unified API layer, each with its own trade-offs and design principles. Apollo Federation uses GraphQL subgraphs and the _entities field for entity resolution, requiring organizations to adopt GraphQL as their main tech stack. GraphQL Federation, developed under the GraphQL Foundation, maintains a vanilla GraphQL approach with explicit directives like @lookup, focusing on composability, collaboration, evolvability, and explicitness, though it faces challenges in clarity and batching efficiency. Cosmo Connect, offering a newer approach, generates strict gRPC contracts from SDL, eliminating the need for GraphQL subgraph servers while the Cosmo Router handles operational tasks like batching, authentication, and retries. Cosmo Connect is particularly suited for integrating existing APIs into a Supergraph, providing a streamlined, efficient way to manage API infrastructure without the complexities associated with running additional GraphQL servers.

In the context of GraphQL Federation, the @requires directive poses a significant compliance risk by potentially allowing sensitive information to leak between subgraphs, undermining security controls. To address this issue, the @openfed__requireFetchReasons directive has been introduced, enabling subgraph owners to specify an allowlist of subgraphs that can access sensitive fields such as minimumPrice. This measure enhances compliance by making data access explicit and auditable, simplifying the process for organizations subject to strict data governance regulations. Unlike authorization, which controls user-level access, this directive focuses on ensuring that sensitive fields are not exposed across subgraphs without explicit consent, thereby turning compliance challenges into a manageable, declarative issue. This approach not only streamlines compliance audits by defining dependencies and rules directly within the schema but also highlights the importance of understanding service dependencies in microservice architectures.

Cosmo Connect offers a streamlined approach to building federated GraphQL APIs, eliminating the need for backend teams to manage GraphQL servers by providing tools such as Router Plugins and standalone gRPC Services. The Router Plugins are lightweight subgraphs compiled to binaries, managed directly by the Cosmo Router, which simplifies deployment and reduces latency, while gRPC Services are independent processes ideal for teams requiring clear ownership and flexible deployment. The platform allows developers to define schemas, generate gRPC code, and run business logic efficiently, facilitating integration into a federated graph without separate service deployment. Through three tutorials, users can learn to deploy a Router Plugin, create a gRPC service, and explore an advanced demo that combines plugins with standalone GraphQL servers, demonstrating a mixed architecture that can bridge external services without rewriting backends. The tutorials highlight schema-first GraphQL development with automatic protobuf and gRPC code generation, providing strong typing and seamless integration with external APIs, offering different approaches to fit various team needs and scaling requirements.

GraphQL's evolution from a monolithic API model to modern Federation has highlighted the need for a unified API Layer as organizations grow, necessitating a foundational Entity Layer to model domains as entities and enforce graph integrity. This approach reduces the burden on API consumers by centralizing integration and enabling a consistent schema design and governance, thus addressing issues like inconsistent specifications and API sprawl. GraphQL, particularly with its Federation capabilities, allows for efficient data requests and simplifies API consumption by presenting a single monolithic schema. Companies using GraphQL Federation benefit from a centralized platform that supports schema reviews and governance, solving advanced API management challenges. Despite some negative discourse on social media, large enterprises have successfully adopted GraphQL Federation to manage APIs at scale, with the Entity Layer serving as a critical component in unifying APIs across distributed systems.

Acoustic, a marketing and customer engagement platform, transformed its GraphQL gateway by adopting WunderGraph's Cosmo, resulting in significant improvements in efficiency and cost savings. Previously reliant on a complex Rust-based system that involved lengthy build times, schema conflicts, and costly engineering efforts, Acoustic faced challenges with maintaining their system, including the need for custom workarounds and difficulties in rollbacks and schema management. By transitioning to Cosmo, they streamlined their operations with a Go-based router, visual schema tools, and built-in features like rate limiting and endpoint isolation, which eliminated the need for Rust plugins and manual CI rollbacks. This move not only saved Acoustic an estimated $178,000 in engineering costs but also enhanced their developer experience, enabling faster deployment, clearer schema management, and the ability to create customer-specific APIs without affecting public endpoints. The partnership with WunderGraph provided responsive support and contributed to shaping Acoustic's new, more efficient system.