GRAPI supports querying multiple M-Files vaults through a single GraphQL endpoint. Your system administrator configures Vault connections and authentication. Contact your administrator for:
- Vault Access: Ensure your user account has appropriate permissions for the vaults you need to query
- JWT Token: Obtain a valid JWT token for API authentication
- Vault Names: Get the list of available vault names configured in the system
Access Points #
- GraphQL Playground – Web-based GraphQL IDE (Nitro) for interactive queries (See Nitro documentation)
<https://your-server/ui>
- GraphQL Endpoint – API endpoint for queries and mutations
<https://your-server/graphql>
Configuration #
Configure via appsettings.json. Fields marked with \* are required.
| Section | Field | Description |
|---|---|---|
| TRAPI | BaseUrl \* |
URL of the TRAPI REST API service |
TimeoutSeconds |
HTTP request timeout (default: 60) | |
| VaultConnections[] | VaultName \* |
Friendly name for GraphQL namespace |
NetworkAddress \* |
M-Files server hostname | |
ConnectionType \* |
Protocol: TCPIP, HTTPS, LPC |
|
AuthType \* |
Authentication: MFiles, Windows |
|
NetworkPort |
Server port (default: 2266) | |
Username \* |
M-Files username | |
Password \* |
M-Files password | |
Domain |
Windows domain (required for Windows auth) | |
Vault \* |
Vault GUID | |
| Authentication | Enabled |
Enable JWT authentication (default: true) |
| Authentication:Jwt | PublicKey \* |
RSA public key in PEM format (required if auth enabled) |
HeaderName |
JWT header name (default: X-API-Key) | |
ExpectedIssuer |
Token issuer for validation | |
ExpectedAudience |
Token audience for validation | |
ValidateLifetime |
Validate token expiration (default: true) | |
ClockSkewMinutes |
Allowed clock skew (default: 5) | |
| GraphQL | EnableIntrospection |
Allow clients to query the schema structure via introspection queries. Disable in production for security (default: false) |
EnableWebTool |
Enable Nitro GraphQL IDE at /ui for interactive query testing (default: false). See Nitro documentation |
|
EnforceCostLimits |
Prevent expensive queries by limiting query complexity and depth. Protects against denial-of-service attacks (default: true) | |
ExecutionTimeoutSeconds |
Maximum time allowed for a single GraphQL query execution before it is cancelled (default: 30 seconds) | |
| Hangfire | SchemaRefreshJobSchedule |
Cron expression for automatic schema refresh job (default: 0 0 * * * = midnight daily). See Cron expressions |
Configuration Example #
"TRAPI": {
"BaseUrl": "[<https://trapi.example.com>]",
"TimeoutSeconds": 60
},
"VaultConnections": [
{
"VaultName": "Vault1",
"NetworkAddress": "your-server",
"ConnectionType": "TCPIP",
"AuthType": "MFiles",
"NetworkPort": "2266",
"Username": "username",
"Password": "password",
"Vault": "{GUID}"
}
],
"Authentication": {
"Enabled": true,
"Jwt": {
"PublicKey": "-----BEGIN RSA PUBLIC KEY-----\\n...\\n-----END RSA PUBLIC KEY-----",
"HeaderName": "X-API-Key",
"ExpectedIssuer": "mfiles-key-generator",
"ExpectedAudience": "mfiles-api-suite",
"ValidateLifetime": "true",
"ClockSkewMinutes": "5"
}
},
"Hangfire": {
"SchemaRefreshJobSchedule": "0 0 * * *"
},
"GraphQL": {
"EnableIntrospection": false,
"EnableWebTool": false,
"EnforceCostLimits": true,
"ExecutionTimeoutSeconds" : 30
}
