This seems to be a common misconception. GraphQL is just a protocol; query fields don&#x27;t have to be tied to your schema at all, so you don&#x27;t have to expose anything you don&#x27;t want to, in the same way that you don&#x27;t have to make every table accessible via REST.