Federate data, auth, and telemetry with runtime PII masking, DSAR, and policy-aware AI prompts. Turn REST → GraphQL instantly and compose Apollo subgraphs—no rewrites, no data copies. Decisions enforced at query time.
query OrdersForAnalyst {
orders {
id
total
department
userEmail # PII
}
}Trace: POST /graphql
↳ call: GET /orders_api/orders
↳ PDP: /pdp/decision.v2
↳ DSAR: /compliance/:tenant/:workspace/dsarYou’ve heard “GraphQL on your database.” You’ve heard “API gateways.” You’ve heard about Apollo Federation. You’ve heard about security. What you haven’t had is all of it—integrated—without duct tape.
Most vendors optimize for neat worlds and end up with a connector zoo. Real life is messier: dozens of REST services, multiple IdPs, regulated data, and AI projects that must never bypass policy. The main challenge isn’t “give devs GraphQL over tables.” It’s stitching REST-heavy, multi-IdP, policy-constrained estates into a single, zero-trust API fabric.
Federate fast. Turn REST → GraphQL instantly and compose Apollo subgraphs—no rewrites, no data copies. Generate SDL from OpenAPI, pick fields per operation, and publish a single endpoint or subgraphs.
Explore Build →Policy in the path. ABAC via PDP/PEP with field-level masking, multi-IdP (OIDC/SAML), and runtime decisions enforced at resolve time.
Explore Secure →DSAR lifecycle (export/delete), immutable audit stamps, schema & policy versioning, and policy-aware AI prompts so LLMs don’t leak PII.
Explore Govern →End-to-end OpenTelemetry: traces, metrics, logs—with policy decisions embedded in spans for real auditability and fast root cause.
Explore Observe →Reads your OpenAPI, builds a plan, and proposes joins, SDL patches, and GraphQL queries. After helping you model the graph, it can prompt over your live response data — with policy-aware redaction — to summarize, compare, cluster, or explain results. Every suggestion includes a short rationale and a confidence badge so you can accept, tweak, or reject with full context.
Explore AI →See how the control plane, data plane, and federated subgraphs sit between your REST, SOAP, and warehouse backends and your clients. The Architecture view walks through PDP/PEP at runtime, DSAR flows, and how AIGQLUnify wraps legacy services without rewrites or schema breakage.
Explore Architecture →Quick reference for CP/DP base URLs, health checks, and example GraphQL and compliance endpoints.
Open API endpoints →Side-by-side with Apollo, database-centric GraphQL engines (e.g., Hasura), gateways, and Mesh. Understand when to pair vs. replace, and how AIGQLUnify acts as the zero-trust API fabric over them.
Open competitive view →Short answers to common questions on deployment, IdPs, data residency, and how AIGQLUnify fits with your existing gateways.
Read the FAQ →Share your estate shape, constraints, and timelines. We’ll map AIGQLUnify to a concrete rollout plan.
Get in touch →A quick walkthrough of the control plane, data plane, PDP decisions in spans, DSAR flows, and how the AI helpers sit inside the policy path.
If the player ever misbehaves, you can always use the direct link: Open the demo in a new tab →
From pain to proof: five classic failure modes of “glue code.” AIGQLUnify collapses them into a single governed, observable runtime.
Try the curl runbooks.
The control plane ingests OpenAPI, policy, tenants, and DSAR metadata. The data plane runs a federated GraphQL endpoint with OpenTelemetry traces, PDP trimming, and AI-aware helpers wired into the same policy path.
Create tenants and workspaces for each environment or customer. Everything in AIGQLUnify is tagged with those IDs — including DSARs, security events, and traces — so you always know who a call belongs to.
The control plane parses your OpenAPI YAML, discovers paths and JSON fields, suggests cross-service joins, and generates an Apollo-compatible SDL and execution plan. No resolvers to hand-write.
For each resource, the data plane calls your PDP with subject, action, resource, and context. Obligations decide which fields exist in the query plan, which are masked in the result, and whether AI helpers are allowed to run at all.
Create DSAR tickets, export or delete subject data, download JSON artefacts, and stream every action as a structured security event into your SIEM — correlated with OpenTelemetry traces.
Modeling helpers suggest joins, propose SDL patches, and turn natural language into GraphQL.
They only ever see the graph your PDP allows, and they only run when
features.ai = true in the obligations.
Turn REST → GraphQL, enforce policy at query time, and see everything with OpenTelemetry.