code: function buildRoutes(app, api, graphqlEndpoint) {
    return function (done) {
      api.forEachOperation(function (path, method, operation) {
        buildRoute(app, path, method, operation, graphqlEndpoint);
      });
      done(null, api);
    }
  }
docs: TODO validation of graphql queries Protection from malicious actors putting apiql description with changes