Application programming interface (API) management is provided. The API management comprises defining a number of GraphQL policies and integrating the GraphQL policies into an API assembly, wherein the GraphQL policies number among other API policies at an API gateway. When a query is received from a client, the GraphQL policies are enforced on the query at the API gateway, and the query is modified if it does not comply with the GraphQL policies. The query is then sent to a GraphQL backend server. A response to the query is received from the GraphQL backend server, and the GraphQL policies are enforced on the response at the API gateway, and the response is modified if it does not comply with the GraphQL policies. The response is then sent to the client.