Checklist

• Not done: Introspection disabled (production): supergraph.introspection: false
• Not done: Sandbox disabled (production): sandbox.enabled: false
• Not done: Homepage disabled (production): homepage.enabled: false
• Not done: Subgraph errors hidden (production): include_subgraph_errors.all: false
• Not done: No wildcard CORS (production): explicit origins only (no "*" and no allow_any_origin: true)
• Not done: Authentication required (if applicable): authorization.require_authentication: true
• Not done: Declarative authorization not silently disabled (if using @authenticated/@requiresScopes/@policy): authorization.directives.enabled is absent or true, router is GraphOS-connected, and a claims source (JWT auth or coprocessor) is configured
• Not done: @policy evaluator wired (if @policy used): a Rhai script or coprocessor evaluates apollo::authorization::required_policies at the Supergraph stage
• Not done: Safelisting vs APQ not confused: if the goal is an operation allowlist, persisted_queries.safelist.enabled: true is set (NOT just apq)
• Not done: APQ disabled when safelisting (if persisted_queries.safelist.enabled: true): apq.enabled: false (mutually exclusive)
• Not done: Persisted queries use GA key: persisted_queries (not preview_persisted_queries)

Version Correctness

• Not done: CORS schema matches version:
  • v1: flat cors.origins: [...]
  • v2: cors.policies: [{ origins: [...] }]
• Not done: JWT issuer field matches version:
  • v1: issuer: <string> (singular)
  • v2: issuers: [<string>] (plural array)
• Not done: Max age format matches version:
  • v1: duration string (max_age: 24h)
  • v2: duration string (max_age: 24h)
• Not done: Limits key is correct: Use limits (v1.17+ and v2), not preview_operation_limits
• Not done: Connectors key is correct (if applicable): early v2 preview = preview_connectors, current v2 GA = connectors

Operational

• Not done: Health check enabled: health_check.enabled: true with a listen address
• Not done: Rate limiting on router:: traffic_shaping.router.global_rate_limit limits client requests; all: limits subgraph requests
• Not done: All env vars documented: Every ${env.VAR} in the config has a corresponding entry in deployment docs
• Not done: APOLLO_KEY not hardcoded: API key is via environment variable, never in config file or logs
• Not done: Secrets use env var expansion: ${env.JWKS_URL}, ${env.JWT_ISSUER}, etc.
• Not done: Config is version-controlled: router.yaml is committed to git (safe to share — no secrets) and changes go through review
• Not done: CI validates config: router config validate router.yaml runs on every PR, pinned to the deployed Router version

Telemetry

• Not done: Logging format is JSON (production): telemetry.exporters.logging.stdout.format: json
• Not done: Tracing sampler is set: sampler: 0.1 (10%) is a reasonable default; tune for your traffic volume
• Not done: Service name is set: common.service_name identifies this router instance

Response Caching (if enabled)

Security

• Not done: User-specific fields identified: Confirmed with the user which fields return per-user data
• Not done: Private scope set: User-specific subgraph responses include Cache-Control: private (via @cacheControl(scope: PRIVATE) in Apollo Server, or by setting the header directly in other frameworks)
• Not done: private_id configured: Every subgraph serving private-scoped data has private_id set
• Not done: User identifier extracted: Rhai script or coprocessor populates the private_id context key from auth token
• Not done: No unprotected user data: Verified that no user-specific response is cached without Cache-Control: private
• Not done: Debug mode disabled (production): response_cache.debug is absent or false
• Not done: Invalidation endpoint not publicly exposed (production): bind to 127.0.0.1, not 0.0.0.0
• Not done: Invalidation shared key uses env var: ${env.INVALIDATION_SHARED_KEY}

Operational

• Not done: Redis URL uses env var: ${env.CACHE_REDIS_URL}, not hardcoded
• Not done: TTL is set: explicit ttl on subgraph.all or per-subgraph
• Not done: Redis credentials use env vars: No hardcoded passwords or usernames

Recommended Final Step

If migrating from v1 to v2, use the built-in upgrade tool: