api gateway security with graphql sucks because its not compatible since it’s REST based