Recover a hidden GraphQL schema from field suggestions

With introspection disabled, most engines still return suggestion errors on near-miss field names. Tooling brute forces those to rebuild the schema.

clairvoyance -o schema.json -w wordlist.txt https://target/graphql
graphql-path-enum -i schema.json -t User   # find paths to sensitive types

Confirm suggestions are on before running a long job.

{ __typename user }   # error: Cannot query "user". Did you mean "users"?

Pro note: after rebuilding, prioritize mutations and aliased batch queries the front end never calls, and test field-level authorization: a type guarded in the UI is often exposed through a different query path.