GraphQL: Field "user" of type "User" must have a selection of subfields

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Wrong: asks for an object with no fields
# query { user(id: 1) }

# Right: name the fields you want back
# query { user(id: 1) { id name email } }

# Check whether the field is an object or a scalar in the schema
curl -s -H 'Content-Type: application/json' https://api.example.com/graphql \
  -d '{"query":"{ __type(name: \"Query\") { fields { name type { kind name ofType { kind name } } } } }"}' \
  | jq '.data.__type.fields[] | select(.name=="user")'

# Validate client operations against the schema before shipping
npx graphql-codegen --config codegen.ts

How to diagnose GraphQL errors

GraphQL returns HTTP 200 with an errors array far more often than it returns a non-2xx status, so clients that only check the status code silently ignore failures. Errors split into validation (the query does not match the schema, always fixable from the schema), authorisation (per-field resolvers rejecting), and performance guards (depth and complexity limits) which exist to protect the server from expensive queries.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Always inspect the errors array, not just the HTTP status. Each entry carries a path that points at the exact field that failed.
2. Validate the query against the schema locally before sending it. GraphQL IDEs and graphql-codegen catch every validation error at build time.
3. For N+1 problems, enable resolver tracing or SQL logging and count queries per request. A DataLoader that batches by key is the standard fix.
4. When you hit a depth or complexity limit, restructure the query rather than raising the limit. The limit is usually protecting the database from an unbounded traversal.
5. Check whether the error is from the gateway or the subgraph in a federated setup; the two have separate schemas and separate authorisation.

Tools worth reaching for

• GraphiQL / Apollo Sandbox
• graphql-codegen
• Apollo tracing
• DataLoader

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 spec.graphql.org 📖 graphql.org

Related GraphQL errors

• Apollo Client: Could not find "client" in the context or passed in as an optionA useQuery or useMutation hook ran outside an ApolloProvider. When the provider clearly wraps…
• Apollo Client: Missing field 'x' while writing result to the cacheThe normalised cache stores objects by id and typename, and the response left out a field the…
• Apollo Server: POST body missing, invalid Content-TypeApollo Server 4 does not parse request bodies itself, so the Express integration needs…
• GraphQL: Abstract type "SearchResult" must resolve to an Object type at runtimeA field returns a union or interface, and the server could not work out which concrete type a…
• GraphQL: Cannot query field "email" on type "User"The server's schema has no field by that name on that type, so the query fails validation…
• GraphQL: Cannot return null for non-nullable fieldA resolver returned null where the schema promised a value. GraphQL then propagates the…
• GraphQL: Cannot spread fragment within itselfA fragment references itself directly or indirectly, creating a circular reference. GraphQL…
• GraphQL: Cannot use GraphQLSchema from another module or realmTwo copies of the graphql package are installed, so the schema was built with one and…

See all 19 GraphQL errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.