Schema Discovery

VIDEO WALKTHROUGH

Schema Discovery: setup guide

2:19

Recorded on version 1.0.2 · Narrated walkthrough · English captions

Jump to a chapter 7 chapters

1. 0:00Set up Schema Discovery
2. 0:17Open Schema Explorer
3. 0:36Refresh after schema changes
4. 0:56Control anonymous discovery
5. 1:18Set and protect the sync token
6. 1:37Verify the intended integration
7. 2:00Your setup checklist

Read the full video transcript

Schema Discovery 1.0.2 — Magento Admin setup

00:00:00 — Set up Schema Discovery
Welcome to the Agentic Ecom Schema Discovery guide. We'll use Magento Admin to review the setup and explain the handoff to your headless storefront. This walkthrough covers stable version 1 point 0 point 2 and assumes the extension is installed.

00:00:17 — Open Schema Explorer
Open Agentic Ecom, Sync Data, Schema Explorer. The viewer lists the queries and mutations available in your Magento Graph Q L schema. This is an integration reference for your frontend developer; it does not grant a caller permission to execute protected operations.

00:00:36 — Refresh after schema changes
Use Refresh Schema after installing extensions or making changes that add Graph Q L fields. Review the query and mutation lists, and use Download JSON when your developer needs the discovered schema. The refresh button belongs to Magento; Astro Admin has its own schema refresh step.

00:00:56 — Control anonymous discovery
Open Stores, Configuration, Schema Explorer, General. Review Allow Anonymous Schema Discovery. Keep anonymous discovery disabled unless your integration explicitly requires it and you have reviewed the exposure. It controls discovery of the schema, rather than normal authorisation of Magento data.

00:01:18 — Set and protect the sync token
Schema Sync Token is for the integration that retrieves schema discovery data. Keep it private and configure the corresponding storefront connection through your deployment's secret handling. After saving, refresh Schema Discovery in Astro Admin and confirm the expected fields are available to the editor.

00:01:37 — Verify the intended integration
Check that a permitted schema-sync request works and that an unauthorised request is denied according to your settings. Then test the actual data query with the correct store and customer context. Discovering a mutation is different from being authorised to run it. No secret or external request is executed in this demonstration.

00:02:00 — Your setup checklist
Your next steps are to refresh the magento schema view, review discovery permissions and token, refresh astro schema and test access. Use a staging store for the end-to-end check. The complete installation and integration reference is at user guides dot Agentic Ecom dot net.

Download videoEnglish captionsDownload transcript

A headless storefront has to know what its Magento backend can actually do — which extensions are installed, what queries and mutations they add. Schema Discovery answers that programmatically: it scans enabled modules’ GraphQL schemas and returns a structured manifest of queries and mutations (with their arguments, return types and source module), as a GraphQL query or a downloadable JSON — so your Astro frontend can adapt to what’s enabled instead of hard-coding assumptions.

Install

Install Schema Discovery with Composer using your AgenticEcom licence key (find it on your My Licences page — one key unlocks every module you own):

# 1. Register the AgenticEcom repository (once per store)
composer config repositories.agenticecom composer https://repo.agenticecom.net
composer config --global --auth http-basic.repo.agenticecom.net <YOUR-LICENCE-KEY> x

# 2. Require this module
composer require agenticecom/module-schema-discovery

# 3. Apply it
php bin/magento setup:upgrade && php bin/magento setup:di:compile && php bin/magento cache:flush

Have the whole platform?

Install every module in one command with composer require agenticecom/suite — see Install the complete suite.

Compatibility

Magento

Check the exact release against your Magento Open Source version.

PHP

Check the exact package requirements and test your PHP version.

Coverage

Native Magento and enabled extensions with GraphQL schema files.

Output

GraphQL manifest + downloadable JSON.

What it reports

For every Query and Mutation field on the instance, the manifest lists its name, return type, arguments (with required-ness), description and source module — and separates extension-provided operations from native Magento ones, with counts of each.

It reads schema, not data

Discovery scans the GraphQL SDL (.graphqls) files that enabled modules ship — it reports the API surface, never your catalogue data, configuration values or database structure.

Secure by default

This is the module’s most important property. Enumerating your whole API surface is useful reconnaissance for an attacker, so access is locked down:

Admin by default

The schemaDiscovery query requires an authenticated admin context. Anonymous access is OFF out of the box.

Optional shared token

For a headless build to pull the schema without a login, set a Schema Sync Token (≥32 chars) and pass it in the X-AgenticEcom-Schema-Token request header (or the legacy token GraphQL argument). Newly saved tokens are encrypted in Magento configuration and compared in constant time. No token, no schema.

Explicit opt-in only

Fully anonymous access exists only if an operator deliberately switches it on in configuration — it is never the default.

Admin download

The Download JSON action is permission-gated, so an operator can always grab the manifest offline even with the public query disabled.

How to use it

Admin

Open AgenticEcom → Sync Data → Schema Explorer to see the live counts and a searchable table of every query and mutation, then Download JSON for your build pipeline. (The admin menu entry is labelled Schema Explorer.)

GraphQL (token)

{
  schemaDiscovery(token: "your-32+char-sync-token") {
    total_query_count total_mutation_count
    queries { name type module args { name type required } }
    mutations { name type module }
  }
}

Returns extension operations first, with native counts alongside.

FAQ

Is my schema exposed to the public?

No — schemaDiscovery requires an admin context by default. A headless frontend can authenticate with a shared sync token (32+ characters, constant-time compared), and fully anonymous access only exists if you explicitly enable it. The secure default is admin-only.

Does it expose my data or database structure?

No — it reads the GraphQL schema definition files modules ship and reports the query/mutation API surface only. No catalogue data, config values or DB schema are ever included.

Why would a headless storefront need this?

So it can adapt to whatever’s installed — discover that BlogPro adds blogPosts, or that a feed module adds its mutations — and enable the matching frontend features automatically, instead of hard-coding which extensions exist.

How does it handle Magento’s tricky core schema files?

It extracts fields directly from the SDL with a brace-tracking parser rather than a strict GraphQL parser, so the dozen core files that use placeholder types or cross-file references don’t break discovery. Check exact-release compatibility before deployment.