GraphQL API
The GraphQL package exposes staff data, staff groups, assigned customers and staff authentication to headless storefronts and integrations.
composer require mageb2b/staff-graph-ql:*
php bin/magento setup:upgrade
php bin/magento cache:flush
The package requires the Staff base extension (mageb2b/staff). This is a technical integration interface; plan it with the developer or agency that maintains the storefront.
Queries
| Query | Returns | Authorization |
|---|---|---|
staff |
A filtered list of staff records | Admin or integration token only |
staffById(id: Int!) |
One staff record | Admin/integration, or the Staff account itself |
staffGroups |
A filtered list of staff groups | Staff, admin or integration token |
staffGroupById(id: Int!) |
One staff group | Staff, admin or integration token |
staffMyCustomers |
The customers assigned to the authenticated staff account | Staff token only — admin/integration calls are rejected |
staffCustomersByStaffId |
The customers assigned to a given staff record | Admin/integration, or the Staff account matching staff_id |
Mutations
| Mutation | Purpose | Authorization |
|---|---|---|
generateStaffToken(email, password) |
Sign a staff account in and receive a bearer token | Anonymous (staff credentials) |
revokeStaffToken |
Invalidate the current staff token | Staff token only |
requestStaffPasswordReset(email) |
Send the staff password-reset email | Anonymous |
resetStaffPassword(token, new_password, confirm_password) |
Set a new password with the emailed token | Anonymous (e-mailed reset token) |
createStaffCustomerToken(customer_id) |
Create a customer token for impersonating an assigned customer | Staff, admin or integration |
Staff identity data includes name, email, phone, status, website, customer access and creation/edit permissions. Customer impersonation through createStaffCustomerToken follows the same assignment rules as the storefront My Customers area — it does not bypass customer assignment.
Tokens issued by generateStaffToken authenticate as the Staff user type, not as an admin or integration. Since version 1.1.0 of the package, staff directory queries (staff, and staffById for other accounts) reject that token type — use an admin or integration token for directory reads.
Test sign-in, token expiry and customer authorization in staging before exposing the schema to a production storefront. Inspect the installed schema with an introspection query if your version differs.