GraphQL Pokémon (Favware) API

Free GraphQL Pokémon API with no key. Ask for exactly the fields you need — stats, types, abilities, learnsets, sprites — in a single query. Tested POST example included.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the GraphQL Pokémon (Favware) API?

Favware's GraphQL Pokémon API is a free, key-free GraphQL endpoint covering every Pokémon through the current generations. You send one query naming exactly the fields you want — species, stats, types, abilities, learnsets, evolutions and sprites — and get back exactly those, with no over-fetching.

The whole argument for this API over a REST equivalent is the round-trip count. A Pokédex entry screen typically needs the species, its types, base stats, abilities, evolution chain and a sprite — six related resources that REST would make six requests, or one enormous fixed payload. Here it is one POST with one query, and the response contains those fields and nothing else. Our tested query asked for four fields and received exactly four.

There is a hard gotcha at the front door. The server enforces CSRF protection by requiring a `Content-Type` header, and a POST without one is rejected with `This operation has been blocked as a potential Cross-Site Request Forgery` — not a GraphQL error, an HTTP-level refusal that looks like the API is broken. Send `Content-Type: application/json` and it works immediately. The other thing to note is that the schema version lives in the path (`/v8`), so a major version bump is a URL change, not a silent breaking deploy.

Quick facts

Base URL: https://graphqlpokemon.favware.tech/v8
Authentication: No key or account. The only header requirement is `Content-Type: application/json`, without which requests are rejected as potential CSRF.
Rate limit: No rate-limit headers are returned. The project asks for fair use and is happy to be self-hosted if you need volume.
Pricing: Free and open source (MIT).
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the GraphQL Pokémon (Favware) API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Query a Pokémon's number, types and base stat total

POST https://graphqlpokemon.favware.tech/v8

curl

curl -X POST 'https://graphqlpokemon.favware.tech/v8' \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ getPokemon(pokemon: dragonite) { num species types { name } baseStatsTotal } }"}'

JavaScript (fetch)

const res = await fetch("https://graphqlpokemon.favware.tech/v8", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"query":"{ getPokemon(pokemon: dragonite) { num species types { name } baseStatsTotal } }"}),
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Content-Type": "application/json",
}

payload = {"query":"{ getPokemon(pokemon: dragonite) { num species types { name } baseStatsTotal } }"}

res = requests.post("https://graphqlpokemon.favware.tech/v8", headers=headers, json=payload, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

{
  "data": {
    "getPokemon": {
      "num": 149,
      "species": "dragonite",
      "types": [
        {
          "name": "Dragon"
        },
        {
          "name": "Flying"
        }
      ],
      "baseStatsTotal": 600
    }
  }
}

Parameters

Parameter	Type	Required	Description
`query`	body field	Required	The GraphQL query document. Root fields include `getPokemon`, `getItem`, `getAbility`, `getMove` and their fuzzy variants. `{ getPokemon(pokemon: dragonite) { num species } }`
`variables`	body field	Optional	Variable values when the query is parameterised, as a JSON object. `{"name":"dragonite"}`
`operationName`	body field	Optional	Which operation to run when the document contains several. `PokemonQuery`
`Content-Type`	header	Required	Must be `application/json`. Omitting it triggers the CSRF block, not a parse error. `application/json`

Response fields

dataobject: Standard GraphQL envelope. One key per root field you requested, so `getPokemon` appears only because the query asked for it.
data.getPokemon.numinteger: National Pokédex number. Note that regional forms share a number with their base species.
data.getPokemon.speciesstring: Lowercase species key, which is also the value you pass back in as the `pokemon:` argument.
data.getPokemon.typesarray of objects: Types come back as objects with a `name`, not as bare strings — you must select `{ name }` or the query fails validation.
data.getPokemon.baseStatsTotalinteger: Precomputed stat total, saving you from summing the six individual base stats yourself.
errorsarray: Present instead of, or alongside, `data` when a query fails. GraphQL returns HTTP 200 with an `errors` array, so never branch on status code alone.

What you can build with the GraphQL Pokémon (Favware) API

Build a Pokédex screen that loads in a single request
Fetch type matchups and base stats for a team-builder
Power an autocomplete over species names with fuzzy queries
Pull sprites and artwork URLs alongside data in one call
Teach GraphQL with a public endpoint that needs no signup

Common errors and how to fix them

400 with a CSRF message

The POST arrived without a `Content-Type` header.

Fix: Send `Content-Type: application/json`. This is the single most common failure and it looks nothing like a GraphQL error.

200 with an `errors` array

The query is syntactically valid JSON but invalid GraphQL — usually a scalar field selected as an object or vice versa.

Fix: Read `errors[].message`; it names the field and the expected shape. Remember `types` needs a `{ name }` sub-selection.

404 on the endpoint

You used an older version segment in the path.

Fix: The version is part of the URL. Check the repository's README for the current one before assuming `/v8` is still latest.

GraphQL Pokémon (Favware) API — frequently asked questions

Does the GraphQL Pokémon API need an API key?

No. It is entirely open — no key, no account, no header beyond `Content-Type: application/json`. That last one is mandatory though: without it the request is blocked as potential cross-site request forgery.

How is this different from PokéAPI's GraphQL endpoint?

They are separate projects with separate schemas and datasets. Favware's is purpose-built for GraphQL with fuzzy search resolvers and precomputed fields like `baseStatsTotal`; PokéAPI's GraphQL layer sits over its REST dataset. Pick on schema fit, not on data coverage.

Why do I get a CSRF error from a GraphQL API?

The server requires a `Content-Type` header on every POST as a CSRF countermeasure. Tools that send a bare body without the header — including some quick curl invocations — get refused at the HTTP layer before the query is ever parsed.

Can I self-host this Pokémon API?

Yes. It is open source under MIT, and the maintainers explicitly suggest self-hosting for high-volume use rather than hammering the public endpoint. That also insulates you from version changes in the hosted path.

Tools that pair with this API

GraphQL Formatter

Format or minify GraphQL queries, mutations, fragments and SDL schemas. Preserves block strings and comments, and reports the line of any unbalanced brace.

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

cURL to Fetch Converter

Paste a curl command and get a ready-to-use JavaScript fetch() snippet plus an axios version — method, headers, body and auth mapped automatically, all offline.

GraphQL Pokémon (Favware) is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.