Any opening curly bracket in a GraphQL query marks the start of a new nesting level of the query. The depth of a query is then simply the deepest nested level. By limiting the depth of a query to a certain value, the size of the data is limited correspondingly. Furthermore, indefinite querying of circularly linked content is prevented. As the depth is calculated before actually invoking the query, the counter measure is quite efficient.

The depth limit is enabled by setting the configuration property caas.graphql.max-query-depth to a value greater than 0. The default depth limit is 30.