Reference: recognized methods and parameters

The builder recognizes certain method names on command and attribute classes, and certain specially named parameters that it injects at runtime. These conventions are identical for core and plugins.

Methods on command classes (queries/mutations)

Method	Signature	Notes
execute	execute( ...args ): <return type>	Required. Parameters become GraphQL arguments; the return type becomes the GraphQL return type (use #[ReturnType] for interface returns).
authorize	authorize( ...args ): bool	Optional. Custom authorization for the operation; return false to deny. Compose with attributes via $_preauthorized.

Methods on attribute classes

Method	Signature	Makes the attribute…
authorize	authorize( <PrincipalType> $principal, ... ): bool	an authorization attribute.
get_name / get_value	get_name(): string / get_value(): bool|int|float|string|null	(on Metadata subclasses) expose the metadata entry.
transform_description	transform_description( string $description ): string	a description-mirroring metadata attribute.
shows_in_metadata_query	shows_in_metadata_query(): bool	able to opt its target out of _apiMetadata (when it returns false).

Methods on custom scalar classes

Method	Signature	Purpose
serialize	static serialize( mixed $value ): string	PHP value → transport string.
parse	static parse( string $value ): mixed	Client string → PHP value; throw \InvalidArgumentException on bad input.

Recognized parameters

These are optional, underscore-prefixed parameters detected by name. They may appear in any order; declare only the ones you use. The underscore prefix also keeps them out of the GraphQL argument list. (provided_fields on input types uses the same underscore-invisibility idea for an internal property.)

Parameter	Type	Available on	Value
$_principal	the registered principal type	execute(), authorize()	The resolved principal for the request.
$_preauthorized	bool	authorize() (command)	Whether the attribute-based gates already grant access — compose your custom check on top.
$_query_info	?array	execute()	The selection tree of the current query, for resolve-time optimization. Provided via QueryInfoExtractor.
$_metadata	array	authorize() (attribute)	#[Metadata] entries at the call site, in slices ['query'], ['type'], ['field'] (each array<string, scalar>). At the operation level only ['query'] is populated.
$_args	array	authorize() (attribute)	The GraphQL arguments at the call site.
$_parent	mixed	authorize() (attribute)	The enclosing object being resolved, for output-field gates (enables owner-or-scope checks).

For how these combine in granular authorization, see Authentication and authorization.

Public PHP-side helpers

Call	Purpose
ResolverHelpers::compute_preauthorized( string $command_fqcn, object $principal ): bool	Ask whether attribute gates would grant access, without executing the command.
GraphQLControllerBase::get_schema(): SchemaHandle	Obtain the schema handle for PHP-side metadata inspection.
SchemaHandle::get_all_metadata() / find_metadata( ?name, ?type, ?field )	Read collected metadata. See Metadata and discovery.