class GraphqlController < ApplicationController

  skip_authorization_check

  def query
    render json: ConsulSchema.execute(
      params[:query],
      variables: params[:variables] || {}
    )
  end
end

class GraphqlController < ApplicationController

  skip_before_action :verify_authenticity_token
  skip_authorization_check

  def query
    render json: ConsulSchema.execute(
      params[:query],
      variables: params[:variables] || {}
    )
  end
end

Disable CSRF protection for GraphQL controller
Disable CSRF protection for GraphQL controller

Related documentation at:
http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtec
tion/ClassMethods.html
