GraphQL becomes burden when GraphQL can not be support by all clients. Thus a REST API layer is needed and at the end, "we had a REST API that happened to use GraphQL.js internally".

The solution comes to Zod: runtime validation, avoid JSON serialization gotchas and filter extra properties.

Learnings: question established patterns; start with complexity; tools matter but patterns matter more and simplicity always win.

The patterns are indeed underrated.

GraphQL for: diverse client types with vastly different data needs; query flexibility outweighs architectural simplicty.
Zod + REST for: runtime validation, architectural simplicity, prefer REST patterns, building internal APIs with known customers.