AH review comments

Author: dlepow

articles/api-management/graphql-api.md

@@ -6,7 +6,7 @@ ms.service: api-management
 author: dlepow
 ms.author: danlep
 ms.topic: how-to
-ms.date: 02/15/2023
+ms.date: 02/24/2023
 ms.custom: event-tier1-build-2022
 ---
 
@@ -118,6 +118,25 @@ After importing the API, if needed, you can update the settings by using the [Se
 
 [!INCLUDE [api-management-graphql-test.md](../../includes/api-management-graphql-test.md)]
 
+### Test a subscription
+If your GraphQL  API supports a subscription, you can test it in the test console.
+
+1. Ensure that your API allows a WebSocket URL scheme (**WS** or **WSS**) that's appropriate for your API. You can enable this setting on the **Settings** tab.
+1. Set up a subscription query in the query editor, and then select **Connect** to establish a WebSocket connection to the backend service. 
+
+    :::image type="content" source="media/graphql-api/test-graphql-subscription.png" alt-text="Screenshot of a subscription query in the query editor.":::
+1. Review connection details in the **Subscription** pane. 
+
+    :::image type="content" source="media/graphql-api/graphql-websocket-connection.png" alt-text="Screenshot of Websocket connection in the portal.":::
+    
+1. Subscribed events appear in the **Subscription** pane. The WebSocket connection is maintained until you disconnect it or you connect to a new WebSocket subscription.  
+
+    :::image type="content" source="media/graphql-api/graphql-subscription-event.png" alt-text="Screenshot of GraphQL subscription events in the portal.":::
+
+## Secure your GraphQL API
+
+Secure your GraphQL API by applying both existing [access control policies](api-management-policies.md#access-restriction-policies) and a [GraphQL validation policy](validate-graphql-request-policy.md) to secure and protect against GraphQL-specific attacks.
+
 [!INCLUDE [api-management-define-api-topics.md](../../includes/api-management-define-api-topics.md)]
 
 ## Next steps

articles/api-management/graphql-schema-resolve-api.md

@@ -108,6 +108,11 @@ type User {
 
 [!INCLUDE [api-management-graphql-test.md](../../includes/api-management-graphql-test.md)]
 
+## Secure your GraphQL API
+
+Secure your GraphQL API by applying both existing [access control policies](api-management-policies.md#access-restriction-policies) and a [GraphQL validation policy](validate-graphql-request-policy.md) to secure and protect against GraphQL-specific attacks.
+
+
 [!INCLUDE [api-management-define-api-topics.md](../../includes/api-management-define-api-topics.md)]
 
 ## Next steps

includes/media/api-management-graphql-test/graphql-subscription-event.png renamed to articles/api-management/media/graphql-api/graphql-subscription-event.png

@@ -3,9 +3,8 @@ ms.service: api-management
 ms.topic: include
 author: dlepow
 ms.author: danlep
-ms.date: 02/21/2023
+ms.date: 02/24/2023
 ms.custom: 
 ---
 
-In API Management, you can add a GraphQL API in one of two models: pass-through to an existing GraphQL endpoint, or import a GraphQL schema and create a synthetic GraphQL API with custom field resolvers. For more information, see the GraphQL overview.
-<!-- Add link to GraphQL overview when merged -->
+In API Management, you can add a GraphQL API in one of two models: pass-through to an existing GraphQL endpoint, or import a GraphQL schema and create a synthetic GraphQL API with custom field resolvers. For more information, see the [GraphQL overview](../articles/api-management/graphql-apis-overview.md).

includes/media/api-management-graphql-test/graphql-websocket-connection.png renamed to articles/api-management/media/graphql-api/graphql-websocket-connection.png

@@ -3,7 +3,7 @@ ms.service: api-management
 ms.topic: include
 author: dlepow
 ms.author: danlep
-ms.date: 05/10/2022
+ms.date: 02/24/2023
 ms.custom: 
 ---
 
@@ -32,19 +32,4 @@ ms.custom:
     :::image type="content" source="media/api-management-graphql-test/graphql-query-response.png" alt-text="Screenshot of viewing the test query response.":::
 
 1. Repeat preceding steps to test different payloads.
-1. When testing is complete, exit test console.
-
-## Test a subscription
-If your GraphQL schema includes a subscription, you can test it in the test console.
-
-1. Ensure that your API allows a WebSocket URL scheme (**WS** or **WSS**) that's appropriate for your API. You can enable this setting on the **Settings** tab.
-1. Set up a subscription query in the query editor, and then select **Connect** to establish a WebSocket connection to the backend service. 
-
-    :::image type="content" source="media/api-management-graphql-test/test-graphql-subscription.png" alt-text="Screenshot of a subscription query in the query editor.":::
-1. Review connection details in the **Subscription** pane. 
-
-    :::image type="content" source="media/api-management-graphql-test/graphql-websocket-connection.png" alt-text="Screenshot of Websocket connection in the portal.":::
-    
-1. Subscribed events appear in the **Subscription** pane. The WebSocket connection is maintained until you disconnect it or you connect to a new WebSocket subscription.  
-
-    :::image type="content" source="media/api-management-graphql-test/graphql-subscription-event.png" alt-text="Screenshot of GraphQL subscription events in the portal.":::
+1. When testing is complete, exit test console.