The graphQL of Catalog can be accessed without any security. It should be added sessionID in the header.