Hi Gabriela

There is some documentation on using  GraphQL in Totara here that should be helpful. 

This part may be relevant but don't know if your query is a persisted query

1. AJAX endpoint ([siteurl]/totara/webapi/ajax.php): Endpoint used by the application javascript to access and modify data. Supports both unauthenticated and authenticated access. For authenticated access, authentication is via the normal web session cookie with a 'sesskey' token used to prevent cross-site request forgery (CSRF). The AJAX endpoint only supports persisted queries and mutations (queries defined in files in code not arbitrary queries provided as part of the request*).