Excel files can work surprisingly well in B2B scenarios where there's a high degree of trust. At a retailer I used to work at, we ran an impromptu Christmas gifts team in December each year, where corporate clients could put in a large order of gifts to be sent to their employees. Rather than build a website for it, we just sent them over an Excel file they could fill in with the name and address of each employee, the gift they wanted to receive and a message for the label. They'd send the file back to us and we had a process to validate the data and load it into our system. It sounds primitive, but it was much more time- and cost-efficient than faffing around with a custom application that we would only use for one month per year and which the clients probably wouldn't enjoy using anyway.

A malicious user who had the knowledge and ability to craft expensive GraphQL queries could just as easily use that knowledge to tie your REST API in knots by flooding it with fake requests. Some kind of per-user quota system is going to be required either way.

The Cradle adaptation is only an animatic, sadly. Best case scenario is that it generates enough buzz for a Netflix or an Amazon to pick it up for a full series, but then I'd be worried it would get butchered like Rings of Power or Wheel of Time have been.

I've just ordered the first three, thanks.