Embedded GraphQL explorers
Looks like GraphiQL is the only viable option after all. The embedded Apollo Explorer renders an iframe to their web app (see docs), which is not something we want. All other alternatives don't seem worth considering.

Third party GraphQL client webapps
Apollo Sandbox seems to be the most polished one that supports all the features that we want:

• query editor with auto-completion
• schema / docs explorer
• sharing queries via URL e.g. https://studio.apollographql.com/sandbox/explorer?endpoint=https%3A%2F%2Fd19297906d.catalyst.wmcloud.org%2Fwiki%2FSpecial%3AWikibaseGraphQL&explorerURLState=N4IgJg9gxgrgtgUwHYBcQC4TADpIAR4CWKCcAFIWOntiAIoCMtAlHjvgXgDYCGARgi5leSAOYweohAGEIYBNVrIWuAgF9cakGqA

https://web.altairgraphql.dev/ looks nice too, but doesn't support sharing queries via URL.

Embedding on a special page vs a separate GraphiQL page vs third party site
Embedding GraphiQL on a special page:

• that's what we did for the prototype feedback: https://99f00a63c6.catalyst.wmcloud.org/wiki/Special:WikibaseGraphQLSandbox
• very limited horizontal space, especially if users view the wiki with sidebars expanded
• manageable development effort
• requires regular maintenance (updates)

Separate GraphiQL page:

• could be hosted on doc.wikimedia.org like the REST API docs
• similar pros and cons to the "Embedding GraphiQL on a special page" option, without the horizontal space constraints, but with the downside of not being on the wiki itself
• looks like this: https://graphql.org/swapi-graphql/

Third party webapps:

• Apollo Sandbox seems to be the only option
• no development or maintenance effort
• downsides
  • takes users away from the on-wiki docs (opening those "try it out" links in a new tab would help a little)
  • we have no control over the external site. Apollo has a decent reputation now, sending users to a broken page, or one with content we don't want to be associated with would not be great.

I'd prefer sticking to GraphiQL on the special page then, cc: @ECohen_WMDE

To make it absolutely clear, the main reason for choosing that is not the one time error but the fact that it cannot be embedded. I would prefer not sending users to a third party site