There are two ways to disable mutations in the GraphQL schema, depending if it must be done for all endpoints or just for some specific one(s).
1. Disabling mutations for all endpoints permalink
(This can be done in the standard plugin, no need for extensions.)
Go to the Modules page, and disable the Mutations module (as shown in guide Browsing, enabling and disabling modules). This will then prevent all mutations from all other modules from being registered in first place.
2. Disabling mutations for some specific endpoint permalink
This is accomplished via Access Control, by removing access to the mutation operation. For that, create an Access Control entry containing:
- The private visibility mode
- The "Disable access" rule