Is JSON:API enough for headless MLM, or do I need GraphQL?

JSON:API (core in Drupal 10) is sufficient for headless content delivery and is the right default for Pattern C. For complex queries against MLM data (deep genealogy traversal, commission aggregations across cycles, multi-distributor reports), don't try to expose them through Drupal at all; hit the SaaS MLM platform's API directly from the front-end for MLM-domain queries. Drupal handles content; the SaaS handles MLM data; the front-end consumes from both. GraphQL on Drupal is a separate decision based on whether your front-end team prefers it, and not driven by the MLM architecture.