API Endpoints ​

All endpoints are under /api/v1/. Table routes are at /api/v1/table/{table}/. For JavaScript examples of every operation, see the Frontend Guide. Your running server also has interactive docs at /api/v1/doc/ui (Swagger UI).

Database Level ​

Table CRUD ​

All CRUD endpoints respect row-level security rules defined in your config. See the Config Reference for rule syntax.

INSERT -- POST /table/{t}/insert ​

{
  "values": { "title": "Hello", "body": "World" },
  "returning": "*"
}

Common gotcha: Sending {"title": "x"} without the values wrapper silently fails.

SELECT -- GET/POST /table/{t}/select ​

GET with query params:

/table/{t}/select?where=published == true&order=-created&limit=10&select=id,title

POST with JSON body:

{
  "where": "published == true",
  "order": "-created",
  "limit": 10,
  "select": "id,title"
}

Returns: array of records.

LIST -- GET/POST /table/{t}/list ​

Same parameters as SELECT. Returns { items: [...], total: number }.

VIEW -- GET /table/{t}/view/{id} ​

No body. Returns single record or 404.

Optional query params: select (field filter), where (additional filter).

UPDATE -- POST /table/{t}/update ​

{
  "where": "author_id == 'abc123'",
  "setValues": { "published": true },
  "returning": "*"
}

EDIT -- POST /table/{t}/edit/{id} ​

{ "title": "Updated Title" }

Body is bare fields -- NOT wrapped in setValues. The endpoint wraps it internally.

DELETE -- POST /table/{t}/delete ​

{
  "where": "id == 'abc123'",
  "returning": "*"
}

Authentication ​

Available when a table has the auth extension. See the Frontend Guide for complete auth flow examples and the OAuth Guide for provider setup.

Sign Up -- POST /table/{t}/auth/sign-up ​

{
  "username": "testuser",
  "email": "test@example.com",
  "password": "mypassword",
  "name": "Test User"
}

Body is bare fields matching the auth table schema. Returns { token, refresh_token, record }.

Login -- POST /table/{t}/auth/login-password ​

{
  "identity": "test@example.com",
  "password": "mypassword"
}

The identity field accepts email or username. Returns { token, refresh_token, record }.

Other Auth Endpoints ​

Authenticated Requests ​

Add Authorization: Bearer <token> header to any request that needs auth context (for rules like auth.uid == id).