The data API

Every table in your instance is served by one generic, role-gated CRUD API — no per-table endpoints to define. The path names the organization, the app and the table:

{DATA_API}/v1/<org>/<app>/<table>

DATA_API is your instance's data endpoint (http://localhost:6081 in local development). All requests carry a Bearer token issued by your instance's realm; everything executes in the database as the caller's role, so grants and row-level security apply exactly as configured.

Read

# List rows (filter, sort, paginate)
curl -H "Authorization: Bearer $TOKEN" \
  "$DATA_API/v1/acme/core/task?done=false&order=created_at.desc&limit=20&offset=0"

# One row by id
curl -H "Authorization: Bearer $TOKEN" \
  "$DATA_API/v1/acme/core/task/9f8e7d6c-…"

Write

# Create
curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"title": "Ship the docs", "done": false}' \
  "$DATA_API/v1/acme/core/task"

# Update (partial)
curl -X PATCH -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"done": true}' \
  "$DATA_API/v1/acme/core/task/9f8e7d6c-…"

# Upsert
curl -X PUT -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"id": "9f8e7d6c-…", "title": "Ship the docs", "done": true}' \
  "$DATA_API/v1/acme/core/task"

# Delete
curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  "$DATA_API/v1/acme/core/task/9f8e7d6c-…"

From JavaScript

const base = `${DATA_API}/v1/acme/core/task`;
const headers = {
  Authorization: `Bearer ${token}`,
  "Content-Type": "application/json",
};

// list
const tasks = await fetch(`${base}?done=false&limit=20`, { headers })
  .then((r) => r.json());

// create
await fetch(base, {
  method: "POST",
  headers,
  body: JSON.stringify({ title: "Ship the docs" }),
});

Gated RPC

Database functions are callable through the same port, gated by app-namespace USAGE and function EXECUTE checks:

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"p_realm": "nexp_acme"}' \
  "$DATA_API/v1/acme/rpc/core/iam_list_users"

Permission checks

Before rendering UI you can ask what the caller may do:

GET  /v1/<org>/permissions/entities?…    # table-level create/read/write/delete
GET  /v1/<org>/permissions/functions?…   # EXECUTE on functions
POST /v1/<org>/permissions/rows          # row-level (RLS) checks for specific ids