REST from your database's catalog
restloom reads the tables you point it at and serves them as a REST API. Clients choose columns, filter, sort, page and pull in related rows from the query string, in requests you can type into curl. The database builds the JSON; your backend keeps the business logic.
PostgreSQL, MySQL, SQL Server, SQLite - Fastify, Express or plain Node - Apache-2.0
Type a request.
Edit the request or pick an example. It runs here, in your browser, on a small to-do database.
restloom checks every name in the request against the tables, columns and relations it read from your database, and refuses one it does not know before writing any SQL. Your authorize hook then decides whether this caller may ask. The dialect turns the request into SQL for your database, which sends the rows back already shaped as JSON.
The examples on this site use a small to-do app. restloom found each of its relations by reading the foreign keys; nothing below was declared by hand.
select=id,owner(name)A todo's owner_id points to a user, so each todo has an owner. It comes back as an object, or null when there is none.
select=id,steps(title)&order=steps.count.descThe steps point to their todo, so each todo has a list of steps. It comes back as an array you can filter, sort, page and count.
select=id,tags(name)&tags.name=in.(work,home)todo_tags pairs todos with tags. restloom walks through it for you, so you ask for a todo's tags directly.
Not GraphQL and not an ORM: plain REST over the schema you already have, with the business logic left where it belongs, in your code.
Tables, views, keys and relations are read from your database. You can still rename a relation, hide a column, or add a relation the database does not declare.
Learn moreA column whose name looks sensitive (password, token, secret, api_key) is never served unless you list it.
Learn moreFilters, sorts, pages and embeds are query parameters. A quoted name is always a column, so a column called limit still works.
Learn moreAn authorize hook decides who may ask. Another sets the session your row security policies read, and a third keeps every query inside a tenant.
Learn morePostgres, MySQL, SQL Server and SQLite pass the same conformance suite, built from the examples in these docs.
Learn moreNothing can be written until you allow it, resource by resource and column by column. A database function is callable only once you declare it.
Learn more