Data API
Define an entity in your manifest, deploy, and get a full REST API instantly. No controllers, no SQL, no boilerplate.
Every entity also gets auto-generated MCP tools, so AI Agents and external AI tools can read and write to the same data.
REST Endpoints
Base URL: /api/v1/apps/{appId}/collections/{entity}
| Method | Path | Description |
|---|---|---|
| GET | / |
List records. |
| POST | / |
Create a record. |
| GET | /:id |
Fetch a single record by ID. |
| PATCH | /:id |
Update fields on a record. |
| DELETE | /:id |
Delete a record. |
Every request requires a valid Authorization: Bearer token. The runtime extracts the user ID from the JWT and enforces RBAC before executing any SQL. Unknown entities return 404.
System Columns & Field Types
Every entity gets three auto-managed system columns (id, created_at, updated_at) and supports a range of field types. See the manifest reference for the complete specification.
Schema Sync Engine
Every deploy triggers an automatic diff between your manifest and the live PostgreSQL schema. The runtime generates and executes the minimum DDL within a transaction. If any statement fails, the transaction rolls back and the deploy is rejected.
See Build an Application — Schema Sync Engine for the full list of supported changes.
id, created_at, and updated_at are protected.Auto-Generated MCP
Every Application automatically exposes an MCP server with CRUD tools for its entities. External AI tools and AI Agents can interact with your data through MCP, with the same RBAC permissions enforced. The Job Queue is also accessible via MCP.
Browsing Your Data
Browse schemas, inspect table structures, and explore your data directly. The database browser shows all app schemas with their entities and column definitions.
The built-in SQL Editor lets you run queries directly against your database for debugging, reporting, or ad-hoc analysis.
Using Code
Create
curl -X POST https://<your-ref>.rootcx.com/api/v1/apps/crm/collections/contacts \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"first_name": "Alice", "last_name": "Smith", "email": "alice@example.com"}'{
"id": "a1b2c3d4-...",
"first_name": "Alice",
"last_name": "Smith",
"email": "alice@example.com",
"created_at": "2024-12-01T10:00:00Z",
"updated_at": "2024-12-01T10:00:00Z"
}List
curl https://<your-ref>.rootcx.com/api/v1/apps/crm/collections/contacts \
-H "Authorization: Bearer $TOKEN"Returns an array of records.
Update
curl -X PATCH https://<your-ref>.rootcx.com/api/v1/apps/crm/collections/contacts/a1b2c3d4-... \
-H "Authorization: Bearer $TOKEN" \
-d '{"first_name": "Alice B."}'updated_at is set automatically. Only the fields you send are updated.
Delete
curl -X DELETE https://<your-ref>.rootcx.com/api/v1/apps/crm/collections/contacts/a1b2c3d4-... \
-H "Authorization: Bearer $TOKEN"