Changelog

Custom endpoints can no longer use a path under /docs, /openapi.json, /openapi-enhanced.json, /health, /alive or /metrics, start with a route parameter, or use a catch-all parameter. Existing ones answer 404; recreate them under another path such as /api/....

A write that reaches an endpoint without an authenticated role is refused with 403, unless the endpoint is configured Public.

/health and /alive answer anonymously only at exactly those paths; /health/ and /alive/ with a trailing slash or a sub-path require authentication.

Your API serves documentation for your own organization only, whatever host it is reached on. A documentation custom domain must be a domain you verified on the Domains page (or a subdomain of one); a refused domain is reported as 400 instead of 404.

Prometheus metrics are no longer reachable on any public host.

Requests that count against a rate limit carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. A request over the limit answers 429 with Retry-After. Anonymous requests to a Public endpoint without its own limit are not limited and get no headers.

Added MySQL and SQL Server databases alongside PostgreSQL.

The dashboard shows a request volume chart and an error rate figure.

Audit log. Changes made through the dashboard (POST, PUT, PATCH and DELETE requests) record the user, method, path, status code and latency; requests to your API record the method, table, status code and latency.

Sign-in can find your organization's single sign-on configuration from your email address, when the email domain is a verified domain of the organization.

A request with an expired API key is refused with 401 and the message "API key has expired."

Each endpoint can have its own rate limit.

The OpenAPI document includes example values and the request and response examples set for each endpoint.

Initial release: CRUD endpoints generated from a PostgreSQL schema, with filtering, sorting and paging.

Organizations with members, roles and invitations.

API keys stored as SHA-256 hashes, with rotation and revocation.

Read-only, read-write and admin roles for API keys.

Per-key rate limits. The count can be shared through Redis so the limit holds across more than one instance; without Redis each instance counts for itself.

OpenAPI document generated from your schema and served at /openapi.json.