Everything between your schema and your users.
Four capabilities, one platform - generation, access control, key management, and documentation. Multi-tenant by design, not bolted on.
Create your API - freeAPI generation
Tables become endpoints
Connect a PostgreSQL, MySQL, SQL Server, Oracle (Preview) or Db2 (Preview) database and RestWard generates CRUD endpoints from your schema. RestWard creates endpoints for every table in the schemas you include. You can switch off the endpoints you do not want.
Prefer the terminal? restward connect does it in one command -
install the CLI.
- Supported sources - PostgreSQL, MySQL, SQL Server, Oracle (Preview) and Db2 (Preview).
- Endpoint mapping - Each table becomes an endpoint, with filtering and paging on list endpoints.
- Config granularity - Enable or disable individual endpoints, for example the write endpoints to make a table read-only.
- Provisioning - RestWard runs the API for you. You do not deploy or host anything.
RBAC
Least privilege, enforced in one place.
Access control is a first-class feature, not a convention. You manage who can call what - and the platform makes sure no query ever leaves its organization.
- Organizations & members - Members are invited into an organization; every resource belongs to one.
- Endpoint settings - Each endpoint can be switched on or off, and has its own authentication type, rate limit and cache time.
- Key roles - Each API key is read-only, read-write or admin.
- Tenant isolation - Every query is filtered by OrganizationId, enforced by a single global authorization filter.
Keys & limits
Protect your API the day it ships.
Key management and rate limiting are included, not add-ons. Configure limits before you share the URL, not after the incident.
See an example of calling a generated API with a key.
- Key lifecycle - Create, scope, rotate, and revoke keys from the dashboard. Plaintext is shown once; only the SHA-256 hash is stored.
- Per-key quotas - Each key carries its own limits - separate budgets for staging, production, and each integration.
- Shared limits - RestWard can share the count through Redis, so the limit holds across more than one instance.
- Rate-limit headers - Responses carry limit headers, and over-limit calls get a clean 429 with retry information.
Documentation
Docs that can’t drift.
The OpenAPI spec is generated from your live schema and served alongside the API. It is always in step with what the API actually does - because it is what the API actually does.
- /openapi.json - The standard OpenAPI spec, consumed by Postman, codegen tools, and internal portals.
- /openapi-enhanced.json - An enhanced spec with additional metadata for documentation surfaces.
- Always current - Schema change → spec regenerates. No hand-maintained docs to fall behind.
- Versioning - Versioned API endpoints are on the roadmap.
The Postgres-to-REST pattern, with the platform layer included.
PostgREST proved the pattern. Hasura scaled it with GraphQL. RestWard applies it as a REST-native, multi-tenant platform.
| Capability | PostgREST | Hasura | RestWard |
|---|---|---|---|
| Multi-organization tenancy | — | + | + orgs, members, invitations |
| RBAC | Postgres roles | + | + org roles, key roles, tenant isolation |
| API key management | — | + | + hashed keys, rotation, IP allowlist |
| Flat-rate billing | — | — | + Stripe, per plan |
| Self-hosting | + | + | Roadmap |
| Protocol focus | REST | GraphQL-first | REST-native |
This table compares platforms, not raw throughput. If you need a single-binary, single-tenant tool, PostgREST is excellent - RestWard is the layer for when that pattern has to serve many organizations.
Connect → provision → serve.
Your database stays yours. RestWard reads the schema, runs an API for your organization, and serves requests through keys, roles, and rate limits.
Connect
Your database, credentials encrypted at rest. RestWard reads the schema only.
Provision
RestWard starts an API for your organization. You do not deploy or host anything.
Serve
Requests pass through API keys, RBAC and rate limits before reaching your data.
Create a REST API for your database
Sign up, connect a database, and call your first endpoint.