AppbricxDocs
FeaturesPricingStart free

Get started

OverviewWhat Appbricx isQuickstart with a coding agentQuickstart with the builderCore concepts

Guides

Data and tablesAccess and rolesBusiness rulesSign-inCustom screensRealtime and topicsWorkflows, schedules and webhooksServer functionsAI in your appPaymentsFilesMessagesIntegrationsVerifyPublishing, domains and rollbackOperating your appExport and self-hostSelf-host install

Tutorials

Build a booking app with Claude CodeMulti-user todo listClient portalSlack on new sign-upTemplates

Reference

Reference homeFrontend SDKHTTP APIMCP toolsCLIIntegrations catalogContract formatAI key resolutionRun Appbricx locally

HTTP API reference

Two HTTP surfaces. The app runtime API is what your app calls: data, sign-in, AI, functions, payments, files and topics, under /__appbricx on the app's own origin. The developer API is what the CLI, MCP clients and CI call to build, verify, deploy and operate apps.

118 endpointsReference home

App runtime API

  • Data APIList, read, create, update and delete rows of the app's tables, plus aggregates, full-text search, lifecycle transitions, external tables, named queries and raw SQL for trusted backends. (21 endpoints)
  • Sign-in APIThe app's own end-user accounts: sign-up, password and magic-link sign-in, social sign-in, two-factor codes, sessions, admin user management and organisations. (34 endpoints)
  • AI APIChat completions and embeddings with the project's own key or plan credits, metered per app and per user. (2 endpoints)
  • Functions, workflows and webhooksCall server functions, queue workflow runs, read runs and dead letters, read notifications, and receive inbound webhooks. (9 endpoints)
  • Payments APIOffline and Stripe card payments against the app's order rows. The server computes every amount. (4 endpoints)
  • Files APISigned uploads into the project's object store, owner-scoped downloads and soft deletes. (4 endpoints)
  • Topics and realtimePublish messages on topics and subscribe to topics and row-changed feeds over server-sent events. (2 endpoints)
  • Connector proxyCall a connected integration's action from an app without the app ever holding the credential. (4 endpoints)

Developer API

  • Developer APIThe HTTP door the CLI, the MCP server and CI use: tokens, projects, the contract loop (check, apply, patch, verify, deploy) and operating the running app (SQL, rows, schema, snapshots, deploys, runs, tail, secrets). (38 endpoints)

Credentials

App key + data marker
A project API key (dpk_c_… in browsers, bound to the app's origins; dpk_s_… on servers) or the builder preview token, plus the data-API marker header. With an app session (the header, or the appbricx_app_session cookie) the call acts as that user under row-level security; without one it acts as a guest. A server key may assert x-appbricx-app-user, x-appbricx-app-role and x-appbricx-app-org.
App key + signed-in user
A project key or preview token and a signed-in app session (header or cookie). Signed-out callers get 401.
Server key
A server-tier project API key (dpk_s_…, created in the editor under Backend, API). Browser keys and end-user sessions are refused.
App key + admin session
A project key and the session of an app user with the admin flag. Anyone else gets 403.
App key
A project key or preview token identifies the app. No user session is needed.
Webhook signature
No bearer token. When the webhook has a secret, sign the raw body with HMAC-SHA256 and send the hex digest. Hooks with a caller-provisioned secret also accept the secret itself in x-appbricx-webhook-secret.
Developer token
A personal access token (apx_pat_…, one workspace, scopes read / apply / deploy), the CLI's browser sign-in token, or the builder session. A project outside the token's reach answers 404, never 403.
Builder session only
The signed-in builder session. A personal access token can't mint another token.

Every endpoint

MethodPathWhat it does
GET/__appbricx/queriesList named queries
POST/__appbricx/queries/*Run a named query
GET/__appbricx/api/v1/searchFull-text search
GET/__appbricx/api/v1/openapi.jsonOpenAPI document
GET/__appbricx/api/v1/:tableList rows
GET/__appbricx/api/v1/:table/aggregateAggregate
GET/__appbricx/api/v1/:table/:idGet a row
POST/__appbricx/api/v1/:tableCreate a row
PATCH/__appbricx/api/v1/:table/:idUpdate a row
DELETE/__appbricx/api/v1/:table/:idDelete a row
GET/__appbricx/api/v1/ext/:entityList external rows
GET/__appbricx/api/v1/ext/:entity/aggregateAggregate external rows
GET/__appbricx/api/v1/ext/:entity/:idGet an external row
POST/__appbricx/api/v1/ext/:entityCreate an external row
PATCH/__appbricx/api/v1/ext/:entity/:idUpdate an external row
DELETE/__appbricx/api/v1/ext/:entity/:idDelete an external row
PATCH/__appbricx/api/v1/:entity/:id/transitionTransition a lifecycle field
POST/__appbricx/data/queryRaw SQL: query
POST/__appbricx/data/execRaw SQL: exec
POST/__appbricx/data/schemaRaw SQL: schema
POST/__appbricx/data/migrateRaw SQL: migrate
POST/__appbricx/auth/signupSign up
POST/__appbricx/auth/loginSign in
GET/__appbricx/auth/meCurrent user
GET/__appbricx/auth/signup-optionsSign-up options
POST/__appbricx/auth/logoutSign out
POST/__appbricx/auth/verify/requestRequest email verification
GET/__appbricx/auth/verify/confirmConfirm email
POST/__appbricx/auth/reset/requestRequest password reset
POST/__appbricx/auth/reset/confirmSet a new password
POST/__appbricx/auth/magic/requestRequest a magic link
GET/__appbricx/auth/magic/consumeUse a magic link
GET/__appbricx/auth/usersList users (admin)
GET/__appbricx/auth/rolesAssignable roles (admin)
POST/__appbricx/auth/usersInvite a user (admin)
PATCH/__appbricx/auth/users/:idChange a user (admin)
GET/__appbricx/auth/set-passwordSet-password page
POST/__appbricx/auth/set-passwordSubmit set-password form
GET/__appbricx/auth/oauth/providersSocial providers
GET/__appbricx/auth/oauth/:provider/startStart social sign-in
GET/__appbricx/auth/oauth/:provider/callbackSocial sign-in callback
GET/__appbricx/auth/oauth/completeComplete shared sign-in
POST/__appbricx/auth/oauth/configConfigure a provider (admin)
DELETE/__appbricx/auth/oauth/config/:providerRemove a provider config (admin)
POST/__appbricx/auth/mfa/enroll/startStart two-factor enrolment
POST/__appbricx/auth/mfa/enroll/confirmConfirm two-factor enrolment
POST/__appbricx/auth/mfa/verifyComplete a two-factor sign-in
POST/__appbricx/auth/mfa/disableTurn off two-factor
POST/__appbricx/auth/mfa/backup-codes/regenerateNew backup codes
POST/__appbricx/orgs/inviteInvite to the organisation
GET/__appbricx/orgs/invite/acceptAccept an invitation
GET/__appbricx/orgs/membersOrganisation members
PATCH/__appbricx/orgs/members/:userIdChange a member's role
DELETE/__appbricx/orgs/members/:userIdRemove a member
GET/__appbricx/orgs/currentCurrent organisation
POST/__appbricx/ai/chatChat completion
POST/__appbricx/ai/embedEmbeddings
POST/__appbricx/functions/:nameCall a server function
POST/__appbricx/runtime/workflows/:id/runQueue a workflow run
GET/__appbricx/runtime/runs/:runIdGet a run
GET/__appbricx/runtime/runsList runs
GET/__appbricx/notificationsNotifications
GET/__appbricx/runtime/dlqDead letters
POST/__appbricx/runtime/dlq/replayReplay a dead letter
GET/__appbricx/runtime/webhooks/:name/secretWebhook secret
POST/hooks/:projectId/:nameInbound webhook
POST/__appbricx/pay/confirmConfirm a card payment
GET/__appbricx/pay/methodsPayment methods
GET/__appbricx/pay/for/:table/:idLatest payment of an order
POST/__appbricx/pay/checkoutCheck out an order
POST/__appbricx/files/signSign an upload
POST/__appbricx/files/directUpload a file
GET/__appbricx/files/:idDownload a file
DELETE/__appbricx/files/:idDelete a file
POST/__appbricx/topics/:name/publishPublish on a topic
GET/__appbricx/topics/:name/subscribeSubscribe to a topic
GET/__appbricx/connector-proxy/availableConnected integrations
GET/__appbricx/connector-proxy/mcp/availableConnected MCP tools
POST/__appbricx/connector-proxy/mcp/:toolNameCall a connected MCP tool
POST/__appbricx/connector-proxy/:integration/:actionRun an integration action
POST/api/dev/v1/tokensMint a token
GET/api/dev/v1/tokensList my tokens
DELETE/api/dev/v1/tokens/:tokenIdRevoke a token
GET/api/dev/v1/meWho am I
GET/api/dev/v1/docsAgent guide
POST/api/dev/v1/components/checkCheck a custom component
GET/api/dev/v1/projectsList projects
POST/api/dev/v1/projectsCreate a project
GET/api/dev/v1/projects/:idProject state
GET/api/dev/v1/projects/:id/contractGet the contract
POST/api/dev/v1/projects/:id/checkCheck a contract
POST/api/dev/v1/projects/:id/applyApply a contract
POST/api/dev/v1/projects/:id/patchPatch the contract
POST/api/dev/v1/projects/:id/screenshotScreenshot the app
POST/api/dev/v1/projects/:id/verifyVerify
POST/api/dev/v1/projects/:id/data/queryQuery dev rows
GET/api/dev/v1/projects/:id/logsWorkflow logs
POST/api/dev/v1/projects/:id/deployDeploy
GET/api/dev/v1/projects/:id/demo-resetDemo mode state
POST/api/dev/v1/projects/:id/demo-resetChange demo mode
GET/api/dev/v1/projects/:id/sign-inSign-in providers
POST/api/dev/v1/projects/:id/sign-inChange a sign-in provider
POST/api/dev/v1/projects/:id/sqlRun SQL
POST/api/dev/v1/projects/:id/rowsEdit rows
GET/api/dev/v1/projects/:id/schemaDescribe the schema
GET/api/dev/v1/projects/:id/snapshotsList snapshots
POST/api/dev/v1/projects/:id/snapshotsTake a snapshot
POST/api/dev/v1/projects/:id/snapshots/:snapshotId/restoreRestore a snapshot
GET/api/dev/v1/projects/:id/deploysDeploy history
POST/api/dev/v1/projects/:id/deploys/:deploymentId/rollbackRoll back
POST/api/dev/v1/projects/:id/workflows/:workflowId/runRun a workflow
GET/api/dev/v1/projects/:id/runs/:runIdGet a run
GET/api/dev/v1/projects/:id/dead-lettersDead letters
POST/api/dev/v1/projects/:id/dead-letters/replayReplay dead letters
GET/api/dev/v1/projects/:id/tailTail events and requests
GET/api/dev/v1/projects/:id/secretsList secrets
PUT/api/dev/v1/projects/:id/secrets/:nameSet a secret
DELETE/api/dev/v1/projects/:id/secrets/:nameDelete a secret

Not in this reference

These routes exist in the source but are steps inside a flow, not APIs to call:

  • GET /auth/app-oauth/:provider/go: Hop inside the shared Google sign-in flow (sets the browser nonce, then redirects to the provider). Started by GET /__appbricx/auth/oauth/:provider/start, never called directly.
  • GET /files/integration/:filename: Serves files an integration action wrote to temporary storage, by an unguessable name the action returned. Not an API you call.
  • GET /__appbricx/auth/preview-login: One-time preview sign-in link minted by the builder's Backend panel (15 minutes, single use). Returns an HTML page.
Appbricx

The backend, runtime and hosting for apps your coding agent builds. On our cloud, in yours, or on your own servers.

Features

Coding agents and MCPVerify testingBuilder consolePostgres databaseData APIRealtimeRow-level securitySign-in and authPaymentsWorkflows and jobsAI in your appIntegrationsBackups and rollbackHosting and domainsSelf-host and exportAll features

Product

ShowcasePricingFor coding agentsTemplatesPrivate cloudBring your own AI keyFAQ

Compare

Appbricx vs SupabaseLovable alternativeBolt alternativeFor freelancersFor agencies

Resources

DocumentationReferenceBlogSupportContact

© 2026 Appbricx. All rights reserved.

TermsPrivacyCookiesAcceptable Use