Routes
Every route of the Data API, under /api. Most of them are patterns over your own database: {schema}, {table}, {view} and {function} are the names of what you exposed, so Acme's work orders are /api/public/table/work_orders. The rest are fixed routes, the same on every instance.
Each route answers as the caller: a session or a token, with its roles' permissions. A resource you didn't expose answers 404 RESOURCE_NOT_FOUND, as if it didn't exist; an action the caller's roles don't allow, 403 ACTION_DENIED.
GET /api/openapi.json: the OpenAPI document of what the caller can reach. See OpenAPI.Your tables, views and functions
| Method | Route | Does | Needs |
|---|---|---|---|
GET | /api/{schema}/table/{table} | read rows: fields, where, search, order_by, limit, aggregates | READ |
GET | /api/{schema}/table/{table}/{pk} | read one row by its primary key | READ |
POST | /api/{schema}/table/{table} | create a row, several (a list), with related rows (nested), or upsert (on_conflict) | CREATE (and UPDATE to upsert) |
PATCH | /api/{schema}/table/{table}/{pk} | update one row | UPDATE |
PATCH | /api/{schema}/table/{table}?where[…] | update every row the filter selects | UPDATE |
DELETE | /api/{schema}/table/{table}/{pk} | delete one row | DELETE |
DELETE | /api/{schema}/table/{table}?where[…] | delete every row the filter selects | DELETE |
GET | /api/{schema}/view/{view} | read a view's rows, with the same parameters | READ |
POST | /api/{schema}/function/{function} | call a function; ?async=true runs it in the background | EXECUTE |
With Acme's names:
GET /api/public/table/work_orders?fields=number,status,site.name&where[status][_eq]=NEW
GET /api/public/table/work_orders/3f2b…
POST /api/public/table/work_orders
PATCH /api/public/table/work_orders/3f2b…
DELETE /api/public/table/work_orders/3f2b…
GET /api/public/view/vehicles_latest_positions
POST /api/public/function/create_invoice_from_work_order
An update or delete without {pk} needs a where (unless Settings › Data API › Limits says otherwise), so a missing filter can't change every row. Several rows at once are one transaction: one failure rolls back them all.
TotalBase's own tables use the same patterns under the totalbase schema, as far as each one is exposed and the caller is granted: /api/totalbase/table/users lists users for a delegated manager. See Delegated administration.
Guides: Reading, Filtering, Aggregating, Writing, Nested writes, Calling functions.
Fixed routes
Authentication
| Method | Route | Does |
|---|---|---|
POST | /api/auth/login | sign in with email and password; answers a session token |
POST | /api/auth/logout | end the session |
GET | /api/auth/me | the signed-in user |
POST | /api/auth/register | create an account, when self-registration is on |
POST | /api/auth/password/forgot | email a reset link |
POST | /api/auth/password/reset | set a new password with a reset token |
POST | /api/auth/password/change | change the signed-in user's password |
POST | /api/auth/email/verify | verify an email with its token |
POST | /api/auth/email/resend | send a new verification link |
POST | /api/auth/invitations/accept | accept an invitation and set the password |
GET | /api/auth/oauth/{provider} | start signing in with a provider |
GET | /api/auth/oauth/{provider}/callback | the provider's return |
Bodies and answers: Authentication API.
Your tokens
| Method | Route | Does |
|---|---|---|
GET | /api/tokens | list your API tokens |
POST | /api/tokens | create one; the secret is in the answer, once |
POST | /api/tokens/{id}/rotate | issue a new secret, the old one valid for a while you choose |
POST | /api/tokens/{id}/revoke | stop it for good |
DELETE | /api/tokens/{id} | delete it |
See API tokens.
Transactions and background work
| Method | Route | Does |
|---|---|---|
POST | /api/transactions | several writes in one PostgreSQL transaction; needs the Can run transactions capability. See Transactions |
GET | /api/executions/{id} | the status and result of an asynchronous function call you started |
POST | /api/executions/{id}/cancel | cancel it |
Files
| Method | Route | Does |
|---|---|---|
POST | /api/totalbase/table/files | upload a file (multipart) |
GET | /api/totalbase/table/files/{id} | its content; images take transformations |
GET | /api/totalbase/table/files/{id}/info | its details |
PATCH | /api/totalbase/table/files/{id} | change its details, rename or move it |
PUT | /api/totalbase/table/files/{id}/content | replace its content |
DELETE | /api/totalbase/table/files/{id} | delete it and its content |
POST | /api/totalbase/table/templates/{id}/pdf | render a PDF template with your data |
Listing files and folders uses the table pattern: /api/totalbase/table/files, /api/totalbase/table/folders. See Using files in tables.
Workflows
| Method | Route | Does |
|---|---|---|
POST | /api/workflows/{slug}/run | run a Manual workflow; needs its invoke grant. See Manual trigger |
GET, POST | /api/workflows/{slug}/webhook | a Webhook workflow's endpoint, with the method it's set to. See Webhook trigger |
GET | /api/workflows/runs/{runId}/result | a run's result, after an asynchronous start |
The instance
| Method | Route | Does |
|---|---|---|
GET | /api/openapi.json | the OpenAPI document of what the caller can reach |
GET | /api/instance | the instance's public presentation: name, logo, language, sign-in layout. No sign-in needed |
Not part of the Data API
/admin/api/*is the Admin API, for administrators./app/api/*serves the admin and the App themselves. It's internal: build on the Data API and the Admin API instead./mcpis the MCP server./health/liveand/health/readyare for load balancers: see Deployment.