dbAPI

Apache-2.0 · MySQL / MariaDB · v1.5.0

Governed JSON:API for MySQL-backed business apps

Turn your schema into a production REST layer — introspection, policies, JWT, and OpenAPI — without writing CRUD for every table. Keep rules in the database; ship clients against a stable API.

Guide GitHub

Build with us — implementation and workflow modules via LogiMaxx

Schema is the source of truth
Policy before data goes live
JSON:API + generated OpenAPI

GET /v1/apis/default/data/customers

{
  "data": [{
    "type": "customers",
    "id": "42",
    "attributes": { "name": "Acme", "status": "active" }
  }]
}

Why dbAPI

Boilerplate out. Schema and policy in.

Hand-rolled controllers, stale OpenAPI, and filters bolted on later do not scale. dbAPI introspects your database, rebuilds when the schema evolves, and keeps data routes dark until validation passes.

Schema as source of truth

Introspect from information_schema, rebuild config and OpenAPI, keep overrides in patch.php.

Policy before data

APIs stay in draft until connection, schema, and policies validate. Activate only when ready.

Standards-shaped responses

JSON:API documents with relationships, sparse fieldsets, and consistent errors — plus Swagger UI.

Two planes

One product, two jobs

Operators define whether and how an API exists. Applications read and write rows once it is active.

Control plane

/mgmt/v1/apis/…

Create APIs, attach connections, introspect and rebuild schema, set auth and network policies, validate, activate or deactivate. Plain JSON for operators and CI.

Data plane

/v1/apis/{apiId}/data/…

JSON:API CRUD, filters, includes, pagination, field ACLs, and JWT — only while the API status is active.

Draft
Create an apiId and store credentials once.
Connect
Point at MySQL, test, introspect, rebuild.
Govern
Auth, IP rules, per-table and per-field ACLs.
Activate
Validate readiness, then open the data plane.

Capabilities

What the data plane gives you

Every exposed table or view becomes a resource. Foreign keys become relationships. Each active API ships a cached OpenAPI spec.

Read with power

Compact filter expressions compiled to safe SQL
Sort, pagination, sparse fieldsets
Includes and relationship filters
Optional CSV / XLS export

Write with control

Create, update, delete — single or bulk
Nested creates with depth limits
Upsert-style onduplicate handling
CSV import on collections

Security on every request

IP ACLs for data and management traffic
JWT after a configurable SQL login query
Per-table and per-field ACLs
Inactive APIs return 409

One installation can host many independent APIs — each apiId with its own connection, policies, and OpenAPI under dbconfigs/.

Use cases

Where dbAPI fits

Same database, new HTTP surface — whether you are greenfield on MySQL or extending something that already runs.

REST over an existing schema

Point at the database, introspect, set policies, activate — then consume tables and views as JSON:API with OpenAPI in sync.

Extend legacy apps

Put dbAPI in front of the MySQL or MariaDB you already have. Ship new UIs, mobile clients, or partner integrations without rewriting the monolith — same data, separate apiId, independent auth and network rules.

Line-of-business workflows

Back-office and approval flows where rules live in SQL; dbAPI provides HTTP, docs, and guardrails.

Who it is for

Teams that already build on MySQL

Best when important rules live in the database and clients need a stable, documented REST surface. Not a hosted Postgres BaaS, not GraphQL-first, not a low-code admin UI.

Developers & founders

Ship admin panels and line-of-business apps quickly; keep transactional logic in SQL.

Agencies

Repeatable JSON:API + OpenAPI projects on client-owned databases, with per-project policies.

IT & operations

Modernize access to an existing MySQL estate — including legacy systems — without a full ERP or cloud-only stack.

Multi-database products

Dev, staging, prod, or per-tenant schemas as separate apiIds on one server.

Install

Run the published container

Image: ghcr.io/dbapiator/dbapi. External MySQL or MariaDB required. Single-mode example below; full reference on the deploy guide.

shell · docker

docker pull ghcr.io/dbapiator/dbapi:1.5.0

docker run -d --name dbapi -p 8888:80 \
  -e DEPLOYMENT_MODE=single \
  -e CONFIGS_DIR=/app/apis \
  -e CONFIG_API_SECRET='change-me' \
  -e DB_HOST=mysql.example.com \
  -e DB_NAME=myapp \
  -e DB_USER=dbapi \
  -e DB_PASSWORD='secret' \
  -v dbapi-configs:/app/apis \
  ghcr.io/dbapiator/dbapi:1.5.0

Then open http://localhost:8888/. Full docs: Guide (quick start + deploy) · Management API · Tutorials.

Services

Monetize the outcome — keep the engine open

dbAPI stays open source. LogiMaxx sells delivery and opinionated patterns for MySQL-backed workflow and back-office systems.

Implementation

Fixed-scope back-office or workflow on your MySQL — schema, policies, activate, client-ready OpenAPI.

Document workflow module

Approvals, states, and lifecycle as an installable vertical built on dbAPI.

Builder patterns

Schema conventions, SP/trigger templates, and Management API checklists for teams who self-host.

You pay for outcomes and method — not for locking the gateway behind a paywall.

Request a discussion Email