REST and GraphQL
Read and write tables over HTTP.
Every table in the public schema gets REST endpoints at:
https://api.clouzark.com/rest/<database ref>Find the URL and keys with clouzark db keys.
Authentication
Send one of:
apikey: <anon key>— browsers and mobile apps. Row-level security applies.apikey: <service key>— server-side only. Bypasses row-level security.Authorization: Bearer <user token>— acts as a signed-in user from Auth.
Endpoints
| Request | Returns |
|---|---|
GET /rest/<ref> | { tables } |
GET /rest/<ref>/<table>?page=1 | { columns, rows, total, pageSize }, 50 rows per page |
GET /rest/<ref>/<table>/<id> | { row } |
POST /rest/<ref>/<table> with a JSON row | { row } (201) |
PATCH /rest/<ref>/<table>/<id> with the changed columns | { row } |
DELETE /rest/<ref>/<table>/<id> | 204 |
Errors come back as { "error": "..." }.
const base = 'https://api.clouzark.com/rest/my-app-db';
const headers = { apikey: process.env.NEXT_PUBLIC_CLOUZARK_ANON_KEY!, 'Content-Type': 'application/json' };
const { rows } = await fetch(`${base}/orders?page=1`, { headers }).then((r) => r.json());
const { row } = await fetch(`${base}/orders`, {
method: 'POST',
headers,
body: JSON.stringify({ total_cents: 4200 }),
}).then((r) => r.json());Row-level security
With the anon key or a user token, Postgres row-level security decides what each request can see and change. Enable it on every table your app exposes, and write policies with auth.uid(), which returns the signed-in user's id (or null):
alter table orders enable row level security;
create policy "read own orders" on orders
for select using (user_id = auth.uid());
create policy "create own orders" on orders
for insert with check (user_id = auth.uid());GraphQL
The same data is available over GraphQL, with the same keys and policies:
POST https://api.clouzark.com/graphql/<database ref>
{ "query": "...", "variables": { } }