Using the REST API: Endpoints, Queries, and Authentication

Every time you create or modify a table in NoCodeBackend, a fully documented RESTful API is instantly provisioned and mapped directly to your MySQL schema.

This guide provides a comprehensive breakdown of how to interact with this API, authenticate requests securely, apply complex filtering logic, handle pagination, and read the auto-generated Swagger documentation.

1. Detailed Overview

The NoCodeBackend REST API follows standard REST conventions. It maps HTTP verbs (GET, POST, PUT, PATCH, DELETE) to database CRUD operations (Create, Read, Update, Delete).

The API relies entirely on standard HTTP status codes (2xx for success, 4xx for client errors, 5xx for server errors) and standard JSON payloads. There is no proprietary SDK required—you can interact with the API using native fetch in JavaScript, URLSession in Swift, or requests in Python.

The Swagger / OpenAPI Interface

You don't need to guess your endpoint URLs. In your dashboard, the API Docs (Swagger) tab provides an interactive UI generated directly from your live database schema.

This UI allows you to test endpoints directly in your browser. When you add a new column to a table, the Swagger documentation updates instantaneously to reflect the new expected payload structure.

2. Authentication

By default, all endpoints are closed to the public. You must authenticate every request. There are two distinct methods for authenticating against the REST API based on your environment.

Method A: Secret Keys (Server-to-Server)

If you are calling the API from a secure environment (a Node.js server, Next.js Server Actions, Python backend, or automation script), use a Secret Key.

1. Navigate to your database card in the dashboard, click the three dots menu (...), and select Secret keys.
2. Create or copy your Secret Key.
3. Pass the key in the standard Authorization header as a Bearer token:

const response = await fetch('https://api.nocodebackend.com/read/users?Instance=db_abc123', {
  headers: {
    'Authorization': 'Bearer ncb_sec_...'
  }
});

WARNING: Never embed a Secret Key in client-side code (browser SPAs or public bundles). Anyone who inspects network traffic can extract the key and compromise your database.

Method B: NoCodeBackend Built-in Auth (Client-Facing Apps & Customer Portals)

If you are building a customer-facing web application or client portal, use NoCodeBackend's Built-in Session Authentication combined with Row Level Security (RLS).

1. Users sign up or log in via your application's built-in authentication flow or our pre-built @nocodebackend/account-react component.
2. The user receives a secure session cookie (better-auth.session_token).
3. Your client routes data requests through your application's /api/data/* proxy (e.g., GET /api/data/read/tasks?Instance=db_abc123).
4. The API gateway automatically enforces session-based Row-Level Security, ensuring authenticated users can only view, create, and modify rows where user_id matches their own session.

3. Standard Endpoints & Payload Structures

NoCodeBackend provides dedicated REST endpoints for every table. In server-to-server calls, specify your database instance via the Instance query parameter.

Let's assume you have a database instance shop_db and a table named products.

1. Retrieve a Collection (GET)

GET https://api.nocodebackend.com/read/products?Instance=shop_db
(Or in client apps: GET /api/data/read/products?Instance=shop_db)
Returns an array of records. Use query parameters for filtering, sorting, and pagination (see section 4).

2. Retrieve a Single Record (GET)

GET https://api.nocodebackend.com/read/products/42?Instance=shop_db
(Or in client apps: GET /api/data/read/products/42?Instance=shop_db)
Returns a single JSON object. If ID 42 does not exist (or the authenticated user does not own it under RLS), returns 404 Not Found.

3. Create a Record (POST)

POST https://api.nocodebackend.com/create/products?Instance=shop_db
(Or in client apps: POST /api/data/create/products?Instance=shop_db)
Pass a JSON body representing the new row:

{
  "name": "Mechanical Keyboard",
  "price": 149.99
}

Returns a 200 status with the created record object (including the auto-generated id). In client sessions, user_id is automatically set to the active session ID.

4. Update a Record (PUT)

PUT https://api.nocodebackend.com/update/products/42?Instance=shop_db
(Or in client apps: PUT /api/data/update/products/42?Instance=shop_db)
Updates the specified record with the fields provided in the JSON payload:

{
  "price": 129.99
}

5. Delete a Record (DELETE)

DELETE https://api.nocodebackend.com/delete/products/42?Instance=shop_db
(Or in client apps: DELETE /api/data/delete/products/42?Instance=shop_db)
Permanently deletes the record matching that ID. Returns success confirmation.

4. Advanced Querying: Filtering and Pagination

When retrieving data via GET /table_name, you append query parameters to the URL to manipulate the result set.

Pagination (Required for Performance)

Never pull an entire table at once. Use limit and offset.

• _limit: The maximum number of rows to return (default is 50, max is 1000).
• _offset: The number of rows to skip.

Example: Get page 3, with 20 items per page. GET /products?_limit=20&_offset=40

Sorting

• _sort: The column to sort by. Prefix with a minus sign - for descending order.

Example: Get the 10 newest products, sorted by date. GET /products?_sort=-created_at&_limit=10

Filtering Operators

You can apply logic directly to column names using suffixes.

• ?status=active (Exact match)
• ?price_gt=100 (Greater than)
• ?price_gte=100 (Greater than or equal)
• ?price_lt=50 (Less than)
• ?price_lte=50 (Less than or equal)
• ?name_like=Keyboard (Case-sensitive partial match)
• ?name_ilike=keyboard (Case-insensitive partial match)
• ?category_in=electronics,books (Matches any value in the list)

Example: Find all active products under $50, sorted by price. GET /products?status=active&price_lt=50&_sort=price

5. Troubleshooting

Common Errors

Error: 404 Not Found

• Cause: The URL is incorrect, the table name is misspelled, or you are trying to GET/PUT/DELETE an id that does not exist in the database.
• Resolution: Double-check your database instance ID in the base URL and ensure the table name is exactly as it appears in the dashboard (usually lowercase and plural).

Error: 405 Method Not Allowed

• Cause: You sent an HTTP verb to an endpoint that doesn't support it (e.g., sending a POST request to /products/42).
• Resolution: Review the Swagger documentation. To create a record, send POST to the root /products. To update, send PATCH to the specific ID /products/:id.

Error: 422 Unprocessable Entity

• Cause: The JSON body you sent is malformed or contains incorrect data types (e.g., passing a string "fifty" into an INT column).
• Resolution: Check the response body; NoCodeBackend will usually return an array of validation errors specifying exactly which column caused the rejection.

Error: 500 Internal Server Error

• Cause: This usually indicates a fatal crash in your Pre Hook logic (e.g., a syntax error in your math calculation step).
• Resolution: Check your Pre Hook logs in the dashboard to identify the failing step.