Using the REST API: Endpoints, Queries, and Authentication

Every time you create or modify a table in NoCodeBackend, a fully documented RESTful API is instantly provisioned and mapped directly to your MySQL schema.

This guide provides a comprehensive breakdown of how to interact with this API, authenticate requests securely, apply complex filtering logic, handle pagination, and read the auto-generated Swagger documentation.

1. Detailed Overview

The NoCodeBackend REST API follows standard REST conventions. It maps HTTP verbs (GET, POST, PUT, PATCH, DELETE) to database CRUD operations (Create, Read, Update, Delete).

The API relies entirely on standard HTTP status codes (2xx for success, 4xx for client errors, 5xx for server errors) and standard JSON payloads. There is no proprietary SDK required—you can interact with the API using native fetch in JavaScript, URLSession in Swift, or requests in Python.

The Swagger / OpenAPI Interface

You don't need to guess your endpoint URLs. In your dashboard, the API Docs (Swagger) tab provides an interactive UI generated directly from your live database schema.

This UI allows you to test endpoints directly in your browser. When you add a new column to a table, the Swagger documentation updates instantaneously to reflect the new expected payload structure.

2. Authentication

By default, all endpoints are closed to the public. You must explicitly authenticate every request. There are two distinct methods for authenticating against the REST API.

Method A: Secret API Keys (Server-to-Server)

If you are calling the API from a secure environment (a Node.js server, a Next.js App Router, Python backend, or CI/CD script), use a Secret Key.

1. Generate a key in Developer Settings > API Keys.
2. Pass the key via the x-api-key HTTP header.

const response = await fetch('https://api.nocodebackend.com/v1/db_abc123/users', {
  headers: {
    'x-api-key': 'sk_live_...'
  }
});

WARNING: Never embed a Secret Key in client-side code (React SPA, Vue, Mobile App). Anyone who unpacks your bundle can extract the key and compromise your entire database.

Method B: Database Auth (Client-Side)

If you want to call the API directly from a browser or mobile app, you must use JWT-based Database Auth combined with Row Level Security (RLS).

1. The client logs in via the /auth/login endpoint.
2. The client receives a JWT.
3. The client passes the JWT in the Authorization header: Authorization: Bearer <jwt_token>
4. The database uses RLS policies to restrict what rows that specific JWT is allowed to SELECT or UPDATE.

3. Standard Endpoints & Payload Structures

The base URL for all your requests is: https://api.nocodebackend.com/v1/{your_db_instance}

Let's assume you have a table named products.

1. Retrieve a Collection (GET)

GET /products Returns an array of records. Use query parameters for filtering and pagination (see section 4).

2. Retrieve a Single Record (GET)

GET /products/:id (e.g., GET /products/42) Returns a single JSON object. If ID 42 does not exist, returns 404 Not Found.

3. Create a Record (POST)

POST /products Pass a JSON body representing the new row.

{
  "name": "Mechanical Keyboard",
  "price": 149.99
}

Returns a 201 Created status with the fully populated object (including auto-generated id).

4. Fully Replace a Record (PUT)

PUT /products/:id Completely overwrites the existing record. If you omit the price in the payload, the price in the database will be overwritten as NULL (if allowed by schema constraints).

5. Partially Update a Record (PATCH)

PATCH /products/:id Updates only the specific fields provided in the payload. All other fields remain unchanged. (Recommended over PUT for most use cases).

6. Delete a Record (DELETE)

DELETE /products/:id Permanently destroys the record. Returns a 204 No Content on success.

4. Advanced Querying: Filtering and Pagination

When retrieving data via GET /table_name, you append query parameters to the URL to manipulate the result set.

Pagination (Required for Performance)

Never pull an entire table at once. Use limit and offset.

• _limit: The maximum number of rows to return (default is 50, max is 1000).
• _offset: The number of rows to skip.

Example: Get page 3, with 20 items per page. GET /products?_limit=20&_offset=40

Sorting

• _sort: The column to sort by. Prefix with a minus sign - for descending order.

Example: Get the 10 newest products, sorted by date. GET /products?_sort=-created_at&_limit=10

Filtering Operators

You can apply logic directly to column names using suffixes.

• ?status=active (Exact match)
• ?price_gt=100 (Greater than)
• ?price_gte=100 (Greater than or equal)
• ?price_lt=50 (Less than)
• ?price_lte=50 (Less than or equal)
• ?name_like=Keyboard (Case-sensitive partial match)
• ?name_ilike=keyboard (Case-insensitive partial match)
• ?category_in=electronics,books (Matches any value in the list)

Example: Find all active products under $50, sorted by price. GET /products?status=active&price_lt=50&_sort=price

5. Troubleshooting

Common Errors

Error: 404 Not Found

• Cause: The URL is incorrect, the table name is misspelled, or you are trying to GET/PUT/DELETE an id that does not exist in the database.
• Resolution: Double-check your database instance ID in the base URL and ensure the table name is exactly as it appears in the dashboard (usually lowercase and plural).

Error: 405 Method Not Allowed

• Cause: You sent an HTTP verb to an endpoint that doesn't support it (e.g., sending a POST request to /products/42).
• Resolution: Review the Swagger documentation. To create a record, send POST to the root /products. To update, send PATCH to the specific ID /products/:id.

Error: 422 Unprocessable Entity

• Cause: The JSON body you sent is malformed or contains incorrect data types (e.g., passing a string "fifty" into an INT column).
• Resolution: Check the response body; NoCodeBackend will usually return an array of validation errors specifying exactly which column caused the rejection.

Error: 500 Internal Server Error

• Cause: This usually indicates a fatal crash in your Pre Hook logic (e.g., a syntax error in your math calculation step).
• Resolution: Check your Pre Hook logs in the dashboard to identify the failing step.