Database API

The Postbase Database API exposes a single endpoint (POST /api/db/query) that powers the SDK query builder. It translates a JSON request body into safe parameterised SQL and executes it against your project's PostgreSQL schema.

Endpoint

POST /api/db/query
Authorization: Bearer pb_anon_<key>   -- or pb_service_<key>
X-Postbase-Token: <user-jwt>          -- optional: forwards user identity for RLS

Request Body

{
  "table": "posts",
  "operation": "select",
  "filters": [
    { "column": "published", "operator": "eq", "value": true }
  ],
  "select": "id, title, created_at",
  "order": { "column": "created_at", "ascending": false },
  "limit": 10,
  "offset": 0
}

Operations

• select — Read rows

• insert — Insert one or many rows (provide data)

• update — Update rows matching filters (provide data)

• upsert — Insert or update on conflict (provide conflictColumns)

• delete — Delete rows matching filters

Filter Operators

Available operators for the filters array:

• eq, neq — Equal / not equal

• gt, gte, lt, lte — Comparison

• like, ilike — Pattern match (case sensitive / insensitive)

• in — Value is in array

• is — IS NULL / IS TRUE checks

• contains — JSONB @> containment

• overlaps — Array && overlap

• textSearch — Full-text search via to_tsvector @@ plainto_tsquery

RLS & Auth Context

Pass a user JWT in X-Postbase-Token or X-Postbase-Session. Postbase calls set_config('postbase.user_id', uid) before running the query, so your RLS policies can reference current_setting('postbase.user_id', true)::uuid.

Project Isolation

Each project's tables live in a dedicated PostgreSQL schema named proj_<projectId>. The API resolves the correct schema from the API key, so you never need to qualify table names.