API reference · Data plane

Rows

Read and write the rows of a table on the data plane. Every call is filtered by the table's access preset and the identity of the caller.

Host: https://proj-<id>.manybases.com · Key: pk_ (with X-Session for a signed-in user) or sk_. The same routes exist for an account key under /v1/projects/:pid/… — see Mirrors.

GET/v1/tables/:table/rows

List rows. Filters, sort and cursor pagination as in Conventions. 200 { data: [...], cursor }

GET/v1/tables/:table/rows/:id

One row. 200 { data: {...} }. A row that does not exist and a row you may not read answer the same 404

POST/v1/tables/:table/rows

Create one row (an object) or several (an array of at most 100 — 10 on a form table). 201 with the complete rows, platform columns filled in

PATCH/v1/tables/:table/rows/:id

Change only the columns you send. 200 with the complete row

DELETE/v1/tables/:table/rows/:id

200 { data: { id, deleted: true } }

Creating a row#

http

POST /v1/tables/habits/rows
Authorization: Bearer pk_…
X-Session: <token>
Content-Type: application/json

{ "name": "Sport", "target_per_week": 3 }

→ 201
{ "data": { "id": "01J3ZK…", "name": "Sport", "target_per_week": 3,
            "owner_id": "usr_a", "created_at": "2026-07-27T09:12:00Z", "updated_at": "2026-07-27T09:12:00Z" } }

The API sets id, owner_id, created_at and updated_at. A body that carries id or owner_id is refused with 400 validation_error.
owner_id is the end user of the session. A row created with an sk_ or ak_ key has owner_id: null: it belongs to nobody, so on a prive or journal table no end user will ever see it.
On a spaces preset the body carries space_id, chosen among the caller's own spaces; the API checks membership before writing. space_id is immutable afterwards — to move a row, delete and recreate it.
On a form table an anonymous caller may create; the rate limit is 10 creations per minute per IP (429), and the table holds at most 10 000 rows (402 quota_exceeded). Both apply to anonymous and signed-in callers alike; sk_ and ak_ are exempt.
Send Idempotency-Key to make a retry safe. For an anonymous caller the key only de-duplicates: a replay answers 409, never the first response.

Sizes#

A row is at most 64 KB (32 KB on a form table), platform columns included, on creation as on update. The request payload is at most 256 KB. Beyond, 413 payload_too_large names the figure.

Who sees what#

The preset decides per operation. Examples: on prive a user lists only rows where owner_id is theirs; on partage everyone signed in lists everything but edits only their own rows; on journal nobody edits or deletes, ever; on formulaire anyone creates and nobody reads from the app. The full matrix is in Access presets.

A refusal never reveals what it hides: an operation on a row the caller may not see answers the neutral 404; an operation the caller may see but not perform (editing a journal row) answers 403 forbidden. An anonymous caller on a non-public preset answers 401 with the hint "session required".

What is not there#

No OR between filters, no joins, no aggregation (sum, average, group by), no conditional visibility per row or per column. See Limitations for the workarounds. Schema changes go through SQL or the create_table and apply_migration tools.