Skip to content
Manybases
esc

Search pages and sections. Try a tool name, an error code, a route.

↑↓ navigate↵ openesc close
  1. API reference
  2. Management plane
  3. Mirrors
Docs

API reference · Management plane

Mirrors: the data routes under an account key

Every data route but one also exists on the management host, under /v1/projects/:pid/…, for an account key. Same bodies, same responses, same error codes — the same gesture under another key.

Host: https://api.manybases.com · Key: ak_.

GET/v1/tables, GET /v1/tables/:table
Mirror (management host, ak_)GET /v1/projects/:pid/tables, …/tables/:table
Toollist_tables
PATCH/v1/tables/:table
Mirror (management host, ak_)PATCH /v1/projects/:pid/tables/:table
Toolset_table_preset
, GET/PATCH/DELETE …/rows/:id
Mirror (management host, ak_)the same under /v1/projects/:pid/…
Toolquery_rows, insert_row, update_row, delete_row
the seven space routes
Mirror (management host, ak_)/v1/projects/:pid/spaces…
Tool—
POST/v1/sql, GET /v1/sql/history
Mirror (management host, ak_)POST /v1/projects/:pid/sql, …/sql/history
Toolrun_sql, apply_migration
, DELETE /v1/files/:id
Mirror (management host, ak_)/v1/projects/:pid/files…
Toollist_files, upload_file, delete_file

The exception is POST /v1/invites: its mirror and the invite_user tool were removed on 2026-09-22 — an invitation is issued from the app, by a person signed in to it.

What differs under an account key#

  • The access matrix does not apply. An account key sees every row of every table, whatever the preset, and writes anywhere.
  • Rows it creates have owner_id: null. They belong to no end user, so on a prive or journal table no end user will ever see them. Use them for reference data, not for a person's data.
  • It has no spaces of its own. It administers memberships but never becomes a member; creating and deleting a space still require an end-user session.
  • Destruction in volume is guarded. More than 40 deletions by one account key on one project within 5 minutes answer 428 confirmation_required, and the confirmation requires a signed-in human — a refused call gives its budget back. A server key (sk_) has no such budget.
  • Destructive SQL requires a signed-in human, where an sk_ confirms itself.
  • The project must be in the key's scope. Outside it, every route answers the neutral 404.

The one route with no mirror#

GET /v1/files/:id/content has no account-key twin. A file is served by its signed URL, which carries its own authority; doubling it under a key would create a second way to reach a file that the deletion rule would not cover.

The routes that live only here#

Projects, usage, project users, keys, logs, functions, sites, secrets and GitHub links have no data-plane form: they read the control plane, and a project's own host never holds an account secret. They are documented in the other pages of this section.