API Maker
The backend engine for the AI era
Your code
Ready APIs for the jobs every backend has: encryption, secrets, Redis, cache, validation, tokens and events.
API Maker comes with 23 system APIs. Your code calls them with g.sys, and you can open any of them to clients as a REST API under /api/system-api. They have settings and hooks like every other API.
Step through it, slow it down, or open the full canvas.
api-maker/features/inbuilt-systemLive23 system APIs, ready to use. Encryption, secrets and Redis, cache reset, data validation, events and utilities, plus the index APIs and plain queries. Call them as REST APIs, or with g.sys in your code.
Encryption, secrets and Redis, cache reset, data validation, events and utilities, plus the index APIs and plain queries. Call them as REST APIs, or with g.sys in your code.
AES, with the key of your Secret, or a key of your own. The hash is an HMAC SHA-256, it can not be reversed.
Read any key of your encrypted Secret. Set, read and remove Redis keys with a TTL: OTPs, sessions, locks.
The cache of a table, of a custom API or of the system APIs. You get back how many Redis keys were removed.
The validation of a save runs against the schema of a table or of a custom API, and every error comes back.
Emit events to their listeners or to WebSockets, get tokens for your users, call external APIs in parallel or in sequence.
Call external APIs with JSON, forms, file uploads or XML, with API key, bearer, basic or OAuth 2 authentication, retries and file downloads, in parallel or in sequence, and pass values from one answer to the next request. Emit events and WebSocket events. Read table metadata, check a connection string, reset the pools of a moved tenant.
get token signs in API users and the users of your own tables, and returns a token, a refresh token and its expiry.
Run the validation of a table or a custom API on some data and get every error back.
import * as T from 'types';import { randomInt } from 'crypto';async function main(g: T.IAMGlobal) { const otp = String(randomInt(100000, 1000000)); // a code no one can guess await g.sys.cache.setKey(`otp:${g.req.body.phone}`, otp, 300); // expires in 5 minutes const smsKey = await g.sys.system.getSecret('sms.apiKey'); const sent = await g.sys.system.callExternalApi({ url: 'https://sms.example.com/v1/messages', method: 'POST', headers: { Authorization: `Bearer ${smsKey}` }, body: { to: g.req.body.phone, text: `Your code is ${otp}` }, }); return { sent: sent.statusCode === 200 };}module.exports = main;POST /api/system-api/admin/hash-datax-am-authorization: <API user token>{ "name": "Joseph" }The answer is the HMAC SHA-256 of the body, in hex, in data.
On the real admin panel, with real data.
encrypt-data, decrypt-data, hash-data, token, call-external-api, get-secret-by-name, get-redis-key, set-redis-key, remove-redis-key, the three reset caches (database, custom APIs, system APIs), get-table-meta, get-indexes, create-indexes, drop-indexes, execute-plain-query, emit-event, emit-event-ws, the two is-valid-data checks (table, custom API), multi-tenant-instance-updated and is-valid-connection-string.
Yes. g.sys.system.executeQuery runs SQL on a SQL instance, or a command on MongoDB.
Yes. Each system API has settings with enableCaching, its access type and auth providers, and pre and post hooks.