REST API Platform
Build Production-Ready REST APIs in Minutes
Ship secure, scalable APIs with authentication, rate limiting, and auto-generated OpenAPI documentation built right in.
Powerful Features for Every Use Case
Request Validation
Validate incoming requests against JSON schemas automatically. Catch malformed data before it reaches your handlers, with clear error messages that help developers fix issues fast. Schema definitions double as documentation, keeping your API contract and validation logic in perfect sync.
Response Caching
Speed up your API with intelligent caching. Configure TTLs per endpoint, invalidate on demand, or let the platform cache based on request headers. Redis and in-memory backends supported, with automatic cache-key generation that respects query parameters and authentication context.
Versioning Made Simple
Ship breaking changes without breaking clients. URL-based or header-based versioning routes requests to the right handler. Deprecation warnings guide developers to migrate, and you can sunset old versions on your timeline—not theirs.
Webhook Management
Let users subscribe to events with built-in webhook infrastructure. Automatic retries, signature verification, and delivery logs mean you spend zero time debugging 'why didn't my webhook fire?' Subscribers manage their own endpoints through a self-service portal.
Real-Time Metrics
See request volume, error rates, and latency percentiles in real time. Drill down by endpoint, user, or time window. Prometheus-compatible exports let you plug into your existing observability stack, or use the built-in dashboard to spot issues before customers do.
Multi-Tenancy Support
Serve multiple customers from one codebase. Tenant isolation at the database and authentication layer keeps data separate. Route requests by subdomain, header, or token claim, and configure rate limits and features per tenant without deploying separate instances.
Everything You Need to Build Modern APIs
Secure your endpoints with JWT, OAuth 2.0, or API keys out of the box. Role-based access control and permission scopes let you define exactly who can access what. No third-party services required—authentication is baked into the platform, ready to configure in minutes.
Protect your infrastructure with flexible rate limiting that adapts to your needs. Set limits per endpoint, per user, or per API key. Sliding window algorithms prevent abuse while allowing legitimate bursts. Real-time monitoring shows you exactly who's hitting which limits and when.
Your API documentation writes itself. Every endpoint, parameter, and response schema is automatically captured and rendered as interactive OpenAPI 3.0 docs. Developers can test requests directly in the browser, explore examples, and generate client SDKs in any language—all without you writing a single line of documentation.
import { api, auth, rateLimit } from '@rest-platform/core';
const app = api();
app.get('/users/:id',
auth.require('read:users'),
rateLimit({ max: 100, window: '1m' }),
async (req, res) => {
const user = await db.users.findById(req.params.id);
res.json(user);
}
);
// OpenAPI docs auto-generated at /docsUnder the hood
How requests flow through the platform
-
TLS everywhere, zero config
The platform terminates TLS at the edge and renews certificates automatically via Let's Encrypt or your own CA. HTTP requests are redirected to HTTPS by default. No manual cert juggling, no expired-cert outages.
-
Rate limiting before auth
Unauthenticated requests hit the rate limiter first, so attackers can't burn CPU verifying bad tokens. Limits are enforced in Redis with sub-millisecond latency, and the sliding-window algorithm prevents burst abuse while allowing legitimate traffic spikes.
-
Schema validation catches bad data early
Every request is validated against its JSON schema before reaching your handler. Malformed payloads return a 400 with a detailed error message, so your business logic never has to check if required fields exist. Schemas are defined once and reused for validation and documentation.
-
Handlers are just async functions
No framework lock-in. Your route handlers are plain async functions that receive a request and return a response. Middleware composes cleanly, and you can drop down to raw Node.js streams or buffers when you need fine-grained control.
-
Response caching respects auth context
Cached responses are keyed by URL, query parameters, and authentication claims, so user A never sees user B's data. Cache invalidation is explicit—call cache.clear() when data changes—or set a TTL and let stale entries expire automatically.
-
OpenAPI docs generated at runtime
The platform introspects your routes, middleware, and schemas to build an OpenAPI spec on the fly. No separate documentation build step. Add a new endpoint, and it appears in /docs immediately. Annotations in your code enrich the spec with examples and descriptions.
-
Metrics export without code changes
Request count, latency histograms, and error rates are collected automatically and exposed at /metrics in Prometheus format. No instrumentation code in your handlers. Plug the endpoint into Grafana, Datadog, or any metrics backend and you're done.
-
Structured logs, zero config
Every request logs as a single JSON object with trace ID, user ID, endpoint, status, and duration. Errors include stack traces. Logs stream to stdout by default, ready for your log shipper to forward to Elasticsearch, Loki, or CloudWatch.
Request pipeline
From idea to production in four steps
See how fast you can ship a secure, documented API.
Integrate with Your Favorite Tools
Frequently Asked Questions
How does authentication work?
The platform supports JWT tokens, OAuth 2.0 flows, and API keys. You can configure multiple authentication strategies per API and even combine them—for example, requiring both a valid JWT and an API key for certain endpoints. Role-based access control lets you define permissions at a granular level, and the system handles token refresh, revocation, and expiry automatically.
Can I customize rate limiting rules?
Absolutely. Rate limits can be set globally, per endpoint, per user, or per API key. You can define limits by requests per second, minute, hour, or day, and choose between fixed-window, sliding-window, or token-bucket algorithms. Advanced rules let you whitelist certain IPs, apply different limits to different user tiers, or dynamically adjust limits based on system load.
Is the OpenAPI documentation customizable?
Yes. While the platform auto-generates OpenAPI specs from your code, you can enrich them with descriptions, examples, and custom metadata using decorators or configuration files. The documentation UI is themeable, supports multiple API versions side-by-side, and can be embedded in your own developer portal. You can also export the raw OpenAPI JSON to use with other tools.
What databases are supported?
The platform is database-agnostic. Built-in adapters exist for PostgreSQL, MySQL, MongoDB, and DynamoDB, but you can connect to any data source via standard drivers. Multi-database setups are supported, so you can read from a replica, write to a primary, and cache in Redis—all within the same request handler.
How do I handle API versioning?
You can version APIs via URL path (e.g., /v1/users, /v2/users), custom headers (e.g., API-Version: 2), or content negotiation. The platform routes requests to the appropriate handler based on your versioning strategy. Deprecation warnings can be injected into responses automatically, and you can configure sunset dates that return 410 Gone after a version is retired.
Can I deploy this on-premises?
Yes. The platform runs anywhere Node.js or Docker runs—on-premises, in your VPC, or on any cloud provider. There are no external dependencies on proprietary services. You control the infrastructure, the data, and the deployment pipeline. Official Docker images and Kubernetes Helm charts are provided for easy orchestration.
What kind of monitoring is included?
Built-in dashboards show request counts, error rates, latency histograms, and rate-limit hits in real time. Logs are structured JSON, ready for ingestion by your log aggregator of choice. Metrics export to Prometheus, StatsD, or CloudWatch. Distributed tracing integrates with OpenTelemetry, so you can follow a request across microservices and spot bottlenecks.
How does webhook delivery work?
When an event occurs, the platform queues webhook payloads and delivers them to all subscribed endpoints. Deliveries are retried with exponential backoff if they fail. Each webhook is signed with HMAC so subscribers can verify authenticity. A delivery log shows every attempt, response code, and retry, making debugging straightforward. Subscribers manage their own webhook URLs and event filters through a self-service API.
Start building your API in minutes
No credit card, no setup wizard, no waiting for approval. Clone the starter repo, run one command, and you'll have a secure, documented REST API running locally. Authentication, rate limiting, and OpenAPI docs are already configured. Deploy to your cloud in the next five minutes, or keep iterating locally—your choice. Every feature you just read about is included, and the entire platform is open source.