Integration Studio

REST API Builder

Create custom REST endpoints backed by FlowOS tables — no code required. Define routes, authentication, rate limiting, and response shapes in a visual builder.

The REST API Builder at Integrations → API Builder lets you expose custom HTTP endpoints powered by your workspace tables and SDK artifacts — without building and deploying a separate backend. Use it to create data APIs for App Studio data sources, third-party integrations, or public portals.

Route Types

Type	Handler	Description
Table Query	Built-in	Wrap a table query with filters, sorting, and pagination. No code.
Table CRUD	Built-in	Auto-generate GET/POST/PUT/DELETE for a table.
Artifact	SDK	Route requests to a custom SDK script or webhook handler artifact.
Workflow	Workflow	Trigger a workflow and return its output as the API response.
Proxy	Built-in	Proxy to an external URL with auth header injection from a connector.

Route Configuration

Field	Type	Required	Default	Description
path	string	required	—	URL path, e.g. /incidents or /incidents/:id. Supports path params.
method	enum	required	—	GET \| POST \| PUT \| PATCH \| DELETE
description	string	optional	—	Shown in the auto-generated OpenAPI spec.
auth	enum	optional	"api_key"	none \| api_key \| bearer_token \| basic \| oauth2
allowed_roles	string[]	optional	—	Role slugs that can call this route. null = any authenticated caller.
rate_limit	object	optional	—	{ max: 100, window: "1m", by: "ip"\|"api_key"\|"user" }
cache	object	optional	—	{ ttl_seconds: 60 } — cache GET response. Invalidated on write to handler table.
cors	object	optional	—	{ origins: ["https://app.acme.com"], methods: ["GET","POST"] }

Auto-CRUD Example

Configure a CRUD endpoint for a custom table in under a minute:

json

{
  "type": "table_crud",
  "basePath": "/api/custom/assets",
  "table": "it_assets",
  "operations": ["list", "get", "create", "update", "delete"],
  "listConfig": {
    "defaultPageSize": 25,
    "maxPageSize": 100,
    "allowedFilters": ["status", "category", "owner_team"],
    "allowedSort": ["name", "created_at", "updated_at"]
  },
  "fieldPolicy": {
    "readable": ["id", "name", "status", "category", "purchase_date", "assigned_to"],
    "writable": ["name", "status", "category", "purchase_date", "assigned_to"],
    "hidden": ["internal_cost", "vendor_contract_id"]
  },
  "auth": "api_key",
  "allowed_roles": ["asset-manager", "admin"]
}

// Generated endpoints:
// GET    /api/custom/assets
// GET    /api/custom/assets/:id
// POST   /api/custom/assets
// PATCH  /api/custom/assets/:id
// DELETE /api/custom/assets/:id

Artifact-Backed Route

json

{
  "type": "artifact",
  "method": "POST",
  "path": "/api/custom/incidents/triage",
  "artifactSlug": "auto-triage-incident",
  "requestSchema": {
    "type": "object",
    "properties": {
      "incidentId": { "type": "string" },
      "mode":       { "type": "string", "enum": ["basic", "full"] }
    },
    "required": ["incidentId"]
  },
  "auth": "bearer_token",
  "rate_limit": { "max": 10, "window": "1m", "by": "api_key" }
}

Auto-Generated OpenAPI Spec

Every API built in the API Builder automatically gets an OpenAPI 3.1 spec. Access it at:

bash

GET /api/v1/api-builder/spec/:apiId          # JSON
GET /api/v1/api-builder/spec/:apiId?format=yaml  # YAML

The spec is also displayed in the API Builder UI as a Swagger-style interactive reference. Import it directly into Postman, Insomnia, or any OpenAPI-compatible client.

Use the API Builder's built-in request test panel to try your routes before sharing them. It automatically populates API key authentication and shows request/response headers and timing.