Boltstore

Appearance

Docs

Databases API ​

Database management endpoints. List, create, and delete require admin authentication. Viewing a database detail, managing config, and managing keys accept an API key or admin session.

Database Name Rules ​

Database names must match /^[a-z0-9][a-z0-9_-]*$/.

List Databases ​

GET /api/databases

Returns all databases on the server.

bash
curl http://localhost:8080/api/databases \
  -H "Authorization: Bearer <session-token>"
json
{
  "data": [
    {
      "id": "db_abc123",
      "name": "myapp",
      "path": "./data/myapp.db",
      "createdAt": "2026-06-20T10:00:00.000Z"
    }
  ]
}

Create Database ​

POST /api/databases

Create a new SQLite database. The optional group field lets you organize databases into groups for filtering in the admin dashboard.

bash
curl -X POST http://localhost:8080/api/databases \
  -H "Authorization: Bearer <session-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "myapp", "group": "production"}'
json
{
  "data": {
    "id": "db_def456",
    "name": "myapp",
    "group": "production",
    "path": "./data/myapp.db",
    "createdAt": "2026-06-21T12:00:00.000Z"
  }
}

Get Database ​

GET /api/databases/:name

Returns details for a specific database. Accepts an API key or admin session.

Rename Database ​

PATCH /api/databases/:name

json
{ "name": "new-name" }

Renames the database and its underlying file. API keys are automatically updated to reference the new name.

WARNING

Analytics tables (_query_log, _storage_snapshots, _daily_stats, _daily_queries) and the activity log are updated to reflect the new name. Only entries created by this server with analytics enabled are affected — external records are not migrated.

Rename internals:

  1. New Pool Creation: The server does not reuse the old DatabasePool; it creates a new one for the renamed file to avoid 500 errors during the transition
  2. Atomic Update: The _databases table is updated with the new name and file path
  3. Cache Invalidation: The analytics response cache is immediately invalidated, causing the dashboard to refresh with current data
  4. Order of Operations: The server updates analytics records before updating the metadata table to ensure routing stability
  5. File Cleanup: The old file is removed after the new pool is successfully created and verified

Delete Database ​

DELETE /api/databases/:name

Permanently deletes the database and all its data.

Database Config ​

GET /api/databases/:name/config

Get per-database configuration (CORS origins, read-only flag, group). Accepts an API key or admin session.

PATCH /api/databases/:name/config

Update per-database configuration. Accepts an API key or admin session. Only cors_origins and readonly keys are allowed.

json
{
  "readonly": true
}

API Keys ​

GET /api/databases/:name/keys

List API keys for the database. Accepts an API key or admin session.

POST /api/databases/:name/keys

Create a new API key:

json
{ "label": "My Backend Service" }

Returns { id, label, key } — the raw key is returned only once.

WARNING

API keys are SHA-256 hashed at rest. Store the raw key securely — it cannot be retrieved later.

POST /api/databases/:name/keys/:id/rotate

Rotate an API key. Returns a new key. The old key is immediately invalidated.

DELETE /api/databases/:name/keys/:id

Revoke an API key.

Batch Schema ​

GET /api/databases/:name/tables/schema

Returns the CREATE TABLE statements for all user tables in the database. Accepts an API key or admin session.

json
{
  "data": [
    {
      "name": "users",
      "schema": "CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, email TEXT)"
    },
    {
      "name": "posts",
      "schema": "CREATE TABLE posts (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT, author_id INTEGER)"
    }
  ]
}

Export ​

POST /api/databases/:name/export

Exports the database file using VACUUM INTO. Returns the .db file as a download. Accepts an API key or admin session.

Import ​

POST /api/databases/import

Import a .db file as a new database.

bash
curl -X POST http://localhost:8080/api/databases/import \
  -H "Authorization: Bearer <session-token>" \
  -F "[email protected]" \
  -F "name=myapp-restored"

The server runs PRAGMA integrity_check before registering the database.