Skip to content

The REST API

Every table in your app is a REST endpoint at your app's address. Where the API lives, how to authenticate, the machine-readable description, and where calls are logged.

Last updated September 17, 2026

On this page

Every web app has an API. The moment a table exists it is a full set of endpoints at your app's address, and every backend function you allow can be called the same way. Use it to connect your other tools, feed data in from elsewhere, or let your AI agents read and write your app's data.

Where it lives

The base address is your app's own: https://<your app address>/api. The API tab shows it, along with every endpoint your entities generate. The API answers once the app is published; keys you create beforehand keep working.

Authentication

Send your key in an X-Api-Key header on every request. Authorization: Bearer <key> works too.

Shell
curl https://<your app address>/api/entities/Booking \
  -H "X-Api-Key: pxa_sk_..."

There are two kinds of key. A secret key (pxa_sk_) belongs on a server and reads and writes everything. A publishable key (pxa_pk_) is safe in a page and reads public tables only. See API keys.

Check a key

GET /api/whoami describes the key you sent, which tables it may read or write, and the app it belongs to, without touching data.

The machine-readable description

GET /api/openapi.json returns an OpenAPI 3.1 document for your app as your key sees it: every entity, every field with its type, every endpoint and every error. Import it into an API client or hand it to a code generator. On the API tab, Copy for AI copies a description you can paste into an AI assistant so it can write the integration for you.

What the API covers

Entity endpoints
List, get, create, update, delete, bulk, upsert and restore.
Filtering and paging
Typed filters, search, sorting, field selection, cursors.
Calling functions
Run a backend function from your server.
Errors and rate limits
Every error code and what to do about it.
Code examples
Shell, JavaScript and Python.
The call log
Every call, its request, its response and its timing.

Every answer carries

  • X-Request-Id: quote it when asking about a call. It is the id in the app's call log.
  • X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset: your allowance in the current window.
  • An ETag on single records, for conditional reads and safe updates.
Was this page helpful?