Draw the schema. The API is already there.
Hand-writing CRUD is the work nobody misses. Define your data model in Orbit and every table comes with a REST API and an OpenAPI schema, scoped to the signed-in user, so you focus on the product, not the plumbing.
{
"data": [
{ "id": "cus_8kd2", "name": "Ava Chen",
"status": "active" },
{ "id": "cus_9la1", "name": "Marcus Lee",
"status": "active" }
] }
The boilerplate
You wrote the same CRUD endpoints again, didn't you.
“Instantly having an endpoint is pretty magical, it lets us focus on the product and less on the database.” That's the dream. The fear is the shortcut that gets there: auto-APIs that “expose tables directly, and then you wonder how to control such things,” with no per-column control and no real auth. You want the endpoints for free, without handing out the keys to your database.
How it works
An API from your schema, scoped by default.
The same data model that backs your app generates its API. Every entity gets REST endpoints and a live OpenAPI schema, secured to the signed-in user from the first request, not a raw window onto your tables.
A REST endpoint for every entity
Define a table and you get GET, POST, PATCH, and DELETE at /api/v1, plus nested routes that follow your foreign keys. The CRUD layer you'd hand-write is generated, and it stays in step with your schema.
A live OpenAPI schema, always in sync
Every API-tier app publishes an OpenAPI 3.0 document at /openapi.json, generated from the same schema as the routes. Point your client, your codegen, or an AI agent at it and it's never out of date.
Scoped and secured, not tables on the open web
Requests are authenticated to the signed-in user and filtered by row-level security, so callers see only their own data. Not the auto-API that quietly exposes your whole database.
Honest edge: access is the app's end-user session, so this is the API behind your app, not a public API with issued keys. Public API tokens are on the way.
Where it fits
The API is a projection of your data.
You don't build the API separately. It's your data model, exposed. Change the schema and the endpoints and the OpenAPI spec follow.
Get the endpoints without the boilerplate
Define your data model and watch Orbit generate a documented API, scoped to your users from the start.