Sign inStart buildingStart building

Docs / Ship / API

API

FASTBASE has two HTTP surfaces.

Surface Base path Authenticated by Used by
Control plane /api/v1 Access token (Authorization: Bearer fbp_…) or dashboard session Dashboard, CLI, MCP, your automation
Data plane /v1 Project key (apikey: fbpk_… or fbsk_…) Deployed apps and the SDK

Errors

Every error has the same shape:

{
  "error": {
    "code": "CONFIRMATION_REQUIRED",
    "message": "Type the project address \"shop\" to confirm deletion.",
    "requestId": "0b6f2c1e-…",
    "details": { "expected": "shop" }
  }
}

The requestId is also returned in the x-request-id header. Common codes: VALIDATION_FAILED (400), UNAUTHENTICATED (401), QUOTA_EXCEEDED (402), FORBIDDEN / INSUFFICIENT_SCOPE (403), NOT_FOUND (404), CONFLICT / CONFIRMATION_REQUIRED (409), RATE_LIMITED (429).

A resource in someone else’s workspace answers 404, not 403.

Token scopes

projects:read, projects:write, projects:delete, deployments:read, deployments:write, env:read, env:write, logs:read, databases:read, databases:write, storage:read, storage:write, domains:write, ai:use.

Tokens cannot manage other tokens, organizations or members; those need a dashboard session.

Control plane

Projects

Method Path
GET /projects List
POST /projects Create { name, slug?, organizationId? }
GET / PATCH /projects/:project Read / update name and build settings
DELETE /projects/:project Delete — body { "confirm": "<slug>" }
POST /analyze Body: ZIP. Returns the analysis, deploys nothing

:project is the slug or the id.

Deployments

Method Path
POST /projects/:project/deployments?environment=&source=&message= Body: ZIP (Content-Type: application/zip). Returns 202
POST /projects/:project/deployments/git { repository?, branch?, environment? }
GET /projects/:project/deployments History
GET /deployments/:id Status, stages, analysis, diagnosis
GET /deployments/:id/logs?stream=&after= Logs; pass cursor back as after to tail
POST /deployments/:id/cancel · /redeploy · /rollback
POST /projects/:project/rollback Restore the last working version
GET /projects/:project/logs Runtime log of the live version 
curl -X POST "$FASTBASE_API_URL/api/v1/projects/shop/deployments?source=api" \
  -H "Authorization: Bearer $FASTBASE_TOKEN" \
  -H "Content-Type: application/zip" \
  --data-binary @project.zip

Configuration and services

Method Path
GET / PUT /projects/:project/env?environment= Names only / set { environment, variables: [{ key, value }] }
DELETE /projects/:project/env/:key
GET / POST / DELETE /projects/:project/database Info / create / delete (confirm)
GET /projects/:project/database/tables
POST /projects/:project/database/query { sql }
GET / POST /projects/:project/database/backups List / create
POST /projects/:project/database/backups/:id/restore Confirm required
GET / POST /projects/:project/storage/buckets
DELETE /projects/:project/storage/buckets/:bucket Confirm with the bucket name
GET / PUT /projects/:project/auth Sign-in methods and users
GET / PUT / DELETE /projects/:project/functions/:name
GET / POST / DELETE /projects/:project/domains plus /:id/verify
GET / PUT / DELETE /projects/:project/source GitHub repository
POST /projects/:project/ai/messages { message } → reply and proposed steps
POST /projects/:project/ai/actions/:id/execute { confirm? }

Workspace

/organizations, /organizations/:id (DELETE, confirm), /organizations/:id/members, /organizations/:id/invitations, /invitations/accept, /organizations/:id/usage, /organizations/:id/plan, /organizations/:id/audit, /organizations/:id/github, /tokens.

Account

/auth/signup, /auth/login (code when two-factor is on), /auth/logout, /auth/me, /auth/password/forgot, /auth/password/reset, /auth/verify-email, /auth/2fa/setup · /enable · /disable.

Method Path Notes
PATCH /auth/me { name?, locale?, notifyDeployments? } — locale is en or tr and is used for emails
POST /auth/password/change { currentPassword, newPassword } — signs out every other session
DELETE /auth/me { password, confirm } where confirm is your email. Refused while a workspace you own still has projects

Public

Method Path Notes
GET /status Health of the API, database, application hosting and realtime
POST /contact { name, email, message } — delivered to the installation's support address; rate limited

Platform administration

Only for accounts listed in FASTBASE_ADMIN_EMAILS, signed in with a browser session (access tokens are refused). Everyone else receives 404.

GET /admin/overview, GET /admin/users?q=, POST /admin/users/:id/disable · /enable, GET /admin/organizations, POST /admin/organizations/:id/plan, GET /admin/projects.

Metrics

GET /projects/:project/metrics?hours=24 → requests, errors, error rate, bytes, latency (average, p50, p95) and a time series.

Webhooks

POST /webhooks/github (push → deploy) and POST /webhooks/stripe (payment → plan). Both verify the provider’s signature.

Data plane

Method Path Key
POST /v1/auth/signup · /signin · /otp · /otp/verify · /anonymous · /signout public
POST /v1/auth/magic-link · /magic-link/verify · /password/forgot · /password/reset public
GET /v1/auth/oauth/:provider/start?apikey=&redirect_to= public key in the query (browser redirect)
GET /v1/auth/user public + Authorization: Bearer fbu_…
GET / POST / PATCH / DELETE /v1/db/:table secret
PUT / GET / DELETE /v1/storage/:bucket/<path> see Storage
POST /v1/storage/:bucket/sign secret
GET /v1/storage/public/:projectId/:bucket/<path> none (public buckets)
POST /v1/functions/:name public
POST /v1/realtime/ticket public
POST /v1/realtime/broadcast secret

Table filters

GET /v1/db/users?select=id,name&age=gte.18&name=ilike.a%25&order=name.asc&limit=20

Operators: eq, neq, gt, gte, lt, lte, like, ilike, in.(a,b), is.null, is.notnull. PATCH and DELETE require at least one filter. Select the environment’s database with the x-fastbase-environment header.

Rate limits

600 requests per minute per IP address overall; 10 per minute on control-plane credential endpoints and 20 per minute on data-plane ones.

← PreviousMCPNext →Security