HTTP API: documents

Write, read, delete, query, count and batch documents, run transactions, manage indexes, collections, rules and live listeners over HTTP.

Updated Oct 18, 2026

JSON documents in collections, over HTTP. Every route checks your collection rules (doc:read, doc:write, doc:delete — Policy language (SPL)) and runs as the caller, so row policies on sov_documents apply too. The SDKs add Firestore-style helpers: Firebase-style code (Firestore API), Querying documents, Transactions, batches and field transforms.

URL=https://<project-ref>.sovarias.in
ANON_KEY=<anon key>
ACCESS_TOKEN=<a signed-in user's access token>


Base URL	`https://<project-ref>.sovarias.in` — your project URL from Connect.
Keys	Send the project's key as `apikey`. Calls made for a signed-in user also send `Authorization: Bearer <access token>`.
Errors	A status code and `{"detail": …}` — a sentence, or `{code, message}` for errors your code may branch on (HTTP API).

Documents

POST`/api/v1/data/doc/{doc_path}`

Write a document: create or replace it, or merge into it.

{"data": {...}} creates the document or replaces it entirely. Add merge: true (or merge_fields) to merge into an existing one, transforms for server-side changes (increment, array union…), precondition to write only if it is at a known version, or op to make it a strict create or update. Documents are kept in your project's database (sov_documents); at most 1 MB each.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/{doc_path}

Path parameters

doc_pathstringrequired: collection/id, or nested users/alice/orders/o_1. Segments: letters, digits, _ . @ -, up to 256 characters.

Body

dataobjectrequired: The fields (nesting up to 32 levels).
opstringoptionaldefault set: create fails if the document exists (409 ALREADY_EXISTS); update fails if it doesn't (404) and merges the given fields (dotted names allowed).; One of set, create, update
mergebooleanoptional: With set: deep-merge data into the existing document.
merge_fieldsarray<string>optional: With set: only these field paths of data are written.
transformsarray<object>optional: Up to 200 {field, op, value} applied on the server: increment, maximum, minimum (a number), array_union, array_remove (an array), server_timestamp, delete (remove the field).
preconditionobjectoptional: {version}, {update_time} or {exists: true|false} — the write happens only if it holds (412 FAILED_PRECONDITION otherwise).

Returns

statusstring: ok.
keystring: collection:id.
storagestring: postgres_jsonb.
versioninteger: The document's version after the write.
path, update_time, exists, transform_results, commit_time: Writes with merge, transforms, precondition or op also return the commit result: the document's path, update time, and each transform's resulting value.

Responses

201Created.
400Bad path, data isn't an object, too deep, over 1 MB, or a malformed transform.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
404NOT_FOUND — op: update on a document that doesn't exist.
409ALREADY_EXISTS (op: create) or ABORTED (a concurrent write; retry).
412FAILED_PRECONDITION — not at the version / update time given.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/orders/o_1001" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"data": {"customer": "6e19c0a2-3f5b-4a8e-9b1d-0c7f2e8a4d51", "status": "paid", "total": 59.9, "items": [{"sku": "tee-black-m", "qty": 2}]}}'

Response

{
  "status": "ok",
  "key": "orders:o_1001",
  "storage": "postgres_jsonb",
  "version": 3
}

GET`/api/v1/data/doc/{doc_path}`

Read one document.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/{doc_path}

Path parameters

doc_pathstringrequired: collection/id.

Query parameters

txidinteger | nulloptional: Read as of an open document transaction.

Returns

idstring: The document id (last path segment).
pathstring: collection/id (nested: users/alice/orders/o_1).
keystring: collection:id.
dataobject: The document's fields.
versioninteger: 1 when created, +1 on every write — use it for preconditions and transactions.
create_time, update_timestring: ISO 8601, UTC.
foundboolean: Always true here — a missing document (or one the caller may not see) is 404.

Responses

200Success.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
404No such document, or row security hides it from the caller.
401No valid session or key.

curl -s "$URL/api/v1/data/doc/orders/o_1001" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "id": "o_1001",
  "path": "orders/o_1001",
  "key": "orders:o_1001",
  "data": {
    "customer": "6e19c0a2-3f5b-4a8e-9b1d-0c7f2e8a4d51",
    "status": "paid",
    "total": 59.9,
    "items": [
      {
        "sku": "tee-black-m",
        "qty": 2
      }
    ]
  },
  "version": 3,
  "create_time": "2026-10-17T10:02:11.402Z",
  "update_time": "2026-10-17T12:40:11.204Z",
  "found": true
}

DELETE`/api/v1/data/doc/{doc_path}`

Delete one document.

Permanent: documents have no history or trash (Documents).

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/{doc_path}

Path parameters

doc_pathstringrequired: collection/id.

Responses

204Success, with no body.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
401No valid session or key.

curl -s -X DELETE "$URL/api/v1/data/doc/orders/o_1001" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

POST`/api/v1/data/doc/_get`

Read up to 100 documents by path in one request, with their versions.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_get

Body

pathsarray<string>required: 1–100 document paths.

Returns

documentsarray<object>: One entry per path, in order: the document (as from GET) with exists: true, or {id, path, exists: false, version: 0, data: null}.

Responses

200Success.
400paths missing, empty or over 100.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_get" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"paths": ["orders/o_1001", "orders/o_9999"]}'

Response

{
  "documents": [
    {
      "id": "o_1001",
      "path": "orders/o_1001",
      "key": "orders:o_1001",
      "data": {
        "customer": "6e19c0a2-3f5b-4a8e-9b1d-0c7f2e8a4d51",
        "status": "paid",
        "total": 59.9,
        "items": [
          {
            "sku": "tee-black-m",
            "qty": 2
          }
        ]
      },
      "version": 3,
      "create_time": "2026-10-17T10:02:11.402Z",
      "update_time": "2026-10-17T12:40:11.204Z",
      "exists": true
    },
    {
      "id": "o_9999",
      "path": "orders/o_9999",
      "exists": false,
      "version": 0,
      "data": null
    }
  ]
}

POST`/api/v1/data/query/scan`

List documents by key prefix or key range.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.

Body

prefixstring | nulloptional: Keys (collection:id) starting with this, e.g. orders:.
start_keystring | nulloptional: First key (inclusive).
end_keystring | nulloptional: Last key (inclusive).
limitintegeroptionaldefault 100: Up to 10,000.; 1.0–10000.0

Returns

documentsarray<object>: {key, txid, data, found} in key order.
countinteger
truncatedboolean: More documents match than limit.

Responses

200Success.
401No valid session or key.
422The body is missing a required field or has a field of the wrong type.

curl -s -X POST "$URL/api/v1/data/query/scan" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"prefix": "orders:", "limit": 2}'

Response

{
  "documents": [
    {
      "key": "orders:o_0987",
      "txid": 0,
      "data": {
        "status": "paid",
        "total": 51.0
      },
      "found": true
    },
    {
      "key": "orders:o_1001",
      "txid": 0,
      "data": {
        "status": "paid",
        "total": 59.9
      },
      "found": true
    }
  ],
  "count": 2,
  "truncated": true
}

Queries

POST`/api/v1/data/doc/_query/{collection}`

Query a collection by fields: filters, ordering, paging.

Runs as the caller, so collection rules and row policies apply. A query that needs an index that doesn't exist yet still runs (slower on big collections) and Sovaria may build one automatically; create indexes for your common queries.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_query/{collection}

Path parameters

collectionstringrequired: The collection, or a sub-collection path users/alice/orders.

Body

wherearrayoptional: Filters, each [field, op, value] or {field, op, value}. op: == != < <= > >= in not-in array-contains array-contains-any (aliases eq ne lt lte gt gte nin contains). Fields can be dotted (address.city); __key__ is the document id. Up to 30 filters; in-style lists up to 30 values.
order_byarrayoptional: Up to 8 entries, each field, [field, "desc"] or {field, direction}. __key__ may only be last.
limitintegeroptionaldefault 100: Documents per page, up to your plan's maximum (LIMIT_TOO_LARGE beyond).
limit_to_lastintegeroptional: The last N in order_by order (needs order_by; not with limit).
start_at, start_after, end_at, end_beforearray | objectoptional: Cursors: an array of order_by values, {values: [...]}, or {key: "<document id>"}. One start and one end cursor at most. The previous page's next_cursor is a ready-made start_after.

Returns

documentsarray<object>: Matching documents, each as from GET (id, path, key, data, version, create_time, update_time).
countinteger: Documents in this page.
has_moreboolean: Whether another page follows.
next_cursorobject | null: Pass as start_after for the next page.

Responses

200Success.
400INVALID_QUERY (bad filter, operator, cursor…) or LIMIT_TOO_LARGE.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
504DEADLINE_EXCEEDED — add an index for this query.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_query/orders" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"where": [["status", "==", "paid"], ["total", ">=", 50]], "order_by": [["total", "desc"]], "limit": 2}'

Response

{
  "documents": [
    {
      "id": "o_1001",
      "path": "orders/o_1001",
      "key": "orders:o_1001",
      "data": {
        "customer": "6e19c0a2-3f5b-4a8e-9b1d-0c7f2e8a4d51",
        "status": "paid",
        "total": 59.9,
        "items": [
          {
            "sku": "tee-black-m",
            "qty": 2
          }
        ]
      },
      "version": 3,
      "create_time": "2026-10-17T10:02:11.402Z",
      "update_time": "2026-10-17T12:40:11.204Z"
    },
    {
      "id": "o_0987",
      "path": "orders/o_0987",
      "key": "orders:o_0987",
      "data": {
        "customer": "6e19c0a2-3f5b-4a8e-9b1d-0c7f2e8a4d51",
        "status": "paid",
        "total": 51.0,
        "items": [
          {
            "sku": "tee-black-m",
            "qty": 2
          }
        ]
      },
      "version": 1,
      "create_time": "2026-10-17T10:02:11.402Z",
      "update_time": "2026-10-17T12:40:11.204Z"
    }
  ],
  "count": 2,
  "has_more": true,
  "next_cursor": {
    "values": [
      51.0
    ],
    "key": "o_0987"
  }
}

POST`/api/v1/data/doc/_count/{collection}`

Count the documents a query matches (without reading them).

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_count/{collection}

Path parameters

collectionstringrequired: The collection.

Body

wherearrayoptional: Filters, each [field, op, value] or {field, op, value}. op: == != < <= > >= in not-in array-contains array-contains-any (aliases eq ne lt lte gt gte nin contains). Fields can be dotted (address.city); __key__ is the document id. Up to 30 filters; in-style lists up to 30 values.

Responses

200Success.
400INVALID_QUERY.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
504DEADLINE_EXCEEDED.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_count/orders" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"where": [["status", "==", "paid"]]}'

Response

{
  "count": 1043
}

Atomic writes and imports

POST`/api/v1/data/doc/_commit`

Apply several writes atomically; with reads, as a transaction.

All writes apply or none. Add reads — the documents and versions you read — to make it a transaction: if any changed meanwhile, nothing is written and the answer is 409 ABORTED (retry; the SDKs do). Up to docs.max_transaction_writes writes (500).

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_commit

Body

writesarray<object>required: Each {op, path, data?, merge?, merge_fields?, transforms?, precondition?} — op is set (default), create, update or delete; the other fields as for a single write.
readsarray<object>optional: Up to 500 {path, version} the commit depends on.

Returns

commit_timestring: When the commit applied (also server_timestamp's value).
resultsarray<object>: One per write: path, new version, update_time, exists (false after a delete) and transform_results.

Responses

200Success.
400Malformed writes or reads.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
403PLAN_LIMIT_REACHED — more writes than docs.max_transaction_writes.
404NOT_FOUND — update on a missing document.
409ABORTED (a read document changed; retry) or ALREADY_EXISTS (create).
412FAILED_PRECONDITION.
504DEADLINE_EXCEEDED.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_commit" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"reads": [{"path": "accounts/a", "version": 12}], "writes": [{"op": "update", "path": "accounts/a", "data": {"balance": 90}}, {"op": "update", "path": "accounts/b", "transforms": [{"field": "balance", "op": "increment", "value": 10}]}]}'

Response

{
  "commit_time": "2026-10-17T12:58:40.551Z",
  "results": [
    {
      "path": "accounts/a",
      "version": 13,
      "update_time": "2026-10-17T12:58:40.551Z",
      "exists": true
    },
    {
      "path": "accounts/b",
      "version": 8,
      "update_time": "2026-10-17T12:58:40.551Z",
      "exists": true,
      "transform_results": [
        110
      ]
    }
  ]
}

POST`/api/v1/data/doc/_batch/{collection}`

Import up to 500 documents into a collection in one request.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_batch/{collection}

Path parameters

collectionstringrequired: The collection.

Body

documentsarray<object>required: 1–500 items: {id, data}, or the document itself (its id_field value becomes the id, otherwise one is generated).
modestringoptionaldefault insert: insert skips ids that exist; upsert replaces them.; One of insert, upsert
id_fieldstringoptional: A field whose value is the id (for example sku).

Returns

writteninteger
skippedarray: Ids skipped in insert mode because they exist.
keysarray<string>: The ids written.

Responses

201Created.
400documents empty, over 500, or an item isn't an object.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_batch/products" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"documents": [{"sku": "tee-black-m", "name": "Black tee", "price": 19}, {"sku": "tee-white-m", "name": "White tee", "price": 19}], "id_field": "sku", "mode": "upsert"}'

Response

{
  "status": "ok",
  "collection": "products",
  "written": 2,
  "skipped": [],
  "keys": [
    "tee-black-m",
    "tee-white-m"
  ]
}

Live listeners

POST`/api/v1/data/doc/_listen/{collection}`

Start a live query: the current results now, changes over realtime.

Returns the first results and a realtime channel (doclisten:<id>) that receives the changes to the query's results. A listener lasts ttl_seconds (600); renew it before then. The SDKs' onSnapshot does all of this (Live listeners).

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_listen/{collection}

Path parameters

collectionstringrequired: The collection.

Body

wherearrayoptional: Filters, each [field, op, value] or {field, op, value}. op: == != < <= > >= in not-in array-contains array-contains-any (aliases eq ne lt lte gt gte nin contains). Fields can be dotted (address.city); __key__ is the document id. Up to 30 filters; in-style lists up to 30 values.
order_byarrayoptional: Up to 8 entries, each field, [field, "desc"] or {field, direction}. __key__ may only be last.
limitintegeroptionaldefault 100: Documents per page, up to your plan's maximum (LIMIT_TOO_LARGE beyond).

Responses

200Success.
400INVALID_QUERY.
403PERMISSION_DENIED — a collection rule (doc:read / doc:write / doc:delete) or a row policy on sov_documents refused it.
403PLAN_LIMIT_REACHED — docs.max_listeners open at once.
503LISTENERS_UNAVAILABLE.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_listen/orders" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"where": [["status", "==", "paid"]], "order_by": [["total", "desc"]], "limit": 20}'

Response

{
  "id": "lst_7Gk2…",
  "channel": "doclisten:lst_7Gk2…",
  "expires_at": 1792262911.4,
  "ttl_seconds": 600,
  "documents": [
    {
      "id": "o_1001",
      "path": "orders/o_1001",
      "key": "orders:o_1001",
      "data": {
        "customer": "6e19c0a2-3f5b-4a8e-9b1d-0c7f2e8a4d51",
        "status": "paid",
        "total": 59.9,
        "items": [
          {
            "sku": "tee-black-m",
            "qty": 2
          }
        ]
      },
      "version": 3,
      "create_time": "2026-10-17T10:02:11.402Z",
      "update_time": "2026-10-17T12:40:11.204Z"
    }
  ],
  "has_more": false,
  "seq": 0,
  "query": {
    "collection": "orders",
    "where": [
      [
        "status",
        "==",
        "paid"
      ]
    ],
    "order_by": [
      [
        "total",
        "desc"
      ]
    ],
    "limit": 20
  }
}

POST`/api/v1/data/doc/_listeners/{listener_id}/renew`

Keep a listener alive for another ttl_seconds.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_listeners/{listener_id}/renew

Path parameters

listener_idstringrequired: From _listen.

Responses

200Success.
404Expired, or started by another caller.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_listeners/<listener_id>/renew" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "id": "lst_7Gk2…",
  "channel": "doclisten:lst_7Gk2…",
  "expires_at": 1792263511.4,
  "ttl_seconds": 600
}

DELETE`/api/v1/data/doc/_listeners/{listener_id}`

Stop a listener.

Who: Your app: the project's anon key (apikey: <anon key>), with the user's access token once they are signed in.
Also at: /rest/doc/_listeners/{listener_id}

Path parameters

listener_idstringrequired: From _listen.

Responses

204Success, with no body.
404Expired, or started by another caller.
401No valid session or key.

curl -s -X DELETE "$URL/api/v1/data/doc/_listeners/<listener_id>" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

GET`/api/v1/data/doc/_listeners`

How many live listeners the project has open.

Who: A project team member's session (the console, or a token from sov login) as Authorization: Bearer <token>. The member's role must allow the action.
Also at: /rest/doc/_listeners

Responses

200Success.
401No valid session or key.

curl -s "$URL/api/v1/data/doc/_listeners" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "available": true,
  "active_listeners": 12
}

Collections, indexes and rules

GET`/api/v1/data/doc/collections`

The project's collections with document counts.

Who: A project team member's session (the console, or a token from sov login) as Authorization: Bearer <token>. The member's role must allow the action.
Also at: /rest/doc/collections

Responses

200Success.
401No valid session or key.

curl -s "$URL/api/v1/data/doc/collections" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "collections": [
    {
      "name": "orders",
      "document_count": 1043,
      "sample_fields": [
        "customer",
        "status",
        "total",
        "items"
      ]
    }
  ],
  "total": 1
}

POST`/api/v1/data/doc/_indexes`

Create a composite index for queries that filter and order on several fields.

Builds in the background (202, state: building); queries work meanwhile. Creating an index that exists returns it (created: false).

Who: A project team member's session (the console, or a token from sov login) as Authorization: Bearer <token>. The member's role must allow the action.
Also at: /rest/doc/_indexes

Body

collectionstringrequired
fieldsarray<object>required: In order, each {path, order?} with order asc (default) or desc.

Responses

202Accepted — the work continues in the background.
400Bad collection or fields.
403PLAN_LIMIT_REACHED — docs.max_indexes.
401No valid session or key.

curl -s -X POST "$URL/api/v1/data/doc/_indexes" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"collection": "orders", "fields": [{"path": "status"}, {"path": "total", "order": "desc"}]}'

Response

{
  "name": "sovidx_3f9a1c07e2b84d5a6c10",
  "state": "building",
  "created": true
}

GET`/api/v1/data/doc/_indexes`

The project's document indexes and how many the plan allows.

Who: A project team member's session (the console, or a token from sov login) as Authorization: Bearer <token>. The member's role must allow the action.
Also at: /rest/doc/_indexes

Query parameters

collectionstring | nulloptional: Only this collection's.

Responses

200Success.
401No valid session or key.

curl -s "$URL/api/v1/data/doc/_indexes" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "indexes": [
    {
      "name": "sovidx_3f9a1c07e2b84d5a6c10",
      "collection": "orders",
      "fields": [
        {
          "path": "status",
          "order": "asc"
        },
        {
          "path": "total",
          "order": "desc"
        }
      ],
      "auto": false,
      "state": "ready",
      "bytes": 1327104,
      "created_at": "2026-10-17T11:05:42Z"
    }
  ],
  "limit": 100,
  "used": 1
}

DELETE`/api/v1/data/doc/_indexes/{name}`

Drop a document index.

Who: A project team member's session (the console, or a token from sov login) as Authorization: Bearer <token>. The member's role must allow the action.
Also at: /rest/doc/_indexes/{name}

Path parameters

namestringrequired: The index name (sovidx_…).

Responses

204Success, with no body.
401No valid session or key.

curl -s -X DELETE "$URL/api/v1/data/doc/_indexes/sovidx_3f9a1c07e2b84d5a6c10" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

GET`/api/v1/data/doc/_rules/{collection}`

The row policies on sov_documents that apply to a collection.

Collection rules (doc:read …) are access policies, listed with GET /api/v1/policies.

Who: A project team member's session (the console, or a token from sov login) as Authorization: Bearer <token>. The member's role must allow the action.
Also at: /rest/doc/_rules/{collection}

Path parameters

collectionstringrequired: The collection.

Responses

200Success.
401No valid session or key.

curl -s "$URL/api/v1/data/doc/_rules/orders" \
  -H "apikey: $ANON_KEY" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response

{
  "collection": "orders",
  "row_security": true,
  "policies": [
    {
      "name": "orders_own",
      "command": "ALL",
      "roles": [
        "public"
      ],
      "using": "((collection = 'orders'::text) AND (owner_id = (auth.uid())::text))",
      "with_check": "((collection = 'orders'::text) AND (owner_id = (auth.uid())::text))",
      "permissive": "PERMISSIVE",
      "platform": false
    }
  ],
  "all_collections": []
}

Something unclear or missing on this page?Tell us

HTTP API: documents

#Documents

#POST/api/v1/data/doc/{doc_path}

Path parameters

Body

Returns

Responses

#GET/api/v1/data/doc/{doc_path}

Path parameters

Query parameters

Returns

Responses

#DELETE/api/v1/data/doc/{doc_path}

Path parameters

Responses

#POST/api/v1/data/doc/_get

Body

Returns

Responses

#POST/api/v1/data/query/scan

Body

Returns

Responses

#Queries

#POST/api/v1/data/doc/_query/{collection}

Path parameters

Body

Returns

Responses

#POST/api/v1/data/doc/_count/{collection}

Path parameters

Body

Responses

#Atomic writes and imports

#POST/api/v1/data/doc/_commit

Body

Returns

Responses

#POST/api/v1/data/doc/_batch/{collection}

Path parameters

Body

Returns

Responses

#Live listeners

#POST/api/v1/data/doc/_listen/{collection}

Path parameters

Body

Responses

#POST/api/v1/data/doc/_listeners/{listener_id}/renew

Path parameters

Responses

#DELETE/api/v1/data/doc/_listeners/{listener_id}

Path parameters

Responses

#GET/api/v1/data/doc/_listeners

Responses

#Collections, indexes and rules

#GET/api/v1/data/doc/collections

Responses

#POST/api/v1/data/doc/_indexes

Body

Responses

#GET/api/v1/data/doc/_indexes

Query parameters

Responses

#DELETE/api/v1/data/doc/_indexes/{name}

Path parameters

Responses

#GET/api/v1/data/doc/_rules/{collection}

Path parameters

Responses

Related

Documents

POST`/api/v1/data/doc/{doc_path}`

GET`/api/v1/data/doc/{doc_path}`

DELETE`/api/v1/data/doc/{doc_path}`

POST`/api/v1/data/doc/_get`

POST`/api/v1/data/query/scan`

Queries

POST`/api/v1/data/doc/_query/{collection}`

POST`/api/v1/data/doc/_count/{collection}`

Atomic writes and imports

POST`/api/v1/data/doc/_commit`

POST`/api/v1/data/doc/_batch/{collection}`

Live listeners

POST`/api/v1/data/doc/_listen/{collection}`

POST`/api/v1/data/doc/_listeners/{listener_id}/renew`

DELETE`/api/v1/data/doc/_listeners/{listener_id}`

GET`/api/v1/data/doc/_listeners`

Collections, indexes and rules

GET`/api/v1/data/doc/collections`

POST`/api/v1/data/doc/_indexes`

GET`/api/v1/data/doc/_indexes`

DELETE`/api/v1/data/doc/_indexes/{name}`

GET`/api/v1/data/doc/_rules/{collection}`