Docs menu · Resources

APIMock documentation

Resources

A resource turns a declared collection into persistent CRUD endpoints under your mock base URL. Records are stored in a dedicated data store, survive restarts/requests, and support pagination, sorting, operator filters, initial seed records, and reset — with no backend to write.

Updated

Do not use real credentials or personal data.

This is a mock store shared across your workspace. Treat everything you send as public sandbox data.

Setup

  1. Navigate to Endpoints in the dashboard.
  2. Click Create resource to open the creation wizard. Define a Resource (e.g. todos) and add typed fields.
  3. Optionally paste seed records to populate initial data on creation, or add them later.
  4. Five live CRUD endpoints are automatically generated inside a dedicated resource folder under your root path (e.g. /todos).

Generated endpoints are instantly active. If you already have a manual endpoint exactly duplicating a generated route (same method and path), the manual route will take precedence.

CRUD contract

For a resource with slug todos:

Method & pathDoesSuccess
GET /todosList records200 { data, meta }
POST /todosCreate a record201 { data }
GET /todos/:idFetch one200 { data }
PUT /todos/:idUpdate fields (full/partial)200 { data }
DELETE /todos/:idDelete permanently204 (no body)

Every success returns a { data } envelope (lists add meta); every failure returns { error: { code, message, details? } }. Records carry an integer id (sequential per resource), createdAt, and updatedAt. PUT/POST rejects unknown, immutable, and invalid fields. DELETE is permanent.

# Create
curl -X POST "https://<your-slug>.<host>/todos" \
  -H "Content-Type: application/json" \
  -d '{"title":"Buy milk","done":false}'

# Response: 201
{ "data": { "id": 1, "title": "Buy milk", "done": false,
            "createdAt": "2026-07-01T09:00:00.000Z",
            "updatedAt": "2026-07-01T09:00:00.000Z" } }
// JavaScript
const res = await fetch("https://<your-slug>.<host>/todos", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ title: "Buy milk", done: false }),
});
const { data } = await res.json();

Lists: pagination, sort, filter

  • page (default 1) and limit (default 20, max 100).
  • sort = one declared field; order = asc | desc (stable id tie-break).
  • Equality: filter[field]=value.
  • Operators: filter[field][gt|gte|lt|lte|ne]=value, cast by the field's declared type.
  • Only declared fields are filterable/sortable; unknown fields → validation_error.

Responses include meta = { page, limit, total, totalPages } and an X-Total-Count header.

curl "https://<your-slug>.<host>/todos?\
page=1&limit=20&sort=createdAt&order=desc&\
filter[done]=false&filter[priority][gte]=3"

Seed & Reset

Seed records give a resource starting data with stable integer IDs. Seeds reserve the low IDs, so the first created record continues from max(seed id) + 1.

Reset (accessible in the UI) deletes all live records for a resource, restores its seed records, and rewinds the ID counter. You can trigger a reset from the resource folder's context menu (the **...** menu in the endpoints tree) or by clicking **Reset to initial data** inside the **Data** tab of any generated endpoint.

CORS

CORS defaults to allow-all (*). You can configure individual CORS settings per generated endpoint in the editor's authentication settings. Preflight (OPTIONS) requests are handled automatically.

Limits

  • 25 resources per workspace, 50 fields per resource.
  • 10,000 live records per workspace.
  • 64 KiB per record.
  • At the record cap, create returns 409 quota_exceeded — no silent purge.
  • Abuse limits on generated reads/writes return 429 when exceeded.

Error taxonomy

CodeHTTPWhen
validation_error422Unknown/invalid field, bad type, missing required field, bad query.
not_found404No record with that id, or the resource/route does not exist.
conflict409A unique field value already exists.
quota_exceeded409The workspace record cap (10,000) is reached; no record is created.
rate_limited429Too many generated-route requests in a short window.
unauthorized401Reserved for simulated auth.
{ "error": { "code": "validation_error",
             "message": "Unknown field: colour",
             "details": { "field": "colour" } } }

Privacy & sensitive fields

Mark a field sensitive to keep its values out of the Request History (Inspector). Sensitive values are redacted from both the logged request and response bodies; the served response is unchanged. Redaction only protects your Inspector logs — it does not encrypt or hide data from API callers.

This is a mock. Never store real passwords, tokens, API keys, or personal data. Marking a field sensitive redacts logs; it is not a security boundary.

Ship your first resource

Declare a resource, add fields, and call it with the generated endpoints.

Open Endpoints