API Reference

Auto-generated from your schema. Try requests inline; scopes come from the tokens dashboard.

← Schema browseropenapi.json
GraphQL: POST /graphql/v1 — same auth, RLS appliedPrometheus: GET /metrics — text exposition, no authRealtime: WS /rt/v1 — see the Realtime dashboard

Endpoint reference

All routes are served under {VITE_PLUTO_URL} (same-origin via /api/pluto/* proxy). Auth: send Authorization: Bearer <access_token> + apikey: <VITE_PLUTO_ANON_KEY>. Admin routes additionally require a session with is_superadmin=true (or a service-role key).

Health

  • GET/livez— Liveness probe
  • GET/readyz— Readiness — DB + JWT
  • GET/health/migrations— Applied migrations ledger

Auth

  • POST/auth/v1/signup— Email + password sign-up
  • POST/auth/v1/token— Password / refresh grant
  • POST/auth/v1/recover— Send password reset email
  • POST/auth/v1/verify— Verify email OTP
  • POST/auth/v1/logout— Revoke current session

Admin · Users

super_admin
  • GET/admin/v1/users— List users (500 most recent)
  • PATCH/admin/v1/users/:id— Update role / is_superadmin / email_verified
  • DELETE/admin/v1/users/:id— Delete a user (cannot delete self)

Admin · Projects & Keys

super_admin
  • GET/admin/v1/projects— List projects
  • POST/admin/v1/projects— Create project
  • GET/admin/v1/projects/:id/members— List members
  • POST/admin/v1/projects/:id/members— Add member (owner/admin/developer/viewer)
  • GET/admin/v1/projects/:id/keys— List API keys
  • POST/admin/v1/projects/:id/keys— Mint API key
  • POST/admin/v1/projects/:id/keys/:keyId/rotate— Rotate API key

Admin · Audit & Studio

  • GET/admin/v1/audit— Paginated audit events
  • GET/admin/v1/studio/tables?schema=…— List tables in a schema
  • GET/admin/v1/studio/columns?schema=…&table=…— Columns + FK + PK
  • GET/admin/v1/settings— Feature flags

Storage

  • GET/storage/v1/bucket— List buckets
  • POST/storage/v1/bucket— Create bucket
  • POST/storage/v1/object/:bucket/*— Upload object
  • GET/storage/v1/object/:bucket/*— Download object
  • DELETE/storage/v1/object/:bucket/*— Delete object

Data API (REST)

  • GET/rest/v1/:table?select=*— Select rows (PostgREST-compatible)
  • POST/rest/v1/:table— Insert rows
  • PATCH/rest/v1/:table?id=eq.…— Update rows
  • DELETE/rest/v1/:table?id=eq.…— Delete rows

Jobs & Functions

  • GET/jobs/v1/tokens— List job tokens
  • POST/jobs/v1/tokens— Mint job token
  • GET/functions/v1/list— List edge functions
  • POST/functions/v1/:slug— Invoke edge function
Not yet on the backend (returns 404 today)
  • /admin/v1/stats, /admin/v1/workspaces, /admin/v1/integrations/health
  • /admin/v1/sql/history, /admin/v1/cors/origins, /admin/v1/rate-limits
  • /ai/v1/*, /queue/v1/*, /templates/v1, /push/v1/*
  • /auth/v1/sso/providers, WS system:audit / system:migrations