API · 2 of 3

REST endpoints

Enable with OXIDB_HTTP_PORT=8080. JSON in, JSON out, CORS-friendly.

Endpoint summary

MethodPathPurpose
GET/api/proceduresList procedure names
POST/api/proceduresCreate from OxiScript or raw JSON
POST/api/procedures/<name>/callCall a procedure
DELETE/api/procedures/<name>Remove a procedure

List

curl http://localhost:8080/api/procedures
{"ok": true, "data": ["hi", "transfer", "place_order"]}

Create from OxiScript

curl -X POST http://localhost:8080/api/procedures \
  -H "Content-Type: application/json" \
  -d '{
    "name": "transfer",
    "script": "proc transfer(from, to, amount) { let s = find_one(\"accounts\", {_id: from}) if s.balance < amount { abort \"insufficient funds\" } update(\"accounts\", {_id: from}, {$inc: {balance: -amount}}) update(\"accounts\", {_id: to}, {$inc: {balance: amount}}) return {ok: true} }"
  }'

Create from raw JSON definition

curl -X POST http://localhost:8080/api/procedures \
  -H "Content-Type: application/json" \
  -d '{
    "name": "noop",
    "params": [],
    "steps": [{"step": "return", "value": {"ok": true}}]
  }'

Call

curl -X POST http://localhost:8080/api/procedures/transfer/call \
  -H "Content-Type: application/json" \
  -d '{"from":"alice","to":"bob","amount":1500}'
{"ok": true, "data": {"ok": true}}

Call returns the abort error

curl -X POST http://localhost:8080/api/procedures/transfer/call \
  -d '{"from":"empty","to":"bob","amount":1}'
# → 400 Bad Request
# {"ok": false, "error": "insufficient funds"}

Delete

curl -X DELETE http://localhost:8080/api/procedures/transfer

JS / fetch example

async function callProcedure(name, params) {
  const r = await fetch(`http://localhost:8080/api/procedures/${name}/call`, {
    method: "POST",
    headers: {"Content-Type": "application/json"},
    body: JSON.stringify(params)
  })
  return r.json()
}

const result = await callProcedure("transfer", {
  from: "alice", to: "bob", amount: 1500
})
CORS: the REST handler sends permissive CORS headers, so you can call procedures from any browser origin out of the box. For production, front it with a reverse proxy that locks origins down.
Report Issue