API · 2 of 3
REST endpoints
Enable with OXIDB_HTTP_PORT=8080. JSON in, JSON out, CORS-friendly.
Endpoint summary
| Method | Path | Purpose |
|---|---|---|
| GET | /api/procedures | List procedure names |
| POST | /api/procedures | Create from OxiScript or raw JSON |
| POST | /api/procedures/<name>/call | Call a procedure |
| DELETE | /api/procedures/<name> | Remove a procedure |
List
curl http://localhost:8080/api/procedures
{"ok": true, "data": ["hi", "transfer", "place_order"]}
Create from OxiScript
curl -X POST http://localhost:8080/api/procedures \
-H "Content-Type: application/json" \
-d '{
"name": "transfer",
"script": "proc transfer(from, to, amount) { let s = find_one(\"accounts\", {_id: from}) if s.balance < amount { abort \"insufficient funds\" } update(\"accounts\", {_id: from}, {$inc: {balance: -amount}}) update(\"accounts\", {_id: to}, {$inc: {balance: amount}}) return {ok: true} }"
}'
Create from raw JSON definition
curl -X POST http://localhost:8080/api/procedures \
-H "Content-Type: application/json" \
-d '{
"name": "noop",
"params": [],
"steps": [{"step": "return", "value": {"ok": true}}]
}'
Call
curl -X POST http://localhost:8080/api/procedures/transfer/call \
-H "Content-Type: application/json" \
-d '{"from":"alice","to":"bob","amount":1500}'
{"ok": true, "data": {"ok": true}}
Call returns the abort error
curl -X POST http://localhost:8080/api/procedures/transfer/call \
-d '{"from":"empty","to":"bob","amount":1}'
# → 400 Bad Request
# {"ok": false, "error": "insufficient funds"}
Delete
curl -X DELETE http://localhost:8080/api/procedures/transfer
JS / fetch example
async function callProcedure(name, params) {
const r = await fetch(`http://localhost:8080/api/procedures/${name}/call`, {
method: "POST",
headers: {"Content-Type": "application/json"},
body: JSON.stringify(params)
})
return r.json()
}
const result = await callProcedure("transfer", {
from: "alice", to: "bob", amount: 1500
})
CORS: the REST handler sends permissive CORS headers, so you can call procedures from any browser origin out of the box. For production, front it with a reverse proxy that locks origins down.