API Maker v4.0.0

API Maker v4 keeps the APIs, the admin panel and the Git repositories of version 3, on a new engine : versions 1 to 3 were built in Node.js, this one is built in Rust.

25Features 14Improvements 6Breaking changes

Upgrade from v3 Install on a server Run on your computer

Features¶

The engine

API Maker is rebuilt in Rust. The server is one program and runs as one process, using every CPU core. No worker processes to start or balance. One process, every core →
Your code in eight languages. Write custom APIs, hooks, schedulers, events, migrations, test cases and more in TypeScript or JavaScript (Node.js or Bun), Python, PHP, C#, Go, Rust, Java or Kotlin. One account can mix languages ; an API and its hooks use one language. Languages and runtimes →
Packages for every language. npm, PyPI, Packagist, NuGet, Go modules, crates.io and Maven Central. Each language has its own packages, version and Docker image. Sandbox settings →
Languages for native code, from the panel. Sandbox Settings installs the versions of each language your native code needs (runOnNativeProcess) on every server, checked against the publisher's checksum. Each admin chooses the version its own native code runs on. Native languages →
Bytes as the answer, in every language. Code which returns bytes answers with a file, a picture or a PDF as it is, under the content type and headers it sets. Bytes as the answer →

Security and AI

APIs Security Report & Actions. Finds where a person could reach data that is not theirs and gives the account a score out of 100. It reads your code too, in all eight languages : secrets in code, password columns returned, owners taken from the body. Most findings have a one-click fix, and the report is kept in Git. APIs Security Report →
AGENTS.md for AI agents. Every commit writes AGENTS.md in the account repository : a guide for Codex, Claude Code, Cursor and Copilot on where things are, how to write code and how to fix security findings. Your own text around it stays. AGENTS.md in your repository →

Data and databases

Table designer. Create and change tables and collections in the admin panel, on all six databases : columns, keys, indexes and checks. You see the statements before they run, and the schema of the table follows the change. Table designer →
Panel changes recorded in migration scripts. Tables, databases and indexes you create, change or delete in the admin panel can be recorded into a migration script, so every environment makes the same change when it deploys. Recorded from the panel →
Vector, JSON and other column types. Vectors, JSON, bytes, shapes, intervals and arrays work as plain JSON in every API, on all six databases. Data types →
Automatic indexes. Turn on the automatic mode of Index Maker : it finds the slow or frequent queries of your APIs which use no index, and creates the index. Each index goes into the migration script am_index_maker, so every environment gets it on its next deploy. Automatic indexes →
Indexes from your code. g.sys.system.createIndexes, dropIndexes and getIndexes create, drop and list indexes the same way on all six databases. Create indexes →
Import & Export. Export a table, a database or a whole instance into one file, and import it into any instance of the same kind, on all six databases. The files are made by the database's own programs (mongodump, pg_dump, mysqldump, SqlPackage, Data Pump), so they also restore by hand. Before an import, the file is compared with the database of now, and you choose what each table becomes : replace, merge, keep or remove. Import & Export →
Automatic Backup. Plans back the databases up on schedules into Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, MinIO or any store which speaks S3 : encrypted, at the least priority of the server, the old backups removed by your rules. A restore is one click : compared with the database of now, chosen table by table, checked after. Automatic Backup →

Build and ship

SSR websites. Websites in TSX, rendered by API Maker next to your data : file routing, layouts, forms with CSRF protection, sign-in, page cache and SEO. SSR websites →
API Maker Launchpad. A free desktop app for macOS, Windows and Linux. It runs API Maker and its databases on your computer, and installs API Maker on your servers over SSH. Run on your computer →
Upgrade from v3 with the Launchpad. Its V3 to V4 Migration page checks a v3 server, moves it to v4 in place with its data and secrets, and rolls back if a step fails. Upgrade from v3 →
Schedulers on every server. A scheduler can run on every server of the installation at each moment : once per server, or once per runner for the most work done at once. Run on every server →
Locks. g.sys.system.getLock and releaseLock let one run at a time (or a few) do what a lock guards, on every server and in every runner, in all eight languages. A lock frees itself when its time is over. Locks →

Developer tools

IDE. Every file of your account's code in one editor in the admin panel : an explorer of the repository, search in all files, go to file, tabs, go to definition in every language, and the Git history of each file with its lines annotated. IDE →
Debugging in every language. Stop custom APIs, hooks, schedulers and utility classes at breakpoints, see variables and the call stack, and step through the code, in all eight languages. It works in sandboxes and on the native process, with nothing to install. Debugging →
Typed rows without interfaces. A g.sys.db call knows the table it reads : the editor suggests its columns in your query and on the rows it returns, in every language. No interface to write first. The code editor →
Code coverage in your IDE. npm run test in the local client runs the test cases and shows which lines ran, in every language, in VS Code and WebStorm. Code coverage in your IDE →
Speed and traffic in every list. The lists of custom APIs, tables, system APIs, schedulers and events show how fast each one answers, how often it is called and how often it fails. Click a number to see its chart.
A team on one sync token. Several developers sync one account at the same time from their editors, each with the local client and the same sync token : what one saves reaches the others within a second, each line of their terminals says who made the change, and the bar of the admin panel shows who is connected. Several developers, one sync token →

Improvements¶

One port. APIs and web sockets share one port (port). wsPort is no longer used. Behind Caddy nothing changes.
The admin panel comes with API Maker. API Maker serves it on its own port (adminPanel.port) ; the api_maker_fe service is gone.
All MongoDB query operators in find. $nor, $not, $exists, $type, $mod, $regex, $all, $elemMatch, $size, bitwise, geospatial, $expr, $text, $where, $jsonSchema and array positions ("orders.0.qty") work as in MongoDB. On SQL databases, the ones a table supports are turned into SQL, and several operators on one field ({ "$gte": 1, "$lte": 9 }) work too. find →
$slice and $elemMatch in select. On MongoDB, { "orders": { "$slice": -3 } } returns the last 3 orders, and { "orders": { "$elemMatch": { "status": "PAID" } } } the first paid one. Before, the whole array came back. select →
Index Maker redesigned. A summary of every scanning period, suggestions you add to the script in one click, and an index form which says which fields can be indexed. Its tab in API Testing shows every database call of a run on a timeline. Indexes also work on Oracle and SQL Server tables with mixed-case names. Index Maker →
Local client. localClient.js runs on its own, with nothing to install first, and syncs your files both ways. Your own editor →
The local client connects encrypted. It speaks inside the encrypted channel of the admin panel and proves the sync token without sending it ; the server proves it in its turn. The token never shows in a URL or a log of a proxy, and the local client writes inside its own folder only. A channel nobody can read →
The SSR preview reloads by itself everywhere. Beside the editor and in tabs of its own, after a save in the panel, in your editor or by a git pull, a page which failed too. Only the tab you look at keeps a connection to the server, and a website which is off still shows in its preview. The preview →
Git status ignores whitespace at line ends. A file whose lines differ only by spaces, tabs or Windows line endings at their ends is not listed as changed.
Tokens across admin users, for your users too. The root setting Allow API Maker User's Token Across Admin Users also covers the tokens of your users (x-am-user-authorization). Auth of database user →
Docker tab for admin users. The Analytics dashboard shows each admin user the Docker containers of their sandboxes, with live stats and a safe prune. Each container shows the logo of its language and runtime.
Sandboxes on every server, and on each one. How many sandboxes each language of an account runs is automatic (one sandbox, whose runners grow to the CPU cores of the server), or what the account sets for every server or for one server. Idle sandboxes go after the minutes the account sets, or never. A change is followed at once : no sandbox starts anew for it. Sandboxes on the servers →
Sandbox Settings in four tabs. Languages, Images and sandboxes, Import & Export Tools and Allowed Origins : a tab with changes not saved yet is marked, and the address opens the tab it names. The tools tab finds by itself the version of each tool the server runs now, a version a job installed or the program of its PATH, and the Import & Export dialog checks it again when a job ends. The tabs →
Deployment hooks checked before saving. The hook URL and the access token take letters, digits and _ only, and the form says so before you save. Deployment hooks →

Breaking changes¶

Read these before you move a server of v3 to v4. Upgrade from v3 →

null in find on SQL means IS NULL. { "deleted_at": null } returns rows without a value, and { "$ne": null } rows with one. Before, they matched no rows. This also applies to update many and remove by query. $regex on SQL is now a regular expression ; only a pattern with % at an end is still read as $like.
$like on MongoDB works as in SQL. "Bob%" matches names starting with Bob, "%Bob" names ending with it ; before, MongoDB had them the other way round. _ is any one character, and a pattern without % must match the whole value. This applies to every API that takes find. Swap the % in old filters, or use $regex. find →
$or and $nin with nothing to match. A $or condition that matches no row no longer empties the whole result. $nin of an empty array returns every row, as in MongoDB.
Sandboxes install only what you add. A package your code imports must be listed for its language in Sandbox settings. Packages →
No sandbox count in the .env file. sandbox.sandboxCountForAdmin is read no more : each account is Auto unless its Sandbox settings say otherwise, one sandbox of each language whose runners grow to the cores of the server, where 2 sandboxes started before. The count of a v3 account (sandboxCountOverrideAdmin) still holds until the account saves its own. removeSandboxInactiveSinceMinutes: 0 keeps idle sandboxes, as in v3. Sandboxes on the servers →
Deprecated parts removed. UI Maker (DB masters), the AM Store, third party APIs and notes are gone.