​
Tables and resources

Your data is stored in ordinary database tables. To make a table available to your app, you give it a resource. A resource is a small definition that sits on top of the table and says:
  • what the columns are and what each may contain,
  • which of five operations are available, and who may do each,
  • how records relate to each other,
  • extra behaviour: ids, timestamps, owner, events, realtime, caching, rate limits.
In Studio, the Data sidebar lists every table. One tagged resource is served as an API. A table without a resource exists but is reachable only from Studio and with a secret key.

​
The five operations

Each resource has these operations. Each can be switched on or off and has its own access rule. If an operation is off, the API answers as if it doesn’t exist. If every operation is off, the table isn’t served at all.

​
One request, step by step

  1. Your app calls pawabase.from("tasks").eq("done", false). The client adds your API key and the signed-in person’s token.
  2. The gateway refuses calls that break your API access settings, such as a website or address that isn’t allowed, or a key outside its limits. See Environment settings.
  3. Authentication reads the token: who is calling, their roles, organization, assurance level.
  4. The access rule for list on tasks is evaluated. For a list, simple rules (such as “the owner column equals the caller”) become part of the database query, so only allowed rows are even read.
  5. The query runs with your filters, sort and page.
  6. The response is shaped: write-only columns are removed, and only the fields your app asked for (or all) are returned.
  7. Side effects (for writes): events are emitted, subscribers run, realtime is told.
Because step 4 is on the server, hiding a button never protects data. The rule does.

​
What every record has

​
Environments

Each environment (development, production, previews) has its own database. A definition lives in one environment. You build in development, then promote definitions to production. Data never moves unless you export and import it.

​
Definitions are data

Resources, access rules, relations and routes are stored as JSON, which is why Studio can edit them visually and why they can be promoted from one environment to another.

​
Mapping to your own words

Tables and resources

Create and manage them.

Access

Operations and rules.