REST API reference

Every entity you create gets a REST API with no code to write. This page is the reference for it: where requests go, how they authenticate, what each record endpoint takes and returns, and what comes back when something goes wrong. For a walkthrough with a worked example, start with Call the instant REST API.

The request and response bodies are JSON, and every property name is snake_case.

Base URL and project ID

Every endpoint lives under your project:

https://api.my.anythink.cloud/org/{project_id}

Your project ID is the number after /org/ in the dashboard address. Every path on this page is relative to that base URL, so GET /entities/orders/items means GET https://api.my.anythink.cloud/org/{project_id}/entities/orders/items.

Entity names are the lower-case names you gave your entities in the data model, such as orders. They appear in the path exactly as written there.

Authenticate requests

Every endpoint needs credentials except the public record endpoints, the sign-in endpoints and public search. Send one of two things:

GET /org/{project_id}/entities/orders/items
Authorization: Bearer eyJhbGciOiJIUzI1NiIs…

GET /org/{project_id}/entities/orders/items
x-api-key: ak_your_key_here

Put the API key in the x-api-key header, not in Authorization. Never ship a key in a browser or mobile app.

What each permission allows

Authentication says who is calling. Permissions say what they may do. Each entity has four permissions, named {entity}:{action}, and every record endpoint checks one of them:

A user gets permissions from their role, and an API key carries the permissions picked when it was created. A caller without the permission gets 403 Forbidden. On top of permissions, Groups and row-level security decides which individual records a caller can see or change, and field-level security can hide fields. See Roles and permissions.

Platform features use their own permissions in the same pattern, for example anythink_files:read for files, anythink_workflows:trigger for running a workflow and anythink_documentation:read for the API Docs.

Record endpoints

These nine endpoints exist for every entity. Replace {entity} with the entity name.

The examples below use an orders entity with the fields reference, total, status and placed_on.

Try a request

anythink data list orders --limit 10 --filter 'status=paid&total=GTE:10'
anythink data get orders 3
anythink fetch "/entities/orders/items?status=paid&fields=reference,total"

Show me the five most expensive paid orders.

List records

GET /org/{project_id}/entities/orders/items?status=paid&sortBy=total&sortDirection=desc&page=1&pageSize=2&fields=reference,total

{
  "items": [
    { "locked": false, "id": 3, "reference": "A-3", "total": 30, "__name": "A-3" },
    { "locked": false, "id": 1, "reference": "A-1", "total": 10.5, "__name": "A-1" }
  ],
  "page": 1,
  "page_size": 2,
  "total_items": 3,
  "total_pages": 2,
  "has_next_page": true,
  "has_previous_page": false,
  "retrieval_time": 6
}

retrieval_time is how long the query took, in milliseconds.

pageSize, sortBy and sortDirection are camel case in the query string, even though the JSON is snake case. An out-of-range value returns 400 with a message such as 'pageSize' must be between 1 and 1000.

Filter records

Add the field name and a value to the query string. A bare value means equals. Put an operator before the value for anything else. Filters on different fields combine with AND.

To put two conditions on one field, separate them with a comma: total=GTE:6,LT:30 means 6 or more and under 30.

Dates take yyyy-MM-dd, a full timestamp or a Unix time in seconds. Booleans take true or false. A filter on a field the entity doesn't have is ignored, so a misspelt field name returns unfiltered records. Check a surprising total first.

To limit a read to one group's records, add group_scope={group_id}. The caller needs a role in that group that allows reading its data. See Groups and row-level security.

Choose fields

By default a record has every field you can read, plus these:

Pass fields to cut the response down. id, locked and __name always come back. created_at and updated_at come back only when you ask for them or leave fields out. Use fields=* to ask for everything explicitly.

GET /org/{project_id}/entities/orders/items/3?fields=reference

{ "locked": false, "id": 3, "reference": "A-3", "__name": "A-3" }

fields works on the single-record endpoint too. Relationship fields use dots; see Relationships in responses.

Get one record

GET /org/{project_id}/entities/orders/items/3

It returns the record on its own, without the paging wrapper. An unknown ID returns 404.

Create a record

Send the field values as a JSON object. Properties that aren't fields of the entity are ignored.

POST /org/{project_id}/entities/orders/items
Content-Type: application/json

{ "reference": "A-4", "total": 42, "status": "draft", "placed_on": "2026-10-04" }

{
  "locked": false,
  "id": 9,
  "created_at": "2026-10-04T13:42:54.807588Z",
  "updated_at": "2026-10-04T13:42:54.807588Z",
  "reference": "A-4",
  "total": 42,
  "status": "draft",
  "placed_on": "2026-10-04T00:00:00",
  "paid": false,
  "__name": "A-4"
}

The status is 201 Created, and the Location header points at the new record. id, created_at and updated_at are set for you. Creating a record also fires any workflow listening for a record-created event.

Create many records

Send an array. The response is an array of the records that were created, in the same shape as above.

POST /org/{project_id}/entities/orders/items/bulk
Content-Type: application/json

[
  { "reference": "B-1", "total": 5, "status": "draft" },
  { "reference": "B-2", "total": 6, "status": "paid" }
]

/items/import takes the same array but returns 204 No Content and no records. Use it to load data when you don't need the new IDs back.

Update a record

PUT changes only the fields you send. Fields you leave out keep their current values, so you don't need to send the whole record. There is no PATCH: it returns 405.

PUT /org/{project_id}/entities/orders/items/3
Content-Type: application/json

{ "status": "shipped" }

It returns 204 No Content. Read the record again if you need the new values. A locked record can't be updated or deleted: both return 400 Record is locked - no changes can be made. Lock or unlock a record with POST /entities/{entity}/items/{id}/set-lock-status?locked=true.

Delete records

DELETE /org/{project_id}/entities/orders/items/3

It returns 204 No Content, including when the record doesn't exist. To delete several, send the IDs as a JSON array:

POST /org/{project_id}/entities/orders/items/delete-many
Content-Type: application/json

[4, 5]

delete-many accepts POST or DELETE with that body and returns 204. Deleting a record that other records point to follows the relationship's deletion rule. See Connect entities with relationships.

Relationships in responses

When an entity has relationship fields, a record includes the related data under the field's name. What you get depends on the relationship type.

A list of orders where each order has a customer (many to one) looks like this by default:

{
  "locked": false,
  "id": 3,
  "reference": "A-3",
  "customer": {
    "id": 1,
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "__name": "Ada Lovelace"
  },
  "__name": "A-3"
}

And the customers list, where each customer has many orders:

{
  "id": 1,
  "name": "Ada Lovelace",
  "orders": {
    "__count": 2,
    "__data": [
      { "id": 3, "__name": "A-3", "customer": 1 },
      { "id": 7, "__name": "A-7", "customer": 1 }
    ]
  }
}

By default a many-to-one or one-to-one field comes back fully expanded, while a one-to-many or many-to-many field comes back with each related record's id and __name only. Use fields to change either.

Expansion follows relationships up to four levels deep and never visits the same relationship twice on one path. The related records you get back are filtered by the caller's permissions and row-level security, just like top-level records, so two callers can see different __data for the same record. To model relationships, see Connect entities with relationships.

Read public records

An entity marked public can be read without credentials:

Send page and pageSize on the list. These endpoints return only the fields you've marked public, and they take the same filter, sortBy, sortDirection and fields parameters as the authenticated list. For an entity that isn't public they return 404. Search has a public form too: GET /search/public.

Errors

Read the status code first. The body depends on where the error came from, so don't assume it's JSON.

The problem-details bodies carry a traceId. Log it with the request, because it's what support needs to find the failure.

A record that row-level security hides from the caller returns 404, the same as a record that doesn't exist.

Limits

Every response carries rate-limit headers:

Once the limit is reached, requests return 429 until the window passes:

{
  "error": "Rate limit exceeded",
  "message": "Too many requests. Limit: 2000 requests per minute",
  "retry_after": 60,
  "route_type": "org"
}

Wait retry_after seconds, then retry. Loading many records? Use bulk or import rather than one request per record, and a larger pageSize rather than many small pages.

Other endpoints

The record endpoints are the part generated from your data model. The platform has fixed endpoints for the rest. Each links to the guide that covers it.

Search takes q for the query (everything when empty), e for a comma-separated list of entities to search, and page and pageSize (default 20). Each result carries __entity and __url, which points at the record's endpoint.

Payment value lists

GET /enums returns the value lists behind AnythinkPay's dropdowns, so your app can label them without hard-coding. It needs anythink_entities:read. The response is an object keyed by list name, and each list is an array of { "value": "...", "label": "..." }:

anythink fetch /enums

The raw request:

GET /org/{project_id}/enums

{
  "payment_provider": [
    { "value": "stripe", "label": "Stripe" },
    { "value": "apple", "label": "Apple" }
  ]
}

The lists include payment_status, payment_provider, billing_interval, subscription_event_type, subscription_event_source and reward_status. Send the value to the API and show the label to people.

Your project's own API documentation

The dashboard documents your project's API from your current data model, so it includes the entities you created yesterday. Open API Docs in the sidebar. It has two tabs:

• Data Model API covers your entities: list, get, create, update and delete for each, with their request and response shapes.
• Anythink API covers the platform endpoints, such as sign-in, files, search, workflows, dashboards and integrations.

Each tab is an interactive page. Use the filter box to find an endpoint and Try it out to send a real request as the user you're signed in as.

The dashboard has no download button, but the same documents are available over the API. They are OpenAPI 3 documents, so you can feed them to a client generator or an API tool.

GET /org/{project_id}/docs
Authorization: Bearer eyJhbGciOiJIUzI1NiIs…

The response is a JSON object with two OpenAPI documents inside it: data_model_documentation for your entities, and module_documentation.anythink for the platform endpoints. Pull out the one you want and save it as a file. The caller needs the anythink_documentation:read permission.

Next steps