curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&order=id.desc&limit=20' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'No SDK,
Bearer トークンの上の PostgREST——ダッシュボード・MCP・Realtime と同じアイデンティティ。
SDK は永遠に不要
中身は PostgREST：予測可能な URL、標準フィルター、JSON の入出力。あなたの言語が HTTP リクエストを送れるなら、もう統合済みです。
思ったより広い
キャプチャしたトラフィックだけではありません。TestFlight 管理、課金、監査台帳、さらに BusyBro のセッションやメモリまで、同じ REST サーフェスから届きます。
一つのトークンをデータベースが執行
MCP や WebSockets と同じ OAuth トークンがここでも使え、Postgres の行レベルセキュリティが全レスポンスをロールにスコープします。「API がチェックを忘れた」は存在しません——データベース自体がチェックです。
ドキュメントで試す
ダッシュボード内の REST エクスプローラーは、あなた自身の権限で本物のリクエストを組み立てて実行し、ライブのレスポンスをインライン表示。見えているものが、コードが受け取るそのものです。
One host,
The API host is a custom domain onto the data plane itself — the dashboard has no private backend you're locked out of.
- 01
One host, five services
api.busymate.net fronts the whole platform: /rest/v1 (PostgREST over every table and RPC), /auth/v1, /realtime/v1, /functions/v1 and /storage/v1 — a custom domain straight onto the data plane.
- 02
Authenticate with the same token
The OAuth token from the MCP flow (or your dashboard session) goes in the Authorization header. One identity across every surface — there is no separate REST key.
- 03
Query with URL operators
PostgREST turns tables into endpoints: pick columns with select=, filter with eq/gte/like/in, then order, limit and offset — all in the query string.
- 04
The database authorizes
Row-level security scopes every response to your role and ownership. You can't forget a permission check in a client — the check lives in Postgres itself.
Tables, RPCs and
A sample of what's addressable — the in-dashboard REST explorer documents every endpoint with a runnable request.
/rest/v1/devicesGETYour paired devices — identity, platform, last-seen, and the computed live online state (effective_online).
/rest/v1/entriesGETCaptured request/response rows — the same feed the dashboard renders, filterable by host, path, method and status class.
/rest/v1/breakpoint_eventsGETRequests the proxy is holding at a breakpoint right now, with kind, timing and outcome.
/rest/v1/todosCRUDThe shared to-do board — full create/read/update/delete, the same rows every other surface shows.
/rest/v1/settings_global · settings_device · settings_userCRUDThe layered settings tiers the capture stack folds together — write any tier, devices pick it up live.
/rest/v1/rpc/effective_settings_for_deviceRPCPostgres functions as POST endpoints: the server-folded settings union, filtered entry counts, device-control locks, egress-IP control and more.
/functions/v1/*EdgeEdge Functions — device pairing, capture ingest, the MCP server itself, and BusyBro's ask endpoint.
/auth/v1 · /realtime/v1 · /storage/v1platformSessions and refresh, the WebSocket upgrade for live channels, and file storage — the same host serves all of it.
Copy, paste,
Real endpoints, real filters — a table query with PostgREST operators and an RPC call.
# Server errors on one host in your captures, newest first
curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&host=eq.api.example.com&payload->>statusCode=like.5__&order=id.desc&limit=50' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'# The settings a device actually runs — the server-folded union of every tier
curl -X POST 'https://api.busymate.net/rest/v1/rpc/effective_settings_for_device' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>' \
-H 'Content-Type: application/json' \
-d '{"target_uuid":"<device-uuid>"}'From capture to
Assert traffic in CI
Fail a pipeline when a test run's captured traffic contains server errors, an unexpected host, or a call that should have been cached.
Pull captures into your tools
It's JSON over HTTP — notebooks, BI dashboards and log pipelines ingest it directly, or export standard HAR for HAR-speaking tooling.
Automate the back office
Create to-dos, flip settings tiers, manage devices from scripts and cron jobs — the same writes the dashboard makes, callable from anywhere.
The same rows,
Every capability aligns across the dashboard, MCP, REST, WebSockets and BusyBro — a standing rule, checked on every ship. Pick the surface that fits the job; the data and permissions are identical.
Before you
Is there an SDK?
You don't need one — it's PostgREST, so any HTTP client works on day one. If you want a client library, supabase-js speaks the whole surface (REST, auth and realtime) out of the box.
How do I authenticate?
With the same OAuth 2.1 token the MCP flow issues: send it as Authorization: Bearer. One token authenticates MCP, REST, WebSockets and Edge Functions.
How do filtering and pagination work?
Standard PostgREST grammar: shape columns with select=, filter with operators like eq, neq, gte, like and in, then order=, limit= and offset= (or Range headers) for paging.
Can I export captured traffic?
Filter the entries table down to exactly the rows you want as JSON, or export a standard HAR file — from the dashboard or the export_har MCP tool — for Charles- and Proxyman-compatible tooling.
What stops me reading someone else's data?
Row-level security. Every table carries policies that scope rows to your ownership and role — the same rules the dashboard runs under, enforced by Postgres on every query.
Is api.busymate.net really the database?
It's a custom domain onto the platform's Supabase project — and that's the point: the dashboard is built on the same public primitives you can call directly. No private API you're locked out of.
Build on
認証・テーブル・Edge Functions はドキュメントに——あるいはダッシュボード内エクスプローラーからリクエストを。