curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&order=id.desc&limit=20' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'No SDK,
Bearer 토큰 위의 PostgREST — 대시보드, MCP, Realtime과 같은 아이덴티티.
SDK는 영원히 불필요
안에는 PostgREST가 있습니다: 예측 가능한 URL, 표준 필터, JSON 입출력. 여러분의 언어가 HTTP 요청을 보낼 수 있다면 이미 통합된 상태입니다.
생각보다 넓은 범위
캐처된 트래픽만이 아닙니다. TestFlight 관리, 과금, 감사 장부, 심지어 BusyBro의 세션과 메모리까지 같은 REST 표면으로 접근할 수 있습니다.
토큰 하나, 데이터베이스가 집행
MCP와 WebSockets에 쓰는 같은 OAuth 토큰이 여기서도 동작하고, Postgres 행 수준 보안이 모든 응답을 여러분의 역할로 제한합니다. “API가 검사를 깜밖했다”는 없습니다 — 데이터베이스 자체가 검사입니다.
문서에서 직접 시도
대시보드 내 REST 익스플로러는 여러분의 권한으로 실제 요청을 만들어 보내고 라이브 응답을 인라인으로 보여줍니다. 보이는 그대로가 코드가 받을 그것입니다.
One host,
The API host is a custom domain onto the data plane itself — the dashboard has no private backend you're locked out of.
- 01
One host, five services
api.busymate.net fronts the whole platform: /rest/v1 (PostgREST over every table and RPC), /auth/v1, /realtime/v1, /functions/v1 and /storage/v1 — a custom domain straight onto the data plane.
- 02
Authenticate with the same token
The OAuth token from the MCP flow (or your dashboard session) goes in the Authorization header. One identity across every surface — there is no separate REST key.
- 03
Query with URL operators
PostgREST turns tables into endpoints: pick columns with select=, filter with eq/gte/like/in, then order, limit and offset — all in the query string.
- 04
The database authorizes
Row-level security scopes every response to your role and ownership. You can't forget a permission check in a client — the check lives in Postgres itself.
Tables, RPCs and
A sample of what's addressable — the in-dashboard REST explorer documents every endpoint with a runnable request.
/rest/v1/devicesGETYour paired devices — identity, platform, last-seen, and the computed live online state (effective_online).
/rest/v1/entriesGETCaptured request/response rows — the same feed the dashboard renders, filterable by host, path, method and status class.
/rest/v1/breakpoint_eventsGETRequests the proxy is holding at a breakpoint right now, with kind, timing and outcome.
/rest/v1/todosCRUDThe shared to-do board — full create/read/update/delete, the same rows every other surface shows.
/rest/v1/settings_global · settings_device · settings_userCRUDThe layered settings tiers the capture stack folds together — write any tier, devices pick it up live.
/rest/v1/rpc/effective_settings_for_deviceRPCPostgres functions as POST endpoints: the server-folded settings union, filtered entry counts, device-control locks, egress-IP control and more.
/functions/v1/*EdgeEdge Functions — device pairing, capture ingest, the MCP server itself, and BusyBro's ask endpoint.
/auth/v1 · /realtime/v1 · /storage/v1platformSessions and refresh, the WebSocket upgrade for live channels, and file storage — the same host serves all of it.
Copy, paste,
Real endpoints, real filters — a table query with PostgREST operators and an RPC call.
# Server errors on one host in your captures, newest first
curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&host=eq.api.example.com&payload->>statusCode=like.5__&order=id.desc&limit=50' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'# The settings a device actually runs — the server-folded union of every tier
curl -X POST 'https://api.busymate.net/rest/v1/rpc/effective_settings_for_device' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>' \
-H 'Content-Type: application/json' \
-d '{"target_uuid":"<device-uuid>"}'From capture to
Assert traffic in CI
Fail a pipeline when a test run's captured traffic contains server errors, an unexpected host, or a call that should have been cached.
Pull captures into your tools
It's JSON over HTTP — notebooks, BI dashboards and log pipelines ingest it directly, or export standard HAR for HAR-speaking tooling.
Automate the back office
Create to-dos, flip settings tiers, manage devices from scripts and cron jobs — the same writes the dashboard makes, callable from anywhere.
The same rows,
Every capability aligns across the dashboard, MCP, REST, WebSockets and BusyBro — a standing rule, checked on every ship. Pick the surface that fits the job; the data and permissions are identical.
Before you
Is there an SDK?
You don't need one — it's PostgREST, so any HTTP client works on day one. If you want a client library, supabase-js speaks the whole surface (REST, auth and realtime) out of the box.
How do I authenticate?
With the same OAuth 2.1 token the MCP flow issues: send it as Authorization: Bearer. One token authenticates MCP, REST, WebSockets and Edge Functions.
How do filtering and pagination work?
Standard PostgREST grammar: shape columns with select=, filter with operators like eq, neq, gte, like and in, then order=, limit= and offset= (or Range headers) for paging.
Can I export captured traffic?
Filter the entries table down to exactly the rows you want as JSON, or export a standard HAR file — from the dashboard or the export_har MCP tool — for Charles- and Proxyman-compatible tooling.
What stops me reading someone else's data?
Row-level security. Every table carries policies that scope rows to your ownership and role — the same rules the dashboard runs under, enforced by Postgres on every query.
Is api.busymate.net really the database?
It's a custom domain onto the platform's Supabase project — and that's the point: the dashboard is built on the same public primitives you can call directly. No private API you're locked out of.