curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&order=id.desc&limit=20' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'No SDK,
PostgREST over a Bearer token — the same identity as dashboard, MCP, and Realtime.
No SDK, ever
It's PostgREST underneath: predictable URLs, standard filters, JSON in and out. If your language can make an HTTP request, it's already integrated.
Wider than you think
It's not just captured traffic. TestFlight admin, billing, the audit ledger, even BusyBro's sessions and memories are all reachable over the same REST surface.
One token, enforced by the database
The same OAuth token you use for MCP and WebSockets works here, and Postgres row-level security scopes every response to your role. There's no 'the API forgot to check' — the database is the check.
Try it in the docs
The in-dashboard REST explorer builds and fires real requests with your own permissions and renders the live response inline. What you see is exactly what your code will get.
One host,
The API host is a custom domain onto the data plane itself — the dashboard has no private backend you're locked out of.
- 01
One host, five services
api.busymate.net fronts the whole platform: /rest/v1 (PostgREST over every table and RPC), /auth/v1, /realtime/v1, /functions/v1 and /storage/v1 — a custom domain straight onto the data plane.
- 02
Authenticate with the same token
The OAuth token from the MCP flow (or your dashboard session) goes in the Authorization header. One identity across every surface — there is no separate REST key.
- 03
Query with URL operators
PostgREST turns tables into endpoints: pick columns with select=, filter with eq/gte/like/in, then order, limit and offset — all in the query string.
- 04
The database authorizes
Row-level security scopes every response to your role and ownership. You can't forget a permission check in a client — the check lives in Postgres itself.
Tables, RPCs and
A sample of what's addressable — the in-dashboard REST explorer documents every endpoint with a runnable request.
/rest/v1/devicesGETYour paired devices — identity, platform, last-seen, and the computed live online state (effective_online).
/rest/v1/entriesGETCaptured request/response rows — the same feed the dashboard renders, filterable by host, path, method and status class.
/rest/v1/breakpoint_eventsGETRequests the proxy is holding at a breakpoint right now, with kind, timing and outcome.
/rest/v1/todosCRUDThe shared to-do board — full create/read/update/delete, the same rows every other surface shows.
/rest/v1/settings_global · settings_device · settings_userCRUDThe layered settings tiers the capture stack folds together — write any tier, devices pick it up live.
/rest/v1/rpc/effective_settings_for_deviceRPCPostgres functions as POST endpoints: the server-folded settings union, filtered entry counts, device-control locks, egress-IP control and more.
/functions/v1/*EdgeEdge Functions — device pairing, capture ingest, the MCP server itself, and BusyBro's ask endpoint.
/auth/v1 · /realtime/v1 · /storage/v1platformSessions and refresh, the WebSocket upgrade for live channels, and file storage — the same host serves all of it.
Copy, paste,
Real endpoints, real filters — a table query with PostgREST operators and an RPC call.
# Server errors on one host in your captures, newest first
curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&host=eq.api.example.com&payload->>statusCode=like.5__&order=id.desc&limit=50' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'# The settings a device actually runs — the server-folded union of every tier
curl -X POST 'https://api.busymate.net/rest/v1/rpc/effective_settings_for_device' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>' \
-H 'Content-Type: application/json' \
-d '{"target_uuid":"<device-uuid>"}'From capture to
Assert traffic in CI
Fail a pipeline when a test run's captured traffic contains server errors, an unexpected host, or a call that should have been cached.
Pull captures into your tools
It's JSON over HTTP — notebooks, BI dashboards and log pipelines ingest it directly, or export standard HAR for HAR-speaking tooling.
Automate the back office
Create to-dos, flip settings tiers, manage devices from scripts and cron jobs — the same writes the dashboard makes, callable from anywhere.
The same rows,
Every capability aligns across the dashboard, MCP, REST, WebSockets and BusyBro — a standing rule, checked on every ship. Pick the surface that fits the job; the data and permissions are identical.
Before you
Is there an SDK?
You don't need one — it's PostgREST, so any HTTP client works on day one. If you want a client library, supabase-js speaks the whole surface (REST, auth and realtime) out of the box.
How do I authenticate?
With the same OAuth 2.1 token the MCP flow issues: send it as Authorization: Bearer. One token authenticates MCP, REST, WebSockets and Edge Functions.
How do filtering and pagination work?
Standard PostgREST grammar: shape columns with select=, filter with operators like eq, neq, gte, like and in, then order=, limit= and offset= (or Range headers) for paging.
Can I export captured traffic?
Filter the entries table down to exactly the rows you want as JSON, or export a standard HAR file — from the dashboard or the export_har MCP tool — for Charles- and Proxyman-compatible tooling.
What stops me reading someone else's data?
Row-level security. Every table carries policies that scope rows to your ownership and role — the same rules the dashboard runs under, enforced by Postgres on every query.
Is api.busymate.net really the database?
It's a custom domain onto the platform's Supabase project — and that's the point: the dashboard is built on the same public primitives you can call directly. No private API you're locked out of.
Build on
Auth, tables, and Edge Functions in the docs — or fire requests from the in-dashboard explorer.