curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&order=id.desc&limit=20' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'No SDK,
PostgREST peste un token Bearer — aceeași identitate ca dashboardul, MCP și Realtime.
Fără SDK, niciodată
Dedesubt e PostgREST: URL-uri previzibile, filtre standard, JSON la intrare și la ieșire. Dacă limbajul tău poate face o cerere HTTP, e deja integrat.
Mai larg decât crezi
Nu e doar trafic capturat. Administrarea TestFlight, facturarea, registrul de audit, chiar și sesiunile și amintirile lui BusyBro sunt accesibile prin aceeași suprafață REST.
Un token, aplicat de baza de date
Același token OAuth pe care îl folosești pentru MCP și WebSockets merge și aici, iar row-level security din Postgres limitează fiecare răspuns la rolul tău. Nu există „API-ul a uitat verificarea” — baza de date este verificarea.
Încearcă-l în documentație
Exploratorul REST din dashboard construiește și lansează cereri reale cu propriile tale permisiuni și randează răspunsul live inline. Ce vezi e exact ce va primi codul tău.
One host,
The API host is a custom domain onto the data plane itself — the dashboard has no private backend you're locked out of.
- 01
One host, five services
api.busymate.net fronts the whole platform: /rest/v1 (PostgREST over every table and RPC), /auth/v1, /realtime/v1, /functions/v1 and /storage/v1 — a custom domain straight onto the data plane.
- 02
Authenticate with the same token
The OAuth token from the MCP flow (or your dashboard session) goes in the Authorization header. One identity across every surface — there is no separate REST key.
- 03
Query with URL operators
PostgREST turns tables into endpoints: pick columns with select=, filter with eq/gte/like/in, then order, limit and offset — all in the query string.
- 04
The database authorizes
Row-level security scopes every response to your role and ownership. You can't forget a permission check in a client — the check lives in Postgres itself.
Tables, RPCs and
A sample of what's addressable — the in-dashboard REST explorer documents every endpoint with a runnable request.
/rest/v1/devicesGETYour paired devices — identity, platform, last-seen, and the computed live online state (effective_online).
/rest/v1/entriesGETCaptured request/response rows — the same feed the dashboard renders, filterable by host, path, method and status class.
/rest/v1/breakpoint_eventsGETRequests the proxy is holding at a breakpoint right now, with kind, timing and outcome.
/rest/v1/todosCRUDThe shared to-do board — full create/read/update/delete, the same rows every other surface shows.
/rest/v1/settings_global · settings_device · settings_userCRUDThe layered settings tiers the capture stack folds together — write any tier, devices pick it up live.
/rest/v1/rpc/effective_settings_for_deviceRPCPostgres functions as POST endpoints: the server-folded settings union, filtered entry counts, device-control locks, egress-IP control and more.
/functions/v1/*EdgeEdge Functions — device pairing, capture ingest, the MCP server itself, and BusyBro's ask endpoint.
/auth/v1 · /realtime/v1 · /storage/v1platformSessions and refresh, the WebSocket upgrade for live channels, and file storage — the same host serves all of it.
Copy, paste,
Real endpoints, real filters — a table query with PostgREST operators and an RPC call.
# Server errors on one host in your captures, newest first
curl 'https://api.busymate.net/rest/v1/entries?select=id,ts,host,path&host=eq.api.example.com&payload->>statusCode=like.5__&order=id.desc&limit=50' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>'# The settings a device actually runs — the server-folded union of every tier
curl -X POST 'https://api.busymate.net/rest/v1/rpc/effective_settings_for_device' \
-H 'Authorization: Bearer <OAUTH_ACCESS_TOKEN>' \
-H 'apikey: <OAUTH_ACCESS_TOKEN>' \
-H 'Content-Type: application/json' \
-d '{"target_uuid":"<device-uuid>"}'From capture to
Assert traffic in CI
Fail a pipeline when a test run's captured traffic contains server errors, an unexpected host, or a call that should have been cached.
Pull captures into your tools
It's JSON over HTTP — notebooks, BI dashboards and log pipelines ingest it directly, or export standard HAR for HAR-speaking tooling.
Automate the back office
Create to-dos, flip settings tiers, manage devices from scripts and cron jobs — the same writes the dashboard makes, callable from anywhere.
The same rows,
Every capability aligns across the dashboard, MCP, REST, WebSockets and BusyBro — a standing rule, checked on every ship. Pick the surface that fits the job; the data and permissions are identical.
Before you
Is there an SDK?
You don't need one — it's PostgREST, so any HTTP client works on day one. If you want a client library, supabase-js speaks the whole surface (REST, auth and realtime) out of the box.
How do I authenticate?
With the same OAuth 2.1 token the MCP flow issues: send it as Authorization: Bearer. One token authenticates MCP, REST, WebSockets and Edge Functions.
How do filtering and pagination work?
Standard PostgREST grammar: shape columns with select=, filter with operators like eq, neq, gte, like and in, then order=, limit= and offset= (or Range headers) for paging.
Can I export captured traffic?
Filter the entries table down to exactly the rows you want as JSON, or export a standard HAR file — from the dashboard or the export_har MCP tool — for Charles- and Proxyman-compatible tooling.
What stops me reading someone else's data?
Row-level security. Every table carries policies that scope rows to your ownership and role — the same rules the dashboard runs under, enforced by Postgres on every query.
Is api.busymate.net really the database?
It's a custom domain onto the platform's Supabase project — and that's the point: the dashboard is built on the same public primitives you can call directly. No private API you're locked out of.
Build on
Autentificare, tabele și Edge Functions în documentație — sau lansează cereri din explorerul din dashboard.