Coming soon · early access

Your database becomes a REST API. Visually.

Connect the database you already have, see its schema as a graph, switch on what you want to expose and get a published, documented and secure API. Without writing a backend.

See how it works See an example

Starting with PostgreSQL. We are finishing the first version.

How it works

From database to API in three steps

Nothing is exposed until you decide. Every change becomes a version — publish when you want and roll back in one click.

Connect your database

Enter host, user and password. We test the connection, explain any error in plain language and read tables, columns and relations. Credentials are encrypted.

Shape it on the canvas

Your schema shows up as a graph. Enable resources, pick fields, link relations, decide who can read or write and create your own endpoints.

Publish and use it

The REST API goes live right away, with automatic docs, OpenAPI 3.1, a TypeScript SDK and access keys. Use your own domain if you like.

Features

Everything a serious API needs

Filters, pagination, relations, authentication and docs follow one stable convention — the same in every project.

Graph canvas

Think about your API visually: resources as nodes, relations as links. Undo, redo and diffs before you publish.

Ready-made queries

Field and relation selection, filters with 12 operators, sorting and cursor pagination on every route.

Automatic documentation

Reference page, OpenAPI 3.1 and TypeScript SDK generated from what you published — always up to date.

Eject to code

Download a standalone Node server for your API, with the same rules. No vendor lock-in.

Webhooks and hooks

Notify other systems when a record changes and run sandboxed JavaScript validations before saving.

AI copilot

Describe what you want to expose and review the proposal before applying it. Works with your own AI key.

Secure from day one

Your database stays yours. Nobody sees what you did not open up.

  • Denied by default. Tables, fields and operations start switched off; exposing them is your call.
  • No SQL from the outside. Every query is parameterized and only uses tables and columns that exist in your schema.
  • Personal data protected. Masks for ID numbers, e-mail and phone, designed with GDPR and LGPD in mind.
  • Each user sees only their own data. Row policies driven by your users' login token.
  • Limits and auditing. Rate limits, a time cap per query and a log of every change.
# customers with their orders, newest first
GET /d/shop/v1/customers?select=id,name,orders(id,total)&sort=-created_at&limit=2
X-Api-Key: ak_••••••••

{
  "data": [
    {
      "id": 482,
      "name": "Maria Souza",
      "orders": [ { "id": 9131, "total": "189.90" } ]
    },
    { "id": 481, "name": "João Lima", "orders": [] }
  ],
  "meta": { "next_cursor": "eyJ2Ijox…", "has_more": true }
}
Who it is for

For people who have the database but no time for the API

Your system already holds the data. Rootmap builds the bridge to the app, website or partner that needs it.

Legacy systems

PHP, Delphi and similar developers who need to open their data to an app or integration without rewriting the system.

Agencies and freelancers

Deliver APIs to many clients with the same conventions, ready-made docs and each client's own domain.

Data and operations teams

Share data with other teams in a controlled way, with role-based access and an audit trail.

Almost there

Rootmap is in its final stretch of development. Early access opens soon — check back here to follow along.

See how it works again