SQL over HTTPS
Parameterized PostgreSQL queries from serverless runtimes and backends that cannot hold a persistent TCP connection.
- No socket required
- Parameterized by design
- Transactions up to 25 statements
Built for serverless
Edge and serverless runtimes cannot keep a Postgres socket open. The Data API executes a statement over one HTTPS request instead.
Parameters are separate
Values go in params, never interpolated into the SQL string. The shape of the API makes the safe path the easy path.
Transactions, bounded
The transaction endpoint accepts between one and twenty-five statements and runs them together. The bound is deliberate, not a bug to work around.
No session between requests
Separate requests share no session. LISTEN/NOTIFY, cursors and session-scoped locks need a direct connection.
Scoped by key
db.query.read for reads, db.query.write for writes. The same key model as everything else on the platform.
RLS still applies
Row level security is enforced by PostgreSQL, so it applies to Data API calls exactly as it does to a direct connection.
When to use a direct connection instead
Migrations, bulk loads, long transactions and anything that depends on session state belong on a real connection. The Data API is for the request-shaped work in between.
const response = await fetch(
`${process.env.APP_BASE_URL}/api/v1/databases/${databaseId}/query`,
{
method: 'POST',
headers: {
'Content-Type': 'application/json',
Authorization: `Bearer ${process.env.VELTIC_API_KEY}`
},
body: JSON.stringify({
sql: 'SELECT id, name FROM products WHERE id = $1',
params: [42],
method: 'execute'
})
}
);
if (!response.ok) throw new Error(`Query failed: ${response.status}`);
const result = await response.json();Build the whole backend in one project
One plan, one dashboard, one command line interface. PostgreSQL, applications, functions, storage and realtime.