The REST API
EntityFlow exposes a thin, versioned public REST surface mounted at /api/v1. It applies the same tenant-scoped permission checks as the app, so anything you can't do in the UI you can't do over the API.
Authentication
Send an Authorization: Bearer <token> header. The token is either:
- a session token, or
- an API key (
ef_live_...) — see API keys.
curl https://<your-host>/api/v1/diagrams \
-H "Authorization: Bearer ef_live_xxxxxxxxxxxxxxxx"
Endpoints
| Method & path | Purpose |
|---|---|
GET /api/v1/diagrams | List diagrams. |
POST /api/v1/diagrams | Create a diagram. |
GET /api/v1/diagrams/{id} | Fetch a single diagram. |
PUT /api/v1/diagrams/{id} | Save (update) a diagram. |
DELETE /api/v1/diagrams/{id} | Delete a diagram. |
POST /api/v1/diagrams/{id}/export | Export SQL or DBML. |
GET /api/v1/catalog/tables | Search tables across diagrams. |
/api/v1/keys | Manage API keys. |
/api/v1/webhooks | Manage webhooks. |
OpenAPI & interactive docs
| Resource | URL |
|---|---|
| OpenAPI spec | /api/v1/openapi.json |
| Interactive docs | /api/v1/docs |
Use the OpenAPI document to generate clients in your language of choice, and the interactive docs to explore requests live.
note
The REST surface is independently versioned. A major version bump (for example, /api/v2) signals breaking changes; within a major version, changes are additive and backward-compatible.