the data API 

All requests require an API key in the Authorization header.

Authorization: Bearer bondi_pk_…

Create a key in Studio → Integrations → API Keys → Create. The full token is shown once on creation - copy it then. Lost keys cannot be recovered, but you can rotate or revoke and issue a new one.

Both surfaces are scoped by workspaceId and environmentId, which appear in your endpoint URLs. Find them in Studio → Settings → Workspace.

A. REST

The endpoint URLs are the same for every workspace - only the request body's data map differs (its keys are your column serials). Full reference with try-it-out: /docs/api/rest-api.

B. GraphQL

The schema is generated from your tables. Naming pattern:

• <schema><Table>() - list query (filters, pagination, ordering)
• <table>ById() - fetch by primary key
• create<Table>, update<Table>, updateMany<Table>, delete<Table> - mutations
• Foreign-key relations resolve to nested objects.

The schema is private to your workspace, so the GraphQL playground lives inside Studio, behind your login - open it from Integrations → API Playground → GraphQL.

Use the metadata endpoints to enumerate your tables and columns. Useful for code generation or admin tools that adapt to schema changes.

curl https://data-api.heybondi.com/rest/$WS/$ENV/schemas \
  -H "Authorization: Bearer $BONDI_PK"

curl https://data-api.heybondi.com/rest/$WS/$ENV/tables/$TABLE_SERIAL/columns \
  -H "Authorization: Bearer $BONDI_PK"

List the first three rows of a table - same intent, two surfaces.

A. REST

curl "https://data-api.heybondi.com/rest/$WS/$ENV/tables/$TABLE_SERIAL/records?limit=3" \
  -H "Authorization: Bearer $BONDI_PK"

B. GraphQL

curl https://data-api.heybondi.com/graphql/$WS/$ENV \
  -H "Authorization: Bearer $BONDI_PK" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ publicCustomers(limit: 3) { id _display } }"}'

The API is date-versioned (current: 2026-04-27). Breaking changes are announced at least 90 days in advance, and the previous version continues to serve traffic during the migration window. You don't need to pin a version header today - the active version is published in the OpenAPI spec at /docs/api/rest-api.

• Rate limit - per-tenant, enforced at dispatch. Headers X-RateLimit-Limit / -Remaining / -Reset on every response.
• Pagination - pass limit and offset, or use cursor pagination via first + after.
• File uploads - size enforced per file-type category server-side. Returns 422 if exceeded.

All errors share one envelope:

{
  "error": "Validation Error",
  "message": "Request body must include 'data' field",
  "fieldErrors": [...]
}

· Status codes