EN Data Sources

Static, file and HTTP data sources

English · Türkçe · Languages / Diller

Scope: JSON API Forge 0.5.1 · Source review: 17 September 2026 · Language: English

data_sources exposes non-SQL-table data through controlled APIs. Supported types are static, json_file, yaml_file, csv_file and http. Use each source type's contract rather than assuming generic resource CRUD bodies and transaction guarantees.

Public static data

{
  "data_sources": [
    {
      "name": "info", "type": "static", "path": "info", "public": true,
      "data": {"service": "WikiDemo", "version": "1.0.0"},
      "cache_ttl_seconds": 30
    }
  ]
}

Adding this fragment to a project creates GET <prefix>/info. Private sources require an appropriate permission or read/write permissions. Public reading does not imply public writing; public_write is a separate explicit decision.

File sources

file identifies a controlled project file. Filtering/sorting allowlists, id_field and max_items are available. writable=true supports small file-based, single-host use; it is not a distributed database. Locks and atomic replacement alone do not coordinate multiple hosts. Apply least privilege to file locations and write permissions.

PublicCatalog demonstrates a read-only JSON catalog. Changing data files has a different lifecycle from reloading JSON configuration; account for cache TTL as well.

HTTP gateway

url, method, headers, timeout_seconds, max_response_bytes, forward_query, forward_body, retries and cache settings define the upstream contract. Do not let request-body input select arbitrary destination hosts.

Forge's HTTP client constrains redirects, private/link-local destinations, DNS rebinding and oversized responses. HTTPS is the default, and ambient proxy settings are not trusted. Network-level egress rules remain necessary.

retry_non_idempotent defaults to false. Before retrying side-effecting POST/PATCH requests, confirm that the upstream can safely recognize the same command. retries affects how many times work can execute, not just latency.

Reference secrets through environment variables rather than embedding them in headers or URLs. Redact URL userinfo, authorization headers and personal payload data from diagnostics. All 32 fields appear in the content model reference.

Sources and verification

This page describes the behavior at the pinned commits below. Recheck these contracts when upgrading.

• main/framework/datasources.py
• main/framework/services/http_client.py
• main/framework/config.py
• exampleApps/app/PublicCatalog/README.md

---

English home · All English pages · Version maintenance