PostgREST
title: PostgREST radar_quadrant: Platforms radar_ring: Assess radar_position: inner created: 2026-05-22 last_updated: 2026-05-22 related: ["Temporal", "Windmill", "Permify"]
PostgREST is a standalone web server that reads a PostgreSQL schema and automatically exposes it as a RESTful API. No code is written: tables, views, stored procedures, and functions become endpoints immediately, with authentication handled via JWT and row-level security (RLS) policies enforced at the database layer.
Write the schema in PostgreSQL. PostgREST reads it and generates API routes — GET /employees returns rows from the employees table; POST /employees inserts. Filtering, sorting, and embedding (JOIN equivalents) are expressed via query parameters. Supabase ships PostgREST as its auto-generated REST API layer.
Auto-generated endpoints — every table and view is a route. No controller layer, no serializers, no ORM.
Row-Level Security — access rules are enforced in PostgreSQL via RLS policies, not in application middleware. A JWT claim becomes a PostgreSQL session variable; policies filter rows accordingly.
Stored procedure exposure — a PostgreSQL function public.search_products(term text) becomes POST /rpc/search_products.
Horizontal scalability — PostgREST is stateless. Multiple instances behind a load balancer share one Postgres backend.
OpenAPI output — the server generates an OpenAPI spec at / describing all endpoints, usable directly with Bruno or Scalar.
PostgREST is suited for internal tooling, prototyping, and data APIs where the schema is stable and business logic lives in PostgreSQL (functions, triggers, RLS). It is not suited for workflows requiring complex cross-service orchestration or heavy application-layer logic.
| PostgREST | Supabase | Hasura | |
|---|---|---|---|
| Protocol | REST | REST + Realtime | GraphQL |
| Data source | PostgreSQL | PostgreSQL | PostgreSQL, MySQL |
| Self-hosted | Yes | Yes (complex) | Yes |
| Logic layer | SQL / PG functions | SQL + Edge Functions | SQL + Actions |
PostgREST is the lowest-complexity option: a single binary, no daemon, no framework. Supabase wraps PostgREST and adds auth, realtime, and storage.
Single binary or Docker:
docker run --rm --net=host \
-e PGRST_DB_URI="postgres://user:pass@localhost/db" \
-e PGRST_DB_ANON_ROLE="anon" \
postgrest/postgrestNo config files required beyond the PGRST_DB_URI and PGRST_DB_ANON_ROLE environment variables.
PostgREST sits at Platforms → Assess inner. The zero-code REST API model eliminates an entire application layer for data-centric services, with access control delegated to PostgreSQL RLS — a proven, auditable boundary. First studied via the API database architecture pattern article (2024-05-13). The single-binary Docker deployment is near-zero friction. Trial gate: a PostgREST instance serving at least one internal or personal project, with RLS policies enforcing access control verified against multiple JWT roles.
