Endpoints

Serverless Lua endpoints for custom API logic.

What are endpoints?

Endpoints let you write custom server-side logic in Lua. Each endpoint gets a URL path and a Lua script that runs when the path is requested. Use them for webhooks, form handlers, redirects, or any custom API logic.

Serverless

No infrastructure to manage. Write Lua, assign a path, and it's live.

Sandboxed

Scripts run in a secure sandbox with only base, string, table, and math libraries.

Fast

5-second execution timeout. Lua is lightweight and starts instantly.

Request object

Every endpoint receives a request global with details about the incoming HTTP request.

Property	Type	Description
`request.method`	string	HTTP method (GET, POST, PUT, DELETE)
`request.path`	string	Request URL path
`request.query`	table	Query string parameters
`request.headers`	table	HTTP headers
`request.body`	string	Request body (for POST/PUT)

Response format

Return a table with status, headers, and body:

return {
    status = 200,
    headers = {
        ["Content-Type"] = "application/json"
    },
    body = json_encode({ message = "Hello!" })
}

Built-in globals

Global	Description
`json_encode(value)`	Convert a Lua table or value to a JSON string
`json_decode(string)`	Parse a JSON string into a Lua table
`request`	The incoming HTTP request (see above)
`string.*`	Lua string library
`table.*`	Lua table library
`math.*`	Lua math library

Example: JSON API endpoint

Path: /api/greet

local name = request.query.name or "World"

return {
    status = 200,
    headers = {
        ["Content-Type"] = "application/json"
    },
    body = json_encode({
        greeting = "Hello, " .. name .. "!",
        method = request.method
    })
}

Try it:

GET /api/greet?name=Alice

{"greeting": "Hello, Alice!", "method": "GET"}

Example: Webhook handler

Path: /api/webhook

if request.method ~= "POST" then
    return {
        status = 405,
        body = json_encode({ error = "Method not allowed" })
    }
end

local data = json_decode(request.body)

-- Process webhook payload
local event = data.event or "unknown"

return {
    status = 200,
    headers = {
        ["Content-Type"] = "application/json"
    },
    body = json_encode({
        received = true,
        event = event
    })
}

Constraints

Warning

5-second timeout. Scripts that exceed the timeout are terminated.
Sandboxed. Only base, string, table, and math libraries are available. No file system, network, or OS access.
No database access. Endpoints cannot read or write to collections directly. For CRUD operations, use the REST API from your client code instead.

What's next?

API Reference

Full REST API documentation for records, auth, and real-time events.

Templates

Use template functions to display dynamic data on your pages.

Collections

Store and query structured content like blog posts or products.