Backend

Import defineBackend and z from @backifydev/sdk/app in server code. The backend capability is derived when a backend is declared. Worker apps must not declare one.

import { defineBackend, z } from "@backifydev/sdk/app";
export const api = defineBackend({ title: "Orders API" });
api.get("/api/orders/:id", {
  auth: "user", params: z.object({ id: z.string().uuid() }),
  response: z.object({ id: z.string(), owner: z.string() })
}, ({ params, user }) => ({ id: params.id, owner: user.id }));

Declare at module top level with literal names, paths and auth. Supported auth values are "public", "user", { role: "admin" }, or { permission: "orders.read" }. The SDK enforces auth and validates input. Use parameterized SQL and scope every query to the verified user or organization.

api.get/post/put/patch/delete accept params, query, body and response schemas where appropriate. Throw HttpError(status, message, code) for a safe error. /healthz is reserved by default; configure server.health when changing it.

The web role listens on the platform port with internal ingress behind the gateway. The gateway strips client X-Backify-* headers and forwards signed identity; the SDK verifies the signature and application/environment audience.

The portal reads the active release catalog and OpenAPI document rather than discovering arbitrary application endpoints. Generate and commit the catalog with backify lock; verify it with backify check. See the runtime contract.