Zero-code REST API server for SQL Server. Point it at a database — it introspects the schema and generates a full OData-compatible REST API automatically. No code required.
npm install
# Using individual flags
npx tsx src/index.ts \
--host localhost \
--database mydb \
--user sa \
--password "YourP@ssword" \
--trust-server-certificate
# Or using a connection string
npx tsx src/index.ts \
--connection "Server=localhost;Database=mydb;User Id=sa;Password=YourP@ssword;TrustServerCertificate=true"# API: http://localhost:3000/api# Swagger: http://localhost:3000/swaggerAfter installing globally with npm install -g restmssql, the restmssql command is available:
# Show help
restmssql --help
# Show version
restmssql --version
# Show project info
restmssql --about
# Start the API server
restmssql --database mydb --user sa --password "YourP@ssword" --trust-server-certificate
# Use a connection string
restmssql --connection "Server=localhost;Database=mydb;User Id=sa;Password=YourP@ssword"# Expose multiple schemas in read-write mode on a custom port
restmssql --database mydb --user sa --password "YourP@ssword" \
--schemas dbo,sales,hr \
--no-readonly \
--server-port 8080
# Listen on all interfaces (for Docker/remote access)
restmssql --database mydb --user sa --password "YourP@ssword" \
--listen-host 0.0.0.0
# Exclude specific tables
restmssql --database mydb --user sa --password "YourP@ssword" \
--exclude-tables AuditLog,TempData
# Custom pagination
restmssql --database mydb --user sa --password "YourP@ssword" \
--default-page-size 50 --max-page-size 500
# Debug logging
restmssql --database mydb --user sa --password "YourP@ssword" --log-level debug- Auto-generated endpoints for all tables, views, and stored procedures
- OData query support —
$filter,$select,$orderby,$top,$skip,$expand,$count - JSON and XML responses via
Acceptheader - Swagger UI at
/swaggerwith auto-generated OpenAPI spec - Read-only by default — enable writes with
--no-readonly - Multi-schema support — expose specific schemas with
--schemas dbo,sales - Composite primary keys —
GET /api/Table/Key1=val1,Key2=val2 - Stored procedure execution via
POST /rpc/<name> - Relationship expansion — auto-detects foreign keys for
$expandwith nested query options
| Method | URL | Description |
|---|---|---|
GET | /api | Service document (lists all resources) |
GET | /api/<Table> | List rows with OData query options |
GET | /api/<Table>/:id | Get single row by primary key |
POST | /api/<Table> | Create row (requires --no-readonly) |
PATCH | /api/<Table>/:id | Update row (requires --no-readonly) |
PUT | /api/<Table>/:id | Replace row (requires --no-readonly) |
DELETE | /api/<Table>/:id | Delete row (requires --no-readonly) |
POST | /rpc/<Procedure> | Execute stored procedure |
GET | /api/$metadata | OData CSDL metadata (XML) |
GET | /api/openapi.json | OpenAPI 3.0 spec |
GET | /swagger | Swagger UI |
Non-dbo schemas use dotted names: /api/sales.Orders
# Filter
GET /api/Products?$filter=Price gt 100 and InStock eq true# Select specific columns
GET /api/Products?$select=Name,Price
# Order and paginate
GET /api/Products?$orderby=Price desc&$top=10&$skip=20
# Expand related entities (with nested options)
GET /api/Products?$expand=Categories($select=Name)
GET /api/Orders?$expand=OrderItems($top=5;$orderby=UnitPrice desc)
# Count
GET /api/Products?$count=true
# Combine
GET /api/Products?$filter=contains(Name,'phone')&$select=Name,Price&$orderby=Price desc&$top=5
# String functions
GET /api/Products?$filter=startswith(Name,'Lap')
GET /api/Products?$filter=tolower(Name) eq 'laptop'# Null checks
GET /api/Products?$filter=Description eq null
# Composite primary key
GET /api/StockLevels/WarehouseId=1,ProductId=2
# Stored procedure
POST /rpc/GetProductsByCategory
Content-Type: application/json
{"CategoryId": 1}
# XML response
curl -H "Accept: application/xml" http://localhost:3000/api/ProductsPrecedence: CLI flags > environment variables > config file > defaults.
--connection <string> Connection string (Server=...;Database=...;User Id=...;Password=...)
--host <host> SQL Server host (default: localhost)
--port <port> SQL Server port (default: 1433)
--database <database> Database name (required)
--user <user> Database user
--password <password> Database password
--encrypt Encrypt connection (default: true)
--trust-server-certificate Trust server certificate
--server-port <port> HTTP server port (default: 3000)
--no-readonly Enable write operations
--no-cors Disable CORS
--schemas <schemas> Comma-separated schemas (default: dbo)
--exclude-tables <tables> Comma-separated tables to exclude
--default-page-size <size> Default page size (default: 100)
--max-page-size <size> Maximum page size (default: 1000)
--log-level <level> fatal|error|warn|info|debug|trace (default: info)
MSSQLREST_HOST=localhost
MSSQLREST_DATABASE=mydb
MSSQLREST_USER=sa
MSSQLREST_PASSWORD=secret
MSSQLREST_SERVER_PORT=3000
MSSQLREST_READONLY=false
MSSQLREST_SCHEMAS=dbo,salesCreate .mssqlrestrc.json or mssqlrest.config.js:
{
"host": "localhost",
"database": "mydb",
"user": "sa",
"schemas": ["dbo", "sales"],
"readonly": true
}# Quick start with Docker SQL Server + API
./dev.sh
# Or manually
npm run docker:up
npm run dev -- --database mssqlrest_test --user sa --password "YourStr0ngP@ssword!" --trust-server-certificate --schemas dbo,sales,hr
# Tests
npm run test:unit
npm run test:integration # requires Docker# Lint, format, typecheck
npm run lint
npm run format
npm run typecheckThis project uses Conventional Commits and automated versioning.
npm run release # auto-detect bump from commits
git push --follow-tags # triggers GitHub ReleaseSee CONTRIBUTING.md for commit format, branching, and development details.
Request -> Content Negotiation -> OData Parser -> Query Builder -> SQL Server
|
Response <- JSON/XML Formatter <- ----------------------------- Result Set
Schema introspection queries INFORMATION_SCHEMA and sys.* catalog views on startup to discover tables, views, columns, primary keys, foreign keys, and stored procedures. Routes are dynamically generated from the discovered schema.
Security: All user input is parameterized. Identifiers are validated against the introspected schema and bracket-quoted. LIKE wildcards are escaped. Results are always paginated. Security headers are set on all responses.
MIT