apistock - prepared stock for Go APIs

_

apistock is a Go library and a CLI that write a complete, working API into your repository

Plain Go: net/http, log/slog and constructors instead of a DI container. The generated app owns its flows, tables and SQL. The library holds the parts that need security fixes, so they reach you with go get.

You own the code

A layered structure you can read and change. The CLI never rewrites your edits.

Plain Go

net/http, log/slog and constructors. No DI container, no reflection wiring.

One SQL file per query

Hand-written SQL you can read in review and explain in production.

Sign-in as a library

Passwords, sessions, 2FA, passkeys, Google and Apple. Fixes arrive with go get.

Background jobs

River workers on PostgreSQL, with schedules you change at runtime.

Organisations

Multi-tenant from the first commit, or add it later with aps add orgs.

Ops APIs

Audit log, health, releases, jobs and settings behind platform roles and 2FA.

When the bench is bare

we mill our own tools

Tools we built around apistock: watch an app that is running, and inspect the one on your bench.

Observe

Observability for apistock apps, built on the OpenTelemetry data they already send.

Open Observe

Requests and traces(1/3)

Every request with its trace, SQL and logs, grouped by request ID. No agent to install.

Errors, grouped(2/3)

Problems grouped by cause with the request that raised them, so you fix the cause once.

Jobs and mail(3/3)

Job runs, retries and sent mail beside the requests that queued them.

Devtools

Inspect the app on your bench while aps dev runs it.

Open Devtools

Route explorer(1/3)

Every endpoint from openapi.json, with a request builder that uses your signed-in session.

Module graph(2/3)

The wiring in internal/app drawn as a graph, read from the source, not from reflection.

Jobs, mail and settings(3/3)

Run a job now, read the last email, change a runtime setting, reset the seed data.

_

It makes the calls, and says what each one costs.

You are not picking a router, a migration tool and an auth library on day one. Each choice below has a written record you can read before you commit.

PostgreSQL only. No ORM.

No MySQL, no SQLite. If that rules you out, it rules you out.

One SQL file per query.

More files than a query builder. Each one is a query you can read in review.

Auth is a library. The flows are yours.

Security fixes reach you with go get. Sign-up, sign-in and 2FA live in your repo.

Tenancy is chosen at creation.

Single or multi-tenant from the first commit; aps add orgs converts a running database later.

Settings live in PostgreSQL.

Change them without a deploy through /ops/settings. Secrets stay in the environment.

Migrations are forward-only.

One history, run under an advisory lock. No down migrations to trust in production.

Read the decision records

_

Read every line you ship.

Four layers, one SQL file per query, and a wiring file with a named anchor where generators add a line instead of rewriting yours.

See a generated API

Handler

Query

Wiring

Copy

aps new acme-api

Cut the stock

preset, tenancy, email provider

under a minute

aps dev

Start it locally

Postgres, Mailpit, migrations, seed

API ready in about 10 s

aps gen resource Invoice

Add what you sell

four layers, SQL, tests

one line at a named anchor

go build ./cmd/api

Ship one binary

migrations under an advisory lock

release tracking per instance

Side Left

Side Right

_

From an empty folder to a running API

Four commands. Each one ends by naming the next, refuses to run on a dirty tree, and leaves git checkout as the undo button.

Read the quickstart

See a generated API

_

Written down before it was built

“

PostgreSQL only; pgx with hand-written SQL in repositories; goose; module migrations copied into the app's single history. Enables transactional jobs and audit, reviewable schema changes, no ORM lock-in for apps, no commercial-tier dependency.

0005

ADR-0005Database strategy

1 / 4

Your app keeps working if apistock disappears. The library is thin glue over the standard library; the generated code is plain Go you can read, change and deploy without the CLI.

0001

ADR-0001Framework boundaries

2 / 4

Settings are declared in code, stored in PostgreSQL and live on every instance through LISTEN/NOTIFY, with history and audit events. Secrets stay in the environment and never enter the table.

0031

ADR-0031Runtime settings

3 / 4

aps upgrade merges the template's changes beside your edits and commits the result. A changed line in a tracked file, a new resource, a new migration: every edit is kept, and the app builds and passes its tests after.

0050

ADR-0050Upgrades and adding features

4 / 4

_

Build apistock with us

Apache 2.0, built in the open, with every decision on record. Star the repository, open an issue when something is wrong, or send a pull request; the contribution guide says how.

Star on GitHub

_

_