backd
A config-driven REST backend over MongoDB. Declare realms, databases and collections as files on disk, and get a schema-validated, queryable document API. Add server-side functions for the logic clients can’t be trusted with: background jobs, cron schedules and webhooks included.
Open source, MIT licensed. Before exposing a realm, go through the hardening checklist.
What you get
One stateless Go service and a MongoDB database. No handlers to write per collection.
Configuration as files
A directory per realm, database and collection. Each collection is a JSON Schema, with optional indexes.json. Invalid config stops startup and names the file.
Schema-validated writes
JSON Schema draft 2020-12 enforced on every write, with field-level errors. The same schema is mirrored as a MongoDB $jsonSchema validator.
Queries without injection
Filter with where, sort with order_by, paginate and count. Every field and value is checked against the schema. Client input never reaches MongoDB raw.
Optimistic concurrency
_meta.version, ETag and If-Match. Every write is conditional, so concurrent updates are never silently lost.
Automatic provisioning
Collections, validators and indexes are created at startup, or verified for least-privilege deployments. Nothing is ever dropped.
Users and single sign-on
Built-in users per realm with argon2id passwords, sessions valid across the realm’s databases, API keys for services, invitations and brute-force protection. Sign in with Google, Microsoft or Apple, passkeys, a second factor, magic links, email verification, password reset and address changes through any email provider you call from a function, consents, and erasure of a user’s data on request.
Access rules
The rules of each collection decide who may read, create, update and delete each document. Read rules run inside the database query, so lists and counts only show what callers may see.
Server-side functions
JavaScript or TypeScript next to your collections, run in isolated Deno processes: sync calls, background jobs you can follow, cron schedules, webhooks. Rules, secrets, rate limits, idempotency, a network allowlist and full call history are built in. Start here.
Typed from your config
backd types turns the config into TypeScript for your app and your functions, and backd openapi into an OpenAPI 3.1 document per realm for client generators. In development the config reloads as you save it. Typing and OpenAPI.
Files, push and app configuration
Files in your own S3-compatible storage with image versions and quotas, push notifications to FCM, APNs and browsers, and a configuration your apps read, with history and rollback, and conditional GET so they ask only when it changed.
References, aggregations and search
Declare references between collections and return them next to the result with expand, summarize documents with _aggregate (group by declared fields, date buckets in a time zone, exact sums) and search prose with a weighted text index, best match first. All declared in config, with rules applied first and the cost bounded. Start here.
Organizations and team access
Groups of users for B2B apps: roles per organization, teams, team roles with time windows and delegation, documents that belong to an organization or a team, membership hooks and organization email templates. Start here.
Built for operations
JSON logs with request IDs, health and readiness probes, Prometheus metrics with Grafana dashboards, request limits, timeouts and graceful shutdown.