Self-hosted application server · LGPL-3.0

Give Daptin your tables and relationships. Get a running application server.

Define the tables and relationships your product needs. Daptin creates the database, APIs, access controls, admin interface, files, workflows, events, and integrations.

Run Daptin locally →See what Daptin creates

schema_product.yaml

Tables:
  - TableName: product
    Columns:
      - Name: title
        DataType: varchar(200)
      - Name: price
        DataType: float

POST /api/product     201
GET  /api/product     200

JSON:API + GraphQLPolicy + actionsAdmin + live events

Use common API toolsJSON:API · GraphQL · OpenAPI Connect existing auth librariesOAuth 2.0 · OIDC · PKCE · JWT Subscribe with standard clientsWebSocket · Yjs · SSE Keep using mail and file softwareSMTP · IMAP · FTP/FTPS · WebDAV

What Daptin creates

Define a table once. Daptin runs its API, access, admin, and events.

Daptin uses the same table and relationship definitions for APIs, permissions, files, actions, events, and the admin interface.

See how the components fit together →

One definition

TableName: product
Columns:
  - Name: title
    DataType: varchar(200)
  - Name: photo
    ColumnType: image

01 / modelTables, relations, types, IDs, and timestamps

02 / exposeJSON:API, GraphQL, OpenAPI, and dashboard3

03 / governAccounts, groups, row permissions, and audit

04 / operateActions, schedules, events, storage, and servers

Why Daptin uses established protocols

Works with the SDKs, clients, and tools you already use.

Published protocols let you inspect, replace, and maintain integrations without a Daptin-specific client.

Check the v0.12.36 feature list ↗

APIs and realtime

JSON:API, optional GraphQL, WebSocket, and Yjs.

HTTP(S)JSON:API GraphQL OpenAPI 3.0 WebSocket Yjs OpenAI-style SSE

Identity and transport security

OAuth 2.0, OpenID Connect, JWT, and TOTP.

OAuth 2.0 OpenID Connect PKCE S256 JWT TOTP TLS + ACME CORS

Mail, files, and syndication

Reach your data over mail, file, storage, and feed protocols.

SMTP · SMTPS · STARTTLS · DKIM IMAP4rev1 · IDLE FTP · FTPS WebDAV core RSS 2.0 · Atom · JSON Feed S3-compatible storage

Outbound integrations

Call external APIs without shipping secrets to the browser.

OpenAPI 2.0 + 3.0 REST GraphQL over HTTP Unary gRPC WebSocket request/response OpenAI-compatible /v1

Compatibility limits: the CalDAV/CardDAV routes provide basic WebDAV file storage, not the full calendar and contact specifications. Daptin uses JSON:API resource documents, but does not implement the optional include query.

The shipped admin interface

See and edit the live backend in dashboard3.

dashboard3 running on Daptin v0.12.36.

See the product in detail →

Current dashboard3 overview with data, API, administration, and storage tools — **System overview**dashboard3 · local Daptin v0.12.36 source

Current dashboard3 permissions table — **Table permissions**Guest, user, and group access

Current dashboard3 actions table — **Server-side actions**Operations with several server-side steps

Permissions across services

Revoke access once. Every Daptin service honors it.

The former member loses access to records, downloads, actions, and live events. Each service checks the same ownership and group rules.

Read the permission model →

Workspace membership removedgroup relation

Project and ticket rows deniedJSON:API

Attachments and actions deniedfiles + actions

Record events stopWebSocket

Server-side controls

Access checks, secrets, and transactions stay on the server.

Every client and protocol receives the same access decisions. The browser does not hold provider credentials.

Permissions

One access rule covers rows, files, actions, and subscriptions.

Guest, owner, and group permissions cover rows, relationships, assets, actions, WebSocket topics, Yjs rooms, and FTP site paths.

Inspect authorization tests ↗

Authentication

Single-use codes, token rotation, and replay protection.

Actions and scheduled work use database transactions. OAuth codes are single-use, refresh tokens rotate, provider PKCE is required, and OTP attempts are cluster-shared.

Read the token lifecycle →

Operations

Health checks, statistics, audits, and live counters.

/ping reports process liveness; /statistics exposes web, database-pool, host, and resource state. Logs, audit tables, caching, distributed PubSub, and rate counters are built in.

Read the operations guide →

Self-hosted deployment

Run one executable or a container on your infrastructure.

WindowsWindowsx86-64 executable ↓LinuxLinuxx86-64 binary ↓Linux ARM64Raspberry Pi64-bit ARM binary ↓macOSIntel macOSx86-64 binary ↓ContainerDockerVersioned image →Two servicesDocker ComposeDaptin + PostgreSQL →Starting pointKubernetesKustomize manifests →ProductionPersistence and health checksDeployment notes →

See Deploy for artifact limits.

Define a table, start Daptin, and call its API.

Follow the quickstart →Inspect the source ↗