PostgREST

PostgREST turns a Postgres database into a REST API without you writing one. Point it at your schema and every table, view, and function becomes an endpoint, with permissions decided by the roles and row-level security already defined in the database. MIT licensed, free, and a single small binary. It is also the API layer inside Supabase, which is about the best production reference you could ask for.

Running it is light. One stateless binary or the official Docker image next to Postgres 14 or later, scaled horizontally when you need more. It does not do HTTPS, so it sits behind Nginx or another reverse proxy. Auth is JSON Web Tokens mapped to database roles, minted inside the database or by an outside service.

Free at every size, with no paid edition. The real decision is where your logic lives. With PostgREST, validation and permissions are SQL: grants, policies, views, functions. Teams fluent in Postgres move fast. Teams that are not should look at supabase/supabase, which wraps PostgREST with auth, storage, and a dashboard, or directus/directus for an API plus an admin UI.

The catch: the schema cache goes stale when you change the database, so you reload it with a NOTIFY or a signal. And one sloppy grant on the anonymous role exposes data to the internet. Your DBA is now your API security team.