apistock - prepared stock for Go APIs

You own the code

A layered structure you can read and change. The CLI never rewrites your edits.

Plain Go

net/http, log/slog and constructors. No DI container, no reflection wiring.

One SQL file per query

Hand-written SQL you can read in review and explain in production.

Sign-in as a library

Passwords, sessions, 2FA, passkeys, Google and Apple. Fixes arrive with go get.

Background jobs

River workers on PostgreSQL, with schedules you change at runtime.

Organisations

Multi-tenant from the first commit, or add it later with aps add orgs.

Ops APIs

Audit log, health, releases, jobs and settings behind platform roles and 2FA.

When the bench is bare

we mill our own tools

Tools we built around apistock: watch an app that is running, inspect the one on your bench, and ship the next release.

Observability Portal

Observability for apistock apps, built on the OpenTelemetry data they already send.

Open Observability Portal

Requests and traces(1/3)

Every request with its trace, SQL and logs, grouped by request ID. No agent to install.

Errors, grouped(2/3)

Problems grouped by cause with the request that raised them, so you fix the cause once.

Jobs and mail(3/3)

Job runs, retries and sent mail beside the requests that queued them.

Dev Portal

Inspect the app on your bench while aps dev runs it.

Open Dev Portal

Route explorer(1/3)

Every endpoint from openapi.json, with a request builder that uses your signed-in session.

Module graph(2/3)

The wiring in internal/app drawn as a graph, read from the source, not from reflection.

Jobs, mail and settings(3/3)

Run a job now, read the last email, change a runtime setting, reset the seed data.

Deployment Portal

Deploy for apistock apps: releases, rollouts and migrations, from commit to running instance.

Open Deployment Portal

Releases and rollouts(1/3)

One release per version and commit, rolled out an instance at a time, rolled back on its own when 5xx climbs.

Migrations, once(2/3)

Schema changes run before the roll out on one instance, with the lock time and a down.sql check.

The fleet(3/3)

Every instance with its version, weight and health, read from /ops/releases, so a rolling deploy is never a guess.

_

It makes the calls, and says what each one costs.

You are not picking a router, a migration tool and an auth library on day one. Each choice below has a written record you can read before you commit.

PostgreSQL only. No ORM.

No MySQL, no SQLite. If that rules you out, it rules you out.

One SQL file per query.

More files than a query builder. Each one is a query you can read in review.

Auth is a library. The flows are yours.

Security fixes reach you with go get. Sign-up, sign-in and 2FA live in your repo.

Tenancy is chosen at creation.

Single or multi-tenant from the first commit; aps add orgs converts a running database later.

Settings live in PostgreSQL.

Change them without a deploy through /ops/settings. Secrets stay in the environment.

Migrations are forward-only.

One history, run under an advisory lock. No down migrations to trust in production.

Read the decision records

aps new acme-api

Cut the stock

preset, tenancy, email provider

under a minute

aps dev

Start it locally

Postgres, Mailpit, migrations, seed

API ready in about 10 s

aps gen resource Invoice

Add what you sell

four layers, SQL, tests

one line at a named anchor

go build ./cmd/api

Ship one binary

migrations under an advisory lock

release tracking per instance

Side Left

Side Right

_

From an empty folder to a running API

Four commands. Each one ends by naming the next, refuses to run on a dirty tree, and leaves git checkout as the undo button.

Read the quickstart

See a generated API

_

Written down before it was built

“

PostgreSQL only; pgx with hand-written SQL in repositories; goose; module migrations copied into the app's single history. Enables transactional jobs and audit, reviewable schema changes, no ORM lock-in for apps, no commercial-tier dependency.

0005

ADR-0005Database strategy

1 / 4

Your app keeps working if apistock disappears. The library is thin glue over the standard library; the generated code is plain Go you can read, change and deploy without the CLI.

0001

ADR-0001Framework boundaries

2 / 4

Settings are declared in code, stored in PostgreSQL and live on every instance through LISTEN/NOTIFY, with history and audit events. Secrets stay in the environment and never enter the table.

0031

ADR-0031Runtime settings

3 / 4

aps upgrade merges the template's changes beside your edits and commits the result. A changed line in a tracked file, a new resource, a new migration: every edit is kept, and the app builds and passes its tests after.

0050

ADR-0050Upgrades and adding features

4 / 4

_

_

apistock is a Go library and a CLI that write a complete, working API into your repository