pb-api-rules

Topics in the source

• PocketBase API Rules & Filter Expressions
• Rule Types
• Superuser Bypass
• Filter Syntax
• Operators
• Logical Operators
• Values
• Request Macros (@request.)

Each collection has 5 rule types. Each rule is a filter expression that must evaluate to true for the request to proceed. | Rule | Controls | Locked = | Empty string = | |------|----------|----------|----------------| | List | GET /api/collections/{name}/records | superusers only | everyone can list | | View | GET /api/collections/{name}/records/{id} | superusers only | everyone can view | | Create | POST /api/collections/{name}/records | superusers only | everyone can create | | Update | PATCH /api/collections/{name}/records/{id} | superusers only | everyone can update | | Delete | DELETE /api/collections/{name}/records/{id} | superusers only | everyone can delete | Critical: null/locked means only superusers can perform the action (regular users and guests are denied). Empty string "" means EVERYONE including guests. Superusers always bypass API rules entirely — see below. Superusers (formerly admins) always bypass API rules. Rules only apply to regular auth records and guests. | Operator | Meaning | Example | |----------|---------|---------| | = | Equal | status = "active" | | != | Not equal | status != "draft" | | > | Greater than | count > 5 | | >= | Greater or equal | count >

This is an excerpt. Refer to the complete source and its current requirements.