Every Collection Is an API. Zero Boilerplate.
Define a collection schema in Aeion — say, `pages` or `orders` or `tickets` — and you get an auto-generated REST endpoint, a GraphQL field, a WebSocket subscription, an MCP tool for AI agents, a WebMCP browser tool, an OpenAPI spec entry, and a typed TypeScript SDK method. All from one schema definition. No handlers to write. No types to maintain. The kernel does it for you.
The Two Things to Know First
Aeion's API surface is bigger than most platforms', but two ideas anchor everything.
REST API Quickstart
Hit the platform with curl:
30+ Filter Operators
Filters use the URL-safe ?where[field][operator]=value shape. Combine with ?fields=, ?limit=, ?cursor=, ?search= for the full query surface.
GraphQL Surface
Every collection ships GraphQL automatically. Query the schema introspection to discover types and fields.
WebSocket & Realtime Subscriptions
Subscribe to live record changes without polling.
MCP Tools — For AI Agent Integration
Aeion ships 89 MCP (Model Context Protocol) tools. AI agents and automation runtimes can invoke any Aeion capability the same way a developer would call the REST API — except discoverable, typed, and per-tenant gated.
WebMCP — In-Browser AI Tool Layer
WebMCP exposes 180+ MCP-style tools directly to AI agents running in the browser admin UI. Used by Aeion Claw (the native AI assistant) to mutate UI state, navigate views, fill forms, run searches, and orchestrate workflows from inside the admin shell without round-tripping to the server.
TypeScript SDK
A fully typed SDK derived from the Drizzle schema — the IDE knows every collection, every field, every relation.
Authentication
Three patterns, pick the right one for your integration.
Rate Limits & Quotas
Aeion enforces per-tenant rate limits to protect the platform from runaway integrations and to give your account predictable cost behavior.
Versioning
Aeion uses URL-prefix versioning (/api/v1/...) with strict backward-compatibility guarantees within a major version.
Frequently Asked Questions
Per-tenant at `https://yourtenant.aeionos.com/api/openapi.json` (auto-generated from your Drizzle schema). Swagger UI at `https://yourtenant.aeionos.com/api/docs`. The spec reflects only collections active in your tenant — modules you haven't activated don't appear.
Yes — GraphQL introspection, REST `OPTIONS` requests, and `GET /api/schema/collections` all return the current collection schema. Drizzle's `schema.json` is also exported per-tenant for SDK generation.
OAuth 2.0 with PKCE is the standard pattern. Register your app in the admin UI (Apps → OAuth Clients), get a client ID + secret, follow the standard OAuth flow. Your end users approve specific scopes; tokens last for 8 hours by default with refresh.
Aeion is closed-source SaaS, so you can't add custom server-side routes to the platform itself. Three customer-extensible paths instead: (1) Blueprint workflows — orchestrate cross-module logic without code; (2) outbound webhooks per collection — Aeion fires HMAC-signed POSTs to your endpoint when records change; (3) Enterprise co-development for sponsored module work — Aeion ships the feature, you get first-mover access. See /partners for the co-development path.
Yes, over WebSocket. Subscriptions follow the GraphQL spec for `subscription` operations. Server-Sent Events also work for one-way streaming.
Yes. Configure outbound webhooks per collection in the admin UI; Aeion fires HMAC-signed POSTs to your endpoint when records change. Useful for serverless integrations that can't hold WebSocket connections.
`POST /api/v1/files` with multipart/form-data for direct uploads, or use the resumable upload protocol for files >100MB. Files are stored in the platform's File module (`/platform/files`) with optional Bring-Your-Own-Bucket S3 backend.
Not officially — the typed-from-Drizzle TypeScript SDK is the primary developer surface. Python clients work fine against the REST + GraphQL APIs; we recommend the auto-generated OpenAPI client for Python (`openapi-python-client`) which gives you typed methods from the OpenAPI spec.
Yes. Every tenant ships with a sandbox sub-tenant that mirrors the production schema but uses test data and test Stripe keys. Sandbox URL pattern: `https://yourtenant-sandbox.aeionos.com`. API key generation works the same way.
Zero-downtime deploys with rolling restarts. Active requests complete on the old version; new requests hit the new version. Backward compatibility within `v1` is guaranteed across all platform updates.
Typed examples in TypeScript at every endpoint. Curl examples on this page work in any language. For Python, Go, Rust, and other languages, generate a client from the per-tenant OpenAPI spec. For C# / Java enterprise integrations, talk to sales — we can provide reference implementations on Professional and Enterprise.
`security@aeionos.com` for security issues. `engineering@aeionos.com` for technical bugs and feature requests with API surface impact. We respond within 1 business day.