Collections

Package base is managed Hanzo Base: a hosted backend for your app — collections, records, access rules and sign-in.

collections

GET /v1/collections/{wildcard1}

One Base content type, and its records

Reads and writes below the collections root: meta/scaffolds is the field-template palette a new content type is built from, <name> is one content type (view, update, delete), <name>/records is that type's rows (list, create) and <name>/records/<id> is one row (get, update, delete). This is the data plane behind the console's Records browser.

Any other shape below /v1/collections is refused with 404 before it is forwarded, so the wildcard admits exactly those five addresses and nothing more.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

POST /v1/collections/{wildcard1}

One Base content type, and its records

Reads and writes below the collections root: meta/scaffolds is the field-template palette a new content type is built from, <name> is one content type (view, update, delete), <name>/records is that type's rows (list, create) and <name>/records/<id> is one row (get, update, delete). This is the data plane behind the console's Records browser.

Any other shape below /v1/collections is refused with 404 before it is forwarded, so the wildcard admits exactly those five addresses and nothing more.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

PUT /v1/collections/{wildcard1}

One Base content type, and its records

Reads and writes below the collections root: meta/scaffolds is the field-template palette a new content type is built from, <name> is one content type (view, update, delete), <name>/records is that type's rows (list, create) and <name>/records/<id> is one row (get, update, delete). This is the data plane behind the console's Records browser.

Any other shape below /v1/collections is refused with 404 before it is forwarded, so the wildcard admits exactly those five addresses and nothing more.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

PATCH /v1/collections/{wildcard1}

One Base content type, and its records

Reads and writes below the collections root: meta/scaffolds is the field-template palette a new content type is built from, <name> is one content type (view, update, delete), <name>/records is that type's rows (list, create) and <name>/records/<id> is one row (get, update, delete). This is the data plane behind the console's Records browser.

Any other shape below /v1/collections is refused with 404 before it is forwarded, so the wildcard admits exactly those five addresses and nothing more.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

DELETE /v1/collections/{wildcard1}

One Base content type, and its records

Reads and writes below the collections root: meta/scaffolds is the field-template palette a new content type is built from, <name> is one content type (view, update, delete), <name>/records is that type's rows (list, create) and <name>/records/<id> is one row (get, update, delete). This is the data plane behind the console's Records browser.

Any other shape below /v1/collections is refused with 404 before it is forwarded, so the wildcard admits exactly those five addresses and nothing more.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

OPTIONS /v1/collections/{wildcard1}

One Base content type, and its records

Reads and writes below the collections root: meta/scaffolds is the field-template palette a new content type is built from, <name> is one content type (view, update, delete), <name>/records is that type's rows (list, create) and <name>/records/<id> is one row (get, update, delete). This is the data plane behind the console's Records browser.

Any other shape below /v1/collections is refused with 404 before it is forwarded, so the wildcard admits exactly those five addresses and nothing more.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

GET /v1/collections

The org's Base content types

Lists the content types in the org's managed Base, and creates one. This is what the console's Bases manager reads to render the schema.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

POST /v1/collections

The org's Base content types

Lists the content types in the org's managed Base, and creates one. This is what the console's Bases manager reads to render the schema.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

PUT /v1/collections

The org's Base content types

Lists the content types in the org's managed Base, and creates one. This is what the console's Bases manager reads to render the schema.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

PATCH /v1/collections

The org's Base content types

Lists the content types in the org's managed Base, and creates one. This is what the console's Bases manager reads to render the schema.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

DELETE /v1/collections

The org's Base content types

Lists the content types in the org's managed Base, and creates one. This is what the console's Bases manager reads to render the schema.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

OPTIONS /v1/collections

The org's Base content types

Lists the content types in the org's managed Base, and creates one. This is what the console's Bases manager reads to render the schema.

The path is forwarded to the managed Base unchanged and its answer comes back verbatim, so the schema, the records and every refusal are the managed Base's own.

AUTH is one credential, forwarded and never minted: cloud validates the caller's hanzo.id bearer and passes THAT SAME token on, because the managed Base scopes each row by the token's own subject. A caller with no validated principal is refused here, before the request leaves the process, and the org header that rides along is the one cloud validated — a client-forged org was stripped upstream.

This is a COLLECTIONS proxy, not a Base tunnel: only the collections data plane is admitted, and everything else the managed Base mounts — settings, backups, logs — is 404 here whatever the caller's rights on that deployment are.

One registration owns this address for every method, so which methods answer is the managed Base's decision, not this edge's.

---

All Hanzo APIs · Interactive reference