OpenAPI Integration Guide

The raw runtime APIs of Instant API have three common entry points:

Entry point	Path rule	Authentication	Request body	Coverage
WebAPI	/api/{appCode}/{datasetCode}/{method}	Cookie	Business parameters passed directly	All 9 core Instant APIs
Client API	/client/{appCode}/{datasetCode}/{method}	Personal identity auth, X-User-AK	Business parameters passed directly	All 9 core Instant APIs
OpenAPI	/openapi/data/{method}	HMAC headers	{ appCode, datasetCode, paramMap } or paramList	A subset of data operations

If your goal is to curl all 9 Instant APIs, start with Instant API: 9 Raw APIs and the Node.js SDK, which uses the raw WebAPI paths.

1. What OpenAPI Is For

OpenAPI is an HMAC-signed entry point for external systems, server-side jobs, Agent gateways, and low-code platforms. It doesn't rely on user cookies, making it a good fit for server-to-server calls.

OpenAPI is not a one-to-one mirror of WebAPI. In OpenAPI mode, the current Node.js SDK uses these paths:

Instant API	OpenAPI path	Request body shape	Status
filter	/openapi/data/filter	{ appCode, datasetCode, paramMap }	Supported
aggregate	/openapi/data/aggregate	{ appCode, datasetCode, paramMap }	Supported
getOne	/openapi/data/get-one	{ appCode, datasetCode, paramMap: { id } }	Supported
create	/openapi/data/create	{ appCode, datasetCode, paramMap }	Supported
batchCreate	/openapi/data/batch-create	{ appCode, datasetCode, paramList }	Supported
update	/openapi/data/update	{ appCode, datasetCode, paramMap }	Supported
delete	-	-	Not yet supported
getSelectOptions	-	-	Not yet supported
excelExport	-	-	Not yet supported

2. Raw OpenAPI curl Example

export RUNTIME_DOMAIN="https://runtime.lovrabet.com"
export APP_CODE="app_xxx"
export DATASET_CODE="dataset_xxx"
export TIMESTAMP="$(date +%s000)"
export TOKEN="hmac-token-generated-by-server"

curl -X POST "$RUNTIME_DOMAIN/openapi/data/filter" \
  -H "Content-Type: application/json" \
  -H "X-Time-Stamp: $TIMESTAMP" \
  -H "X-App-Code: $APP_CODE" \
  -H "X-Dataset-Code: $DATASET_CODE" \
  -H "X-Token: $TOKEN" \
  -d '{
    "appCode": "'"$APP_CODE"'",
    "datasetCode": "'"$DATASET_CODE"'",
    "paramMap": {
      "where": { "status": { "$eq": "paid" } },
      "currentPage": 1,
      "pageSize": 20
    }
  }'

The server generates TOKEN from the AccessKey, timestamp, appCode, and datasetCode. Never put the AccessKey in frontend code, public repositories, or logs.

3. Node.js SDK Wrapper

In OpenAPI mode, the SDK generates the signature automatically and switches to /openapi/data/{method}:

import { createClient } from "@lovrabet/sdk";

const client = createClient({
  appCode: process.env.LOVRABET_APP_CODE,
  authMode: "openapi",
  accessKey: process.env.LOVRABET_ACCESS_KEY,
  runtimeDomain: process.env.LOVRABET_RUNTIME_DOMAIN || "https://runtime.lovrabet.com",
  models: [
    {
      tableName: "orders",
      datasetCode: process.env.LOVRABET_DATASET_CODE!,
      alias: "orders",
    },
  ],
});

const result = await client.models.orders.filter({
  where: { status: { $eq: "paid" } },
  currentPage: 1,
  pageSize: 20,
});

If you need delete, getSelectOptions, or excelExport, don't use OpenAPI mode — use WebAPI with a cookie or Client API instead.

4. Detailed References

Document	Purpose
OpenAPI	OpenAPI authentication, signing, paths, request bodies, and the full API reference
TypeScript SDK	Full Node.js / TypeScript SDK integration and SDK method reference
Java SDK	Full Java server-side SDK integration and call examples