01
REST & GraphQL, side by side
One schema, two surfaces. Use whichever your client prefers — the same policies, the same keys, the same limits.
Issue 01 · Winter 2026
An API platform,
assembled from your database.
Connect a PostgreSQL database. Mustak introspects your schema and hands back a production-ready REST and GraphQL API — complete with OpenAPI docs, a playground, versioning, keys, rate limits, analytics, and monitoring. No scaffolding to write. No infrastructure to babysit.
Fig. 01 — The generated surface of a single connection.
In this issue
Twenty modules. One connection string.
Mustak isn't an API generator bolted onto a database. It's an ecosystem — auth, orgs, projects, keys, docs, rate limiting, webhooks, analytics, monitoring, billing — designed to remove the year-one backend work that every team rebuilds.
02
OpenAPI, always current
Every version publishes a live OpenAPI spec. Playground, SDKs, and Postman collections stay in sync.
03
Versioning without pain
Ship v2 alongside v1. Existing keys keep working. Deprecate on your schedule, not your customers'.
04
Keys and rate limits
Scoped, hashed keys. Sliding-window limits per key. Honest 429s with retry hints in the response headers.
05
Analytics you'll actually open
Requests, errors, and latencies per endpoint, per key, per version. Filter, group, export.
06
Webhooks with receipts
Signed HMAC payloads. Automatic retries. A delivery log so you can prove you sent it.
Dispatch 02
Five minutes from connection to curl.
Paste a Postgres URL. Approve the tables. Copy your key. That's it — the same request works from the browser, a Lambda, a mobile app, or a curl in your terminal.
$ curl https://api.mustak.dev/v1/acme/orders \
-H "Authorization: Bearer ak_live_a83f…"
{
"data": [
{ "id": "ord_9k2", "total": 24000, "status": "paid" },
{ "id": "ord_9k3", "total": 18500, "status": "paid" }
],
"pagination": { "next": "?cursor=ord_9k3" }
}Ready to begin