Concepts
Organization
Section titled “Organization”The tenancy and billing boundary. You invite members (owner, admin, member), optionally group them into nested teams, bind roles to people or teams, and create projects inside an org.
Plans set how many projects and members an org can have. Members are not billed per seat. Each user can own up to two Free organizations; upgrade one to create more. Organizations you were only invited to do not count toward that limit.
Project
Section titled “Project”The unit that hosts every product: data API, hosting, git, analytics, and so on. A project holds any number of databases (none until you create one). Every data-API URL includes the project ID and the database ID:
https://api.tefily.com/api/p/{projectId}/{databaseId}/{tableName}Database
Section titled “Database”A database groups collections, rows, end users (with their own auth switch) and files inside a project. You create, rename and delete databases in Database. Renaming only changes the display name: the database ID, and so your URLs, never change. Your plan limits how many databases an organization can have.
Collection (schema)
Section titled “Collection (schema)”A named table you define in Database. Metadata (name, fields, endpoints, rules) lives in the platform database. Documents live in MongoDB. The collection name in the URL is the table name, for example posts.
Every document includes system fields you do not add yourself:
| Field | Type | Meaning |
|---|---|---|
_id |
string | Document id |
_createdAt |
datetime | Created at |
_updatedAt |
datetime | Last update |
Endpoint
Section titled “Endpoint”A generated HTTP method on a collection: list, get, create, update, delete, plus file methods upload, download, fileDelete. Disabled endpoints return an error even if the caller is authenticated.
Access rule
Section titled “Access rule”A sequential allow/deny check on an endpoint. Typical pattern: requireAuth, then userFieldCompare so each user only sees their own rows. Platform JWTs, personal access tokens, and service tokens bypass rules on the data API, except requireServiceToken, which allows only a matching project service token.
See Access rules.
Dual APIs
Section titled “Dual APIs”| Prefix | Who calls it | Typical credential |
|---|---|---|
/api/... |
Console, admin SDK, MCP | Platform JWT or kfx_… |
/api/p/:projectId/:databaseId/... |
Your apps | Project JWT, or kfxs_… on a server |
The admin SDK talks to /api/.... The client SDKs talk to /api/p/....