Petstore Example API

A Petstore REST API built with Bun's native HTTP server and SQLite storage. Serves an OpenAPI 3.0 spec at /v3/api-docs. Designed as the running example for the apijack wiki.

Start

bun run server.ts

Server runs on port 3459.

Authentication

This API uses session-based auth with CSRF protection:

1. Send HTTP Basic Auth (admin / password) to GET /session
2. The response sets two cookies: SESSION and XSRF-TOKEN
3. Include the SESSION cookie on all subsequent requests
4. Include the X-XSRF-TOKEN header (value from the XSRF-TOKEN cookie) on mutating requests (POST, PUT, DELETE)

Quick test

# Get session cookies
curl -si -u admin:password http://localhost:3459/session

# Use cookies for a GET
curl -s -b "SESSION=<token>" http://localhost:3459/pets

# Use cookies + XSRF for a POST
curl -s -b "SESSION=<token>" \
  -H "X-XSRF-TOKEN: <xsrf-token>" \
  -X POST -H "Content-Type: application/json" \
  -d '{"name":"Buddy","species":"dog","age":3}' \
  http://localhost:3459/pets

apijack configuration

Add sessionAuth to the environment config:

{
  "sessionAuth": {
    "session": { "endpoint": "/session", "method": "GET" },
    "cookies": { "extract": ["SESSION", "XSRF-TOKEN"], "applyTo": ["*"] },
    "headerMirror": [
      { "fromCookie": "XSRF-TOKEN", "toHeader": "X-XSRF-TOKEN", "applyTo": ["POST", "PUT", "DELETE"] }
    ],
    "refreshOn": [401]
  }
}

Endpoints

Method	Path	Description
GET	/v3/api-docs	OpenAPI 3.0 spec (no auth)
GET	/session	Get session cookies (Basic Auth required)
GET	/pets	List pets (?species=, ?status=)
GET	/pets/:id	Get a pet
POST	/pets	Create a pet
PUT	/pets/:id	Update a pet
DELETE	/pets/:id	Delete a pet
POST	/pets/:id/adopt	Adopt a pet
GET	/owners	List owners
GET	/owners/:id	Get an owner (includes pets)
POST	/owners	Create an owner
PUT	/owners/:id	Update an owner
DELETE	/owners/:id	Delete an owner