Records API

Every collection gets a generic CRUD surface: GET /api/collections/:c/records (list, with page/perPage/skipTotal, filter, sort, search, expand), GET .../records/:id (view, with expand), POST .../records (create), PATCH .../records/:id (update), and DELETE .../records/:id. expand resolves relation fields inline in the same response, following PocketBase’s own dot-notation for nested relations. search runs a full-text query over the collection’s searchable fields, ANDed onto filter — see Database → Full-text search. Errors follow a consistent shape across every endpoint — see Error responses.

Footgun: expand silently drops fields the viewer can’t see

expand re-runs the target collection’s own viewRule for the requesting user before including it — matching PocketBase. If that rule says no, the expanded field is just absent from the response, not an error. The built-in users collection’s default viewRule is id = @request.auth.id (self-service only), so expand=someUserRelation in an app where users need to see each other (teammates, assignees, comment authors, presence, …) will silently omit expand.<field> for every user except the caller themselves — easy to mistake for a missing relation or a bug rather than a rule denying the read.

Fix by relaxing the target collection’s viewRule to whatever “who can see this” actually means for your app, e.g. any signed-in user, or members of a shared team:

{ "viewRule": "@request.auth.id != \"\"" }

or, scoped to a shared team (see examples/team-board/scripts/gen-schema.ts for a full working example):

{ "viewRule": "id = @request.auth.id || @collection._team_members.userRef ?= @request.auth.id" }