Rivetpath is a REST API starter that you host yourself, built by DEV3 Technologies on NestJS 11, TypeScript, Prisma 6 and MySQL 8. It is for backend developers, agencies and startups who want to begin a production API with the parts everyone rewrites already done and tested: sign-in, refresh tokens, API keys, organisations and roles, validation, docs, rate limits, jobs and webhooks. A small web console manages users, organisations, keys and webhooks. There is no end-user front end. The demo is a fictional supply company, Stockrill, with three organisations, 1,800 items and about 40,000 stock movements.
No live demo: grouped screenshots and two video tours show the marketing page, the console, the Swagger and Redoc references, the guides and the test runs. Install it with the demo data to try everything on your own server. This is a web API with a console: there are no mobile apps.
What is in the API
- Authentication: email and password with argon2id, email verification, password reset, TOTP two-factor sign-in with recovery codes, 15-minute JWT access tokens and rotating refresh tokens with reuse detection (a replayed token revokes the whole family). A session list lets users revoke devices.
- API keys:
rpk_ keys shown once and stored as a hash, with scopes that can never exceed their creator's abilities, per-key rate limits, expiry and revoke.
- Organisations and roles: multi-tenant by default. A Prisma extension adds the organisation to every query and fails closed, and a test fails when a tenant model is missing from the list. Built-in and custom roles, invitations, and policy checks written in plain TypeScript.
- Idempotency and pagination:
Idempotency-Key on writes (ten parallel duplicates create one record) and cursor pagination helpers.
- Webhooks: outbox rows written in the same transaction as the change, signed
t=...,v1=... payloads, 9 attempts (1 + 8 retries) with backoff, delivery log, replay, and a pinned outbound fetch that refuses private and metadata addresses.
- Jobs: a persistent queue with leases and unique keys that runs inside the API process; a BullMQ adapter is a documented swap.
- Also included: uploads (local disk or S3-compatible, magic-byte allow-list, signed URLs), mail (log or SMTP), audit log, rate limiting, health and Prometheus metrics, request ids and structured logs, stable error codes with English and Spanish messages, OpenAPI 3.1 with Swagger UI and Redoc, a billing skeleton with a simulated gateway, and an example Inventory module you can delete.
- Gemini AI admin tools (bring your own key): AI actions on most console pages: explain an API error or log entry, summarise the audit trail, draft webhook payload docs, flag anomalies in request rates and errors, ask in plain English over users, keys and jobs (allow-listed filters only), generate OpenAPI descriptions for a generated module and draft release notes. Every answer is a preview you edit and accept; nothing is saved automatically. Prompts are redacted before they leave the server, a daily limit and usage log are built in, and
POST /v1/ai/complete (scope-guarded and rate limited) is a starting point for your own AI features. The package contains no Gemini key: you add your own and Google bills it; without one the buttons say "Add your Gemini key in Settings". A Google Translate switcher sits in the console and docs header; keys, secrets, users and the audit trail are excluded from translation.
- Generator:
npm run rivet:module -- Orders creates a tenant-safe module with schema, migration, controller, service and e2e tests, and refuses to overwrite files.
The console and the docs
The console (React, 70 KB gzipped, served by the API) has an overview with the Rivet Line, users and sessions, organisations, roles, API keys, webhooks with delivery detail and replay, jobs, audit, AI tools, settings and an inventory browser. Thirty-six guides cover getting started, configuration, every feature above, deployment, CI, security and upgrading.
What you get
The complete source (API, console, Prisma schema and migrations, tests, scripts), Dockerfile and docker-compose, GitHub Actions and GitLab CI templates, a setup wizard (npm run setup), demo data (npm run seed), Documentation/index.html (the guides, readable offline), START-HERE.txt and LICENSE.txt. Support is included for 6 months.
Good to know
- Tested on MySQL; PostgreSQL schema validated. The test suite and the demo run on MySQL 8. The Prisma schema validates on PostgreSQL and the guide lists the two raw statements to port; PostgreSQL is not a tested target.
- One process by default. The API, job runner and webhook dispatcher run together. Redis and BullMQ are a documented swap, not shipped. Rate limits use the database or memory.
- Billing is a skeleton. Plans, subscriptions, proration and a signature-check sample, with a simulated gateway. It is not a billing engine.
- No GraphQL in version 1.
APP_SECRET is required (32 or more characters) and signs tokens and encrypts stored secrets: keep it. Webhook targets on private networks are refused unless you set a switch that is blocked in production.- Email goes to the log until you configure SMTP.
- Name: Rivetpath is a working name checked by a web search only, not a trademark clearance.
- No hosted demo. All organisations, people and data in the screenshots are fictional.
Quality checks
Rivetpath 1.0.0 passed its seven release checks on the final code: type-checking, linting and schema validation (0 errors), 119 unit tests and 78 end-to-end tests on a real MySQL database including races (parallel refreshes, parallel withdrawals of the last units, parallel idempotent writes, one job claimed by three runners), a production build with a 70 KB gzipped console and 36 guides, demo seeding in under a minute, an install test from the packaged zip, and a secret scan.
Security that is tested — Rotating refresh tokens, scoped keys, tenancy that fails closed and policies without escalation.
