1. Name the project
Open Builder and choose a clear project name such as inventory_api. Use a supported Python major/minor version and keep the package name simple (letters, digits, and underscores are easiest to work with).
A practical guide to defining, generating, reviewing, and using FastAPI backend projects with API Besaz.
API Besaz is a configuration-driven backend generator. Your configuration covers project settings, database, entities, APIs, security, background tasks, observability, tests, and deployment if needed. The engine validates that definition and renders files for the selected options. The result is a downloadable backend project—not a replacement for every part of building a product.
Use this walkthrough to understand how the Builder choices fit together. The inventory domain is only an example; choose names and fields that match your own application.
Open Builder and choose a clear project name such as inventory_api. Use a supported Python major/minor version and keep the package name simple (letters, digits, and underscores are easiest to work with).
Create a Category entity with an id and a name. Create a Product entity with an id, name, price (decimal), and stock (integer). Add only fields your API actually needs, and review required/default and min/max constraints before continuing.
If each product belongs to one category, define a many_to_one relationship from Product to Category. Read the relationship direction in the Builder carefully; an incorrect direction can produce a valid but different data model than the one you intended.
Add REST collection paths for products and categories and select the HTTP methods you need. Define collection paths without manually adding /{id}; the engine creates item-level paths according to its generation rules. Review the final endpoint summary before generating.
Enable authentication, admin, caching, WebSockets, GraphQL, background tasks, tests, observability, or Docker files only when you need them. Some options depend on other modules, so resolve any validation message rather than trying to bypass it.
Read every validation message, check the server-calculated token cost, and submit generation. When the job completes, download and extract the ZIP. Start with the generated README and environment example, then inspect migrations, routes, and tests before connecting real services or deploying.
The exact files depend on your configuration. A typical output includes an application package plus dependency and configuration files; selected features may add authentication, migrations, tests, and deployment assets. API Besaz generates backend code, not a complete user-facing frontend for your application.
These tools are not necessarily substitutes. The right combination depends on the problem; API Besaz focuses on defining and generating the backend layer.
Useful for research, architecture suggestions, writing or changing code, troubleshooting, and automating development tasks. Agent output still needs review and testing.
Useful for quickly building interfaces, forms, internal apps, and workflows. When a product needs a custom backend or independent API, the no-code app can consume the generated API.
Lets you define backend data models, relationships, routes, and modules in an explicit configuration, then download a FastAPI project you control.
These settings are passed to the generation engine. Some options depend on validation rules and module dependencies in the configuration model:
Review the final cost in the Token Cost panel before generating. Cost depends on enabled options and entity count; the browser estimate is informational and the server recalculates the charge.
Each entity is made of typed fields. The engine validates supported options and constraints for each field type; check the Builder for the exact controls available.
| Type | Python type | Constraints |
|---|---|---|
| string | str | min_length, max_length, pattern |
| text | str | min_length, max_length, pattern |
| integer | int | min_value, max_value |
| float | float | min_value, max_value |
| decimal | Decimal | min_value, max_value |
| boolean | bool | — |
| date | date | — |
| datetime | datetime | — |
| uuid | UUID | — |
| enum | Enum | choices (required) |
| json | dict | — |
Relationships are defined in your configuration. The engine creates foreign keys or link tables based on the relationship type and validates incompatible definitions.
| Type | Meaning | Example |
|---|---|---|
| many_to_one | Many children → one parent | Many orders → one customer |
| one_to_many | One parent → many children | One customer → many orders |
| many_to_many | Many ↔ many (link table) | Posts ↔ tags |
| one_to_one | Exactly one ↔ one | User ↔ profile |
For REST endpoints, choose the entity, collection path, and allowed HTTP methods in the configuration. The engine adds item-level paths according to its generation rules.
get, post, put, patch, delete{id} — API Besaz adds /{id} for item-level operations automatically.Generates routers and API operations from your configured endpoints and entities. REST is enabled by default in the configuration model.
When enabled, the project includes JWT authentication, session management, and TOTP components. Authentication requires REST and GeoIP to be enabled.
The SQLAdmin interface is optional and, according to engine validation, can only be used when authentication is enabled too.
When enabled with Strawberry selected, GraphQL schema and resolvers are generated alongside the other APIs. This feature requires authentication.
Real-time connections are optional. With authentication enabled, connections use a single-use ticket; without authentication, the connection is anonymous.
Caching can be enabled optionally. The generated project is configured to connect to Redis and needs a reachable Redis service at runtime.
When enabled, RabbitMQ connection code and the components required for broker-backed background work are generated.
Logging and metrics components are generated according to the configuration. Dashboards and supporting services depend on deployment settings.
Docker, Compose, and Nginx assets are generated only when deployment is enabled. Configure TLS at the deployment layer before exposing the app publicly.
Pytest files are derived from entities, endpoints, and enabled modules. Locust generation is independent of pytest; the test count varies by project definition.
Security and maintainability are built into the API Besaz workflow: validated configuration, typed schemas, blueprint-defined ownership and writable-field rules, generated tests, and deployment guidance give you a concrete backend foundation to inspect and extend. The platform has been assessed with established security tools and manual checks, so you can continue development from a tested starting point rather than a blank scaffold.
The engine validates project configuration before generation. Blueprint-defined resources can generate typed schemas and constraints, per-user ownership checks, role-aware access rules, and restrictions on which fields clients may write. When ownership, roles, and writable fields are defined correctly, these controls are designed to prevent common IDOR and mass-assignment paths in generated routes. Defense in depth means these layers reinforce one another; custom routes, altered authorization logic, or incorrect configuration still require review.
API Besaz has been tested with CodeQL static analysis, OWASP ZAP web/API scanning, and OpenVAS infrastructure assessment, alongside manual security checks. The reported scanner findings were reviewed and classified as false positives within the tested scope; the assessed build passed those checks after review. This is meaningful test evidence for the evaluated version and configuration—not a claim that untested application-specific code can never contain a vulnerability.
Manual checks covered IDOR/broken access control and Mass Assignment. The included internal report records 29 passing probes, zero failures, and two not-applicable cases caused by test-request or route mismatches. For blueprint-defined resources, correctly configured ownership rules scope record access, while generated schemas and protected-field handling limit what a client can set or change. These protections apply to the generated routes and configuration that were tested; custom endpoints and business rules need their own authorization and input-validation tests.
Load testing reached up to 2,500 requests per second in the tested setup. Locust scenario support can also be included in generated projects when enabled. The result demonstrates useful throughput under that workload and environment; actual capacity depends on endpoint behavior, database queries, hardware, worker/replica count, network conditions, and configuration. Before production, measure throughput together with P50/P95/P99 latency and error rate under your own representative workload.
The generated backend is delivered as a downloadable project that you can inspect, modify, test, version-control and deploy using your preferred development workflow. API Besaz reduces repetitive backend scaffolding; it does not require the generated application to call API Besaz at runtime. You still own the architecture decisions, integrations, security review and ongoing maintenance.
When enabled, generated projects can include structured logs, request IDs, Prometheus metrics and health/readiness endpoints, with Grafana, Loki and related deployment assets according to configuration. Use these signals to measure real latency, errors and saturation rather than relying on a headline requests-per-second number.
GeoLite2 is included by default in generated project ZIPs when GeoIP is enabled. Grafana plugins are not included in project ZIPs; download a compatible plugin bundle and the latest GeoLite2 database from the Downloads page.
Grafana plugin files are not bundled in generated project ZIPs. Download the compatible Loki and Prometheus plugin bundle from the Downloads page when it is listed, then extract the files to grafana/plugins/loki/ and grafana/plugins/prometheus/ respectively. If the combined bundle is not listed, use the official links below. open Downloads. Grafana's official plugin installation guide.
When GeoIP is enabled, the GeoLite2-Country.mmdb database is included in the generated project ZIP by default at the path below. To refresh an existing project, download the latest database from the Downloads page and replace that file. Without the database, country lookup falls back to Unknown. IP geolocation is approximate and must not be treated as a precise address. open Downloads.
app/geoip/GeoLite2-Country.mmdb Get GeoLite2 from MaxMind
Generation cost is not the same for every project. It depends on core settings, enabled modules, and entities; the Builder estimate shows the configured cost before you submit a generation request.
See Pricing for current bundles.
Use the specific validation or job message first. Avoid posting passwords, tokens, private configuration, or environment files when asking for help.
Open the validation summary and fix the first reported issue, then validate again. Check entity and field names, supported field types, enum choices, relationship targets, and endpoint paths. A configuration must meet the engine's structural requirements before generation can start.
Optional features are generated only when selected and compatible with the rest of the Blueprint. Check the feature toggles and dependency messages. A deployment file will not appear if the corresponding deployment option was not enabled.
Check the project status before submitting another request to avoid duplicate work. If the status remains stuck or fails repeatedly, save the project/job identifier and the non-sensitive error message, then contact support. Queue and worker availability can affect completion time.
Generated download links are time-limited. Return to your project/dashboard and request a fresh download when that action is available. If the project is no longer listed, contact support with its identifier; do not share signed download URLs publicly.
Extract the ZIP and read its README first. Install the declared dependencies, create local environment settings from the example without committing secrets, configure a reachable database and any enabled services, and run migrations before the test suite. Generated code is a starting point: review test failures, security settings, permissions, and production deployment choices before launch.
The generated files are provided for you to review and change. You must also follow the licenses of dependencies and any license files included in the output.
Both database options are supported in the configuration. The right choice depends on workload, concurrency, backups, and operational requirements.
Review the cost shown in the Builder before generating. If your balance is insufficient, add tokens first; check the dashboard for the status of any saved project configuration.
Admin is an add-on that requires the Auth Package — users need to log in to reach the admin panel.