Applications

Every table in oikapi belongs to an application. Applications are logical business domains like “CRM”, “HR”, or “Inventory” that group related tables and enforce security boundaries.

Why applications matter

• Organization – Find related tables quickly
• Permissions – Grant a role access to an entire application with one rule instead of per-table
• Security boundaries – Business rules can only access tables within their own application
• Packaging – Export an entire application as an installable .oikapp package

The system application

The system application is created automatically and contains platform tables: users, permissions, roles, audit logs, business rules. It cannot be deleted and is accessible from all other applications.

Creating applications

POST /api/applications
{
  "name": "support",
  "display_name": "Customer Support",
  "description": "Support tickets and knowledge base",
  "category": "business"
}

Name rules: lowercase, letters/numbers/underscores only, must start with a letter.

Categories: admin, business, operations

Assigning tables

Every table must specify its application at creation time. The application is set via the URL path:

POST /api/apps/support/tables
{
  "name": "tickets",
  "display_name": "Tickets"
}

Note

Table names are NOT prefixed with the application name. A table called tickets in the support application is accessed as /api/apps/support/tables/tickets/records. The application name appears in the URL path, not the table name.

Listing applications

GET /api/applications

Deleting applications

DELETE /api/applications/{name}

All tables must be deleted first. System applications cannot be deleted.

Application boundaries

Business rules running on a table in one application cannot access tables in another application unless explicitly granted cross-app access. This is a security feature – your CRM rules can’t accidentally read HR salary data.

A bare table name refers to a table in the rule’s own application. To reach another application, use a dotted application.table reference — which is only allowed when cross-app access has been granted.

Same-app access (allowed):

// Rule on customers (application: crm)
const deals = list('deals', '');        // OK - same app
const contacts = list('contacts', '');  // OK - same app

Cross-app access (requires a grant):

// Rule on customers (application: crm)
const salaries = list('hr.employees', ''); // BLOCKED unless cross-app access is granted

See Business Rules for how to declare cross-app access when needed.