RESTHeart

A backend for web, mobile, AI and IoT apps.

---

What RESTHeart is

RESTHeart is a backend for web, mobile, AI and IoT apps. It gives an application the backend it would otherwise have to write — AI agents and RAG, accounts, permissions, data APIs, live data, email, payments — as configuration, not code. What an application needs beyond it goes into plugins, in Java, Kotlin, JavaScript or TypeScript.

Example

curl "https://demo.restheart.org/messages?filter={\"from\":\"Bob\"}&pagesize=1"

No route was written for /messages. It is a MongoDB collection, and the query parameters (filter, pagesize, sorting) map directly to MongoDB's query language.

Core capabilities

• AI agents: an MCP server, so agents use the application's APIs under the same permissions as its users
• RAG and vector search: embeddings computed on write (Voyage AI, any OpenAI-compatible endpoint, Ollama), uploaded documents chunked for retrieval, results re-ranked
• Accounts: sign-up, login, email verification, password reset, team invitations, Google sign-in, tokens and API keys
• Authentication and Authorization: JWT, OAuth2, LDAP, MongoDB-based users, ACL rules per role, down to the documents a user may read or change, defined as data, not code
• REST API: full CRUD, aggregations, filtering, sorting, pagination, JSON Schema validation, generated from the database schema
• GraphQL: schema-driven mapping to MongoDB queries
• WebSocket: change streams exposed as real-time data sync
• SSE: Server-Sent Events for dashboards, IoT feeds, and event streams
• Email: transactional messages from templates, over your own SMTP
• Payments: Stripe plans, seats and products
• Plugin framework: custom services, interceptors, and initializers in Java, Kotlin, JavaScript, or TypeScript, for the logic a declarative API cannot cover
• Metrics and monitoring: a Prometheus-compatible endpoint plus a browser dashboard at /metrics-ui, tracking request rates, latency percentiles, and HTTP status distribution
• IoT / MQTT: bridge an MQTT broker into RESTHeart — topic messages become Server-Sent Events, REST responses, or MongoDB documents. A separate module, installed into an instance rather than shipped with it.

Distributed as a Docker image and a GraalVM native binary. Built on Java 25, Undertow, and virtual threads.

Running it

Fully managed, no installation required, and including Sophia, an MCP server and browser assistant that exposes RESTHeart's docs and plugin API to AI coding assistants such as Claude Code, Cursor, or VS Code:

Or self-hosted, since the core is free and open source:

curl https://raw.githubusercontent.com/SoftInstigate/restheart/master/docker-compose.yml \
  --output docker-compose.yml && docker compose up --attach restheart

curl http://localhost:8080/ping

Supported MongoDB versions

Every build is tested against MongoDB 7.0, 8.0, 8.3 and 9.0, and against mongodb/mongodb-atlas-local.

Older versions should work too, down to MongoDB 4.2, the oldest the MongoDB Java driver connects to, but they are not tested and some features may need a newer server. If something does not work on your version, please open an issue.

Some features need more than a standalone server:

• Transactions and change streams, which the WebSocket and SSE streams of collection changes rely on, need a replica set. A single-node one is enough, like the one in docker-compose.yml.
• Vector search indexes and $vectorSearch need mongot: MongoDB Atlas, mongodb-atlas-local, or Community/Enterprise 8.2+ with mongot. $vectorScan works on any MongoDB, without an index.

Full documentation: https://restheart.org/docs/

---

License

RESTHeart core is licensed under the GNU AGPL v3.

restheart-commons, the Maven artifact plugins depend on to reach the Approved Interfaces, is licensed under the Apache License 2.0. Plugins that depend only on restheart-commons, without linking against RESTHeart's AGPL-licensed core, can be distributed under any license, including proprietary ones. See PLUGIN_EXCEPTION.md for the exact terms of this permission.

---