PocketBase API Rules

# PocketBase API Rules & Filter Expressions ## Rule Types Each collection has 5 rule types. Each rule is a **filter expression** that must evaluate to `true` for the request to proceed. | Rule | Controls | Locked = | Empty string = | |------|----------|----------|----------------| | **List** | `GET /api/collections/{name}/records` | superusers only | everyone can list | | **View** | `GET /api/collections/{name}/records/{id}` | superusers only | everyone can view | | **Create** | `POST /api/collections/{name}/records` | superusers only | everyone can create | | **Update** | `PATCH /api/collections/{name}/records/{id}` | superusers only | everyone can update | | **Delete** | `DELETE /api/collections/{name}/records/{id}` | superusers only | everyone can delete | **Critical**: `null`/locked means only superusers can perform the action (regular users and guests are denied). Empty string `""` means EVERYONE including guests. Superusers always bypass API rules entirely — see below. ## Superuser Bypass Superusers (formerly admins) **always bypass API rules**. Rules only apply to regular auth records and guests. ## Filter Syntax ### Operators | Operator | Meaning | Example | |----------|---------|---------| | `=` | Equal | `status = "active"` | | `!=` | Not equal | `status != "draft"` | | `>` | Greater than | `count > 5` | | `>=` | Greater or equal | `count >= 5` | | `<` | Less than | `count < 10` | | `<=` | Less or equal | `count ` | Any greater than | `scores ?> 90` | | `?>=` | Any greater or equal | `scores ?>= 90` | | `?<` | Any less than | `scores ?< 10` | | `?<=` | Any less or equal | `scores ?= 2 // Check each tag is from allowed list @request.body.tags:each ?= @collection.allowed_tags.id ``` ## Datetime Macros | Macro | Example output | |-------|----------------| | `@now` | `2024-01-15 10:30:00.000Z` | | `@second` | `2024-01-15 10:30:00.000Z` | | `@minute` | `2024-01-15 10:30:00.000Z` | | `@hour` | `2024-01-15 10:00:00.000Z` | | `@day` | `2024-01-15 00:00:00.000Z` | | `@month` | `2024-01-01 00:00:00.000Z` | | `@year` | `2024-01-01 00:00:00.000Z` | | `@todayStart` | `2024-01-15 00:00:00.000Z` | | `@todayEnd` | `2024-01-15 23:59:59.999Z` | | `@monthStart` | `2024-01-01 00:00:00.000Z` | | `@monthEnd` | `2024-01-31 23:59:59.999Z` | | `@yearStart` | `2024-01-01 00:00:00.000Z` | | `@yearEnd` | `2024-12-31 23:59:59.999Z` | Arithmetic: `@now - 7d`, `@now + 1h`, `@now - 30m` ## `geoDistance()` For location-based filtering: ``` geoDistance(lat, lon, 40.7128, -74.0060) @now ```