---
title: "Turn the REST API on (or change public access): apps using @vercel/kv, @upstash/redis or @upstash/ratelimit work unchanged. Returns a read-write and a read-only token, shown once; earlier tokens stop working."
method: POST
path: "/databases/{databaseId}/rest"
tags: ["Databases"]
---

# Turn the REST API on (or change public access): apps using @vercel/kv, @upstash/redis or @upstash/ratelimit work unchanged. Returns a read-write and a read-only token, shown once; earlier tokens stop working.

`POST /databases/{databaseId}/rest`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/databases/{databaseId}/rest`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `databaseId` string, uuid, required

## Request body

- object
  - `public` boolean: also answer on https://kv-<team>.<app domain> (default false: team network only)

## Response `200`

REST API with new tokens

- object
  - `databaseId` string, uuid, required
  - `supported` boolean, required: the REST API exists for Redis databases only
  - `enabled` boolean, required
  - `public` boolean, required: also answers on the public https address (for browsers and builds outside the team network)
  - `status` 'disabled' | 'provisioning' | 'running' | 'error', required: the team's REST gateway: provisioning while it starts (about a minute the first time)
  - `statusDetail` string, nullable, required
  - `restUrl` string, nullable, required: KV_REST_API_URL / UPSTASH_REDIS_REST_URL for apps on the team network (http://kvrest-<id>:8079)
  - `publicUrl` string, nullable, required: the public https address, when public is on
  - `tokens` object[], required: live tokens (never their values)
    - `kind` 'rw' | 'ro', required
    - `createdAt` string, required: ISO-8601 timestamp
  - `env` object[], required: the environment variables an app needs, as Vercel KV names them
    - `key` string, required
    - `value` string, required: what to put there (tokens: shown once when made)
  - `notes` string[], required
  - `updatedAt` string, nullable, required: ISO-8601 timestamp
  - `token` string, nullable, required: read-write token (KV_REST_API_TOKEN, UPSTASH_REDIS_REST_TOKEN); shown once; null when not replaced
  - `readOnlyToken` string, nullable, required: read-only token (KV_REST_API_READ_ONLY_TOKEN); shown once; null when not replaced

## Other responses

- `400`: Invalid request (code invalid_request), e.g. not a Redis database
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict): the database is not ready yet, or REST is off
- `429`: Too many requests (code rate_limited); see Retry-After
- `501`: Not available on this server (code not_configured)
- `503`: Hosting engine unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)