---
title: "PostgREST with the service key (PATCH, bypasses RLS)"
method: PATCH
path: "/projects/v1/{project_id}/rest/{path}"
tags: ["Projects"]
---

# PostgREST with the service key (PATCH, bypasses RLS)

`PATCH /projects/v1/{project_id}/rest/{path}`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/projects/v1/{project_id}/rest/{path}`
- Auth: one of:
  - HTTP bearer
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

The project-scoped PostgREST forwarder for server-side code holding the project service key (role service_role, bypasses row-level security): the route behind in-function adminDb().from(). The path's project must be the key's (403 PROJECT_MISMATCH otherwise). /rest/v1/* refuses the service key; end users and browsers use /rest/v1/* with the anon key. Replaces /admin/v1/rest/*, which is retiring. A SIWX wallet (SIGN-IN-WITH-X), a sign-in session bearer, or a grant key bearer is also accepted, authorized by the caller's own authority on the project (no service key): project.database.read (org role viewer or higher, or a grant / grant key carrying database:read) and project.database.write (developer or higher, or database:write, which also reads). The credential's shape picks the path; a principal call never returns a key and is audited (with a SHA-256 of the request, never its text) before it runs. A non-member, or a principal without the authority, gets 403 FORBIDDEN with next_actions (ask an org owner or admin for a role, ask for a grant with the capability, or import the service key), and the same answer whether or not the project exists. A principal PATCH needs project.database.write.

## Path parameters

- `project_id` string, required: Run402 project ID. Public IDs are not UUIDs.
- `path` string, required

## Request body

- unknown

## Response `200`

PostgREST's response, passed through

- unknown

## Other responses

- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.
- `403`: The key belongs to another project

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)