Project 28 of 39 · Backend and web
Acquisitions API
REST API for acquisitions and authentication with JWT sessions in HTTP-only cookies, role-based access control, Zod input validation, Drizzle over PostgreSQL, and Arcjet for rate limiting and bot defence. Documented with Swagger.
01Overview
A REST API for acquisitions and authentication, built with sessions in HTTP-only cookies and role-based access control.
Security is treated as the feature rather than an afterthought: rate limiting and bot defence at the edge, strict input validation, and security headers on every response.
02How it is built
- Role-based access control across user and administrator actions.
- Typed database access with migrations rather than ad-hoc queries.
- Rate limiting and bot protection in front of the API.
- Interactive API documentation kept alongside the code.