Expressa

Expressa helps developers create basic collection REST APIs in Node.js and Express by defining collections with JSON Schema instead of custom code. Its Django-like admin interface lets users add and edit collection schemas, create REST endpoints, and manage permissions. The generated endpoints support listing and retrieving records, Mongo-style queries, pagination, field projection, schema retrieval, creation, replacement, updates, and deletion. Schemas can also be reused in a frontend to generate forms. Storage is configured per collection, with JSON-file and in-memory storage available out of the box and MongoDB or PostgreSQL available when their drivers are installed. Developers can combine it with other Express middleware and endpoints, or add event listeners that stop or modify requests and responses.

It is for Node.js and Express developers who want data-driven, schema-defined APIs with an administration interface, while retaining room to add more complex features. It requires Node.js 20 or newer.

The research does not identify a paid product that Expressa replaces, so a direct paid-product comparison is not supported. Its documented boundaries are that it is middleware rather than a full framework, and MongoDB and PostgreSQL support requires separately installed drivers.

Fixes 2 security vulnerabilities: * [Unauthenticated remote code execution via the $where operator in the collection REST API](https://github.com/thomas4019/expressa/security/advisories/GHSA-vx6m-5p2v-fcvg) * [NoSQL injection in collection endpoint can allow indirect password access](https://github.com/thomas4019/expressa/security/advisories/GHSA-7hv5-qm2g-h8vx)

Full release notes →