Build a Headless Blog

Create the posts collection

Navigate to Data Model in the DaaS Studio and click Create Collection:

• Name: posts
• Primary key type: integer (auto-increment)

Add the following fields:

Create a read policy and a static API token

All BuildPad DaaS API requests require a valid token — there is no anonymous/unauthenticated access. The pattern for a public-facing frontend is to create a read-only policy, a dedicated reader user, and embed that user’s static token in your app.

Create the policy:

1. Go to Policies → click Add Policy and name it (e.g., Public Read). Leave Admin access and App access off then click Create.
2. On the policy detail page, scroll to the Permissions section.
3. Click Add Collection, find posts in the list, and click it — the row is added with full read access (green R badge) automatically.
4. Click the green R badge in the posts row and select Use Custom — a modal opens.
5. On the Field Permissions tab (shown by default), select only the fields you want to expose publicly.
6. Switch to the Item Permissions tab and set the filter: { "status": { "_eq": "published" } }
7. Click Save.

Create the reader user and attach the policy:

7. Go to Users → click Add User → fill in an email (e.g. reader@your-domain.com) and a password. Leave the role unset → click Create. You’ll be redirected to the users list.
8. Click the reader user to open it → go to the Policies tab → attach the Public Read policy you just created.
9. Switch to the Basic Information tab → find the Token field → click the + icon button (tooltip: “Generate Token”) → copy the revealed value → click Save. This is your <public_read_token>.

Create some posts

Navigate to Content → posts and create a few posts. Set at least one to status: published.

Fetch posts from your frontend

Use the static token you generated in the previous step:

curl -g "https://your-domain.com/api/items/posts?filter[status][_eq]=published&sort=-published_at&fields=id,title,slug,published_at" \
  -H "Authorization: Bearer <public_read_token>"

const res = await fetch(
  'https://your-domain.com/api/items/posts?filter[status][_eq]=published&sort=-published_at&fields=id,title,slug,published_at',
  { headers: { Authorization: 'Bearer <public_read_token>' } }
)
const { data: posts } = await res.json()

Fetch a single post by slug

const res = await fetch(
  `https://your-domain.com/api/items/posts?filter[slug][_eq]=${slug}&filter[status][_eq]=published&fields=*`,
  { headers: { Authorization: 'Bearer <public_read_token>' } }
)
const { data } = await res.json()
const post = data[0]