Reference-safe migration workflow for production schema evolution.
Master data
List with filters (WHERE DSL), paging, sort.
Create, update, soft / hard delete; restore where allowed.
Validation endpoints for create/update, reference pickers, column suggestions, similar-record detection.
Bulk import/export (JSON, CSV, XLSX) Pro+.
Bulk update/delete by SQL filter and per-row SQL expression Enterprise — UI and API; see docs.
Time travelEnterprise — view and export published data as of a UTC instant when historization is enabled; list/export asOfUtc, bounds API, clock control on Data. See docs.
Saved filtersEnterprise — per-user named WHERE/view presets on the Data grid (flat entities); save, load, apply to URL, delete. See docs.
AliasesPro+ — faster form prefill.
Approvals & history Pro+
Edit vs approved tables when approval is required.
Approve or reject by row or by edit_batch_name batch.
Optional history with valid-from / valid-to windows.
Entity analytics snapshot — per-column fill/null/distinct stats for data stewardship.
Permissions & audit
Scoped by domain and entity: read, write, approve, admin.
Entra app roles for global admins.
Permissions YAML import/export; role ↔ entity matrix.
Audit log query APIEnterprise — who did what, when.
Admin controls
API keys — create/delete keys, optional global-admin mode, and scoped permissions.
Role management — list roles, assign/remove users in app roles.
Global admin tooling for permissions, webhooks, packages, and operational governance.
Search & consumption views
Global search across entity metadata and data values with permission-aware results.
Consumption views — read-only SQL views exposed as JSON/CSV API endpoints.
Entity analytics snapshot Pro+ for stewardship metrics and health checks.
Packages (ZIP)Enterprise — promote entities + config across environments.
YAML import/export for permissions and webhooks; package deploy with overwrite controls.
Operations & runtime
Authentication modes: browser session (OIDC) plus bearer/API key for integrations.
Health endpoints for liveness/readiness and deployment-safe monitoring.
CLI for automation plus downloadable Windows and Ubuntu/Linux packages.
Security
Security headers — CSP, X-Frame-Options, HSTS, Referrer-Policy out of the box.
Rate limiting — configurable per-client API throttling (fixed window).
Webhook URL policy — configurable validation (default off) with AllowAllExceptLocalhost or strict allowlist mode.
Audit-friendly blocking logs — blocked webhook calls are logged with mode, URL, and reason.
Data classification masking — built-in and custom restriction tags (managed in System security settings) are masked as * in views/exports unless the caller has view restricted permission.
Parameterized queries — all SQL via safe DSL; no raw user input in queries.
ZIP deploy safety — path traversal validation on package imports.
Regex timeout — validation patterns run with bounded execution time.