APIs and integrations
Dataira exposes focused surfaces rather than one mandatory stack.
| Surface | Use it for |
|---|---|
@dataira/react | A polished, host-themeable analytics workspace |
@dataira/client | A framework-agnostic, fully custom frontend |
@dataira/node | Server helpers for tokens, policy bindings, OpenAPI, packs, execution, Projects, Environments, and keys |
| REST API | Any backend language without the Node package |
| MCP | Ask governed data questions from an AI coding tool |
| Tunnel CLI | Reach a datasource without opening inbound network access |
OpenAPI and later GraphQL are input datasource adapters, not additional
public Dataira query protocols. OpenAPI v2 compiles an approved same-origin
OpenAPI 3.x JSON/YAML specification and only reviewed side-effect-free GET or
POST query/computation operations. Execution uses private pinned-IP TLS egress
and remains fail-closed unless the environment advertises connector, egress,
and quota capabilities. GraphQL persisted operations are specified for later.
Use the FretGuard pilot for a complete source, pack, deterministic computation, drift, and rollback example.
Saved analytical results are never trusted as standalone JSON. First-party and MCP saves require a live datasource, read-only SQL, and a bounded tabular result. Dataira validates current column access and stores the datasource authorization generation with the result. Reads, dashboard widgets, and refreshes return no result, chart data, or SQL when that provenance is missing or stale. Embed clients may save a draft inherited from the signed end-user scope; it is marked unverified and cannot become certified evidence.
Embed SDK
The React and headless packages use the same end-user token and REST resources, so you can start with the complete UI and replace individual pieces later. The Node package is optional; a backend in any language can perform the same token exchange over HTTPS.
Start with the SDK overview.
MCP
MCP lets tools such as Claude Code, Codex, and other MCP clients author packs or
ask governed questions with a scoped token. Pack-read permission alone never
authorizes data execution. The management impersonation tool additionally
requires both queries.read and embed.access.manage, resolves current subject
generations server-side, and records the actor and delegated subject.
Tunnel CLI
The tunnel opens an outbound connection from your network to Dataira. Use it for localhost, private networks, or databases that must not expose an inbound port.