sgcREST REST APIs, native in Delphi. OpenAPI built in.

Two jobs, seven classes. TsgcHTTPRESTServer publishes a REST API with CORS, /metrics and /health, multi-tenancy and a user store. An OpenAPI engine serves an API straight from an OpenAPI 3.x contract, or generates the contract from your Delphi class, and TsgcOpenAPI_Client consumes any OpenAPI-described API. The sgcWebSockets Core runtime is included.

Publish your first endpoint in a few lines →
  • Delphi 7 to 13
  • C++ Builder
  • OpenAPI 3.x
  • CORS
  • /metrics and /health
  • Multi-tenancy
  • Full source code
  • 4Palette components: REST server, stats, tenancy and users
  • 7Classes total, REST server family, OpenAPI engine and client
  • 4Client auth schemes: Basic, bearer token, OAuth2 and JWT
  • 2Built-in endpoints, /metrics and /health, both opt in
  • 100%Source code included with every license
Watch it work

See sgcREST in two minutes.

A narrated and captioned walkthrough of the REST server: the HTTP server you already know, plus the four things a REST API always ends up needing. Nothing downloads until you press play.

sgcREST quickstart

Build a REST API server in Delphi with CORS, live statistics, tenancy and users.

  1. Everything inheritedTsgcHTTPRESTServer descends from TsgcHTTPServer: Port, TLS, Authentication, sessions, compression, the thread pool, the firewall and the rate limiter.
  2. All of it opt inCORS is off by default, ServerStats and Tenancy are unassigned. Nothing turns itself on after an upgrade.
  3. CORSList the origins, methods and headers you allow, and the server answers the OPTIONS preflight for you.
  4. Metrics and healthAssign TsgcHTTPServerStats and get /metrics and /health, both behind the server's authentication gate.
  5. Multi-tenancyEvery request is mapped to a tenant from the host, the path, a header or a JWT claim. Handlers just read Tenant.
  6. A user store, ready madeAccounts, salted password hashes and roles. The built-in Basic gate resolves every credential against it.
What is in the box

Four palette components, three code-only classes.

The REST server and its three companions are non-visual components on the SGC REST palette page. The OpenAPI server engine and the OpenAPI client live in the sgcHTTP_OpenAPI_* units: create one, configure it and call its methods directly.

REST Server · one server, three companions

View →
  • TsgcHTTPRESTServer
  • TsgcHTTPServerStats
  • TsgcHTTPServer_Tenancy
  • TsgcHTTPServer_Users
  • CORSOptions
  • ServerStats
  • Tenancy
  • Tenant

TsgcHTTPRESTServer extends the standard TsgcHTTPServer with CORS handling through CORSOptions, and two properties for optional companions. TsgcHTTPServerStats counts every request by status class, tracks latency minimum, average and maximum, and serves a Prometheus-format /metrics endpoint plus a JSON /health endpoint, with GetEndpointStats for a per-route breakdown. TsgcHTTPServer_Tenancy resolves the caller's tenant from the host name, a path segment, a request header or a JWT claim, and Tenant reads the result for the request being served. TsgcHTTPServer_Users is a standalone store of accounts, salted password hashes and roles.

OpenAPI Server · spec-first or code-first

View →
  • TsgcOpenAPIRouteTable
  • TsgcOpenAPIServerContext
  • TsgcOpenAPIServerHandler
  • TsgcOpenAPIJSONValidator
  • TsgcOpenAPICodeFirstScanner
  • RespondJSON

Load an OpenAPI 3.0 or 3.1 document and the route table is built from its paths section. A matched request arrives as a TsgcOpenAPIServerContext, with typed path and query parameters, body helpers and RespondJSON/RespondError, and the validator checks bodies, query and path parameters against the JSON Schemas the spec declares. Code-first flips the source of truth: annotate a plain Delphi class and the scanner generates the spec.

OpenAPI Client · any described API

View →
  • TsgcOpenAPI_Client
  • SetBaseURL
  • HTTP_REQUEST
  • HTTP_REQUEST_Async
  • Authentication
  • OnBeforeRequest
  • OnUpload
  • OnDownload

A generic runtime client for any endpoint an OpenAPI document describes, and the base class behind generated SDKs. Authentication covers Basic auth and bearer tokens plus generic OAuth2 and JWT, HTTP_REQUEST carries the call, and OnBeforeRequest, OnUpload and OnDownload track it.

See every component and property

How it works

One server, composable companions.

The seven classes split cleanly by role. The REST server carries the HTTP traffic, three companions add what a production API needs, and the OpenAPI engine turns a spec, written or generated, into a working route table.

A TsgcHTTPServer with extras

TsgcHTTPRESTServer inherits the bindings, TLS and HTTP/2 handling of the plain HTTP server that ships in every sgcWebSockets edition, and adds CORS plus the companion properties, so a REST API gets metrics, health checks and multi-tenancy without a separate framework.

Companions, not baked in

Stats, tenancy and users are separate components. Attach the ones a given API needs and leave the rest out. An attached but unconfigured companion costs the server nothing to check.

Spec-first and code-first, one route table

Whether the OpenAPI document comes from a file you loaded or from TsgcOpenAPICodeFirstScanner.GenerateSpec scanning an attributed class, the same route table and request context serve either one.

Every callback the spec needs

Validation and authentication events receive the parsed TsgcOpenAPIServerContext, with PathParams, QueryParams and RespondJSON, and OnException catches handler errors before they reach the wire, so nothing about why a call was accepted or rejected is hidden from you.

Six platforms, no add-on

All seven classes run on the standard Indy library that ships with RAD Studio: Windows Win32 and Win64, Linux64, macOS, iOS and Android. From Delphi 7 through RAD Studio 13 and on C++ Builder.

The Core runtime is in the box

The sgcWebSockets Core runtime contributes the HTTP/TLS stack the REST server and every OpenAPI class run on, and the JSON layer that serializes every request and response. Its full source is part of the package like everything else.

Quick start

Publish an endpoint, publish a contract, or call one.

The REST server hands you the request directly. The OpenAPI server hands you a validated, already matched operation. The OpenAPI client calls someone else's endpoints. All three compile the same in Delphi 7 to 13 and C++ Builder.

uses
  sgcHTTP_REST_Server, sgcHTTP_REST_Server_Stats;
var
  RESTServer: TsgcHTTPRESTServer;
  Stats: TsgcHTTPServerStats;
begin
  // REST server: CORS, health/metrics and tenancy in one component
  RESTServer := TsgcHTTPRESTServer.Create(nil);
  Stats := TsgcHTTPServerStats.Create(nil);
  Stats.Endpoints.Health.Enabled := True;

  RESTServer.Port := 8080;
  RESTServer.CORSOptions.Enabled := True;
  RESTServer.CORSOptions.AllowOrigins := 'https://app.example.com';
  RESTServer.ServerStats := Stats;
  RESTServer.OnCommandGet := RESTServerCommandGet;
  RESTServer.Active := True;
end;

procedure TForm1.RESTServerCommandGet(AContext: TIdContext;
  ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo);
begin
  AResponseInfo.ContentText := '{"status":"ok"}';
end;
uses
  sgcWebSocket_Server_API_OpenAPI, sgcHTTP_Server;
var
  OpenAPIServer: TsgcWSAPIServer_OpenAPI;
begin
  // OpenAPI server: load the contract, dispatch by operation id
  OpenAPIServer := TsgcWSAPIServer_OpenAPI.Create(nil);
  OpenAPIServer.Server := sgcHTTPServer1;
  OpenAPIServer.LoadFromFile('petstore.json');
  OpenAPIServer.OnRequest := OpenAPIServerRequest;

  sgcHTTPServer1.Port := 8080;
  sgcHTTPServer1.Active := True;
end;

procedure TForm1.OpenAPIServerRequest(Sender: TObject;
  const aOperationId: string; const aContext: TsgcOpenAPIServerContext;
  var Handled: Boolean);
begin
  if aOperationId = 'getPetById' then
  begin
    aContext.RespondJSON(200,
      '{"id":"' + aContext.PathParamAsString('petId') + '","name":"Rex"}');
    Handled := True;
  end;
end;
uses
  sgcHTTP_OpenAPI_Client;
var
  APIClient: TsgcOpenAPI_Client;
  Request: TsgcOpenAPIRequest;
  Response: TsgcOpenAPIResponse;
begin
  // OpenAPI client: call any OpenAPI-described API with basic auth
  APIClient := TsgcOpenAPI_Client.Create(nil);
  APIClient.SetBaseURL('https://api.example.com');
  APIClient.Authentication.Basic.Enabled := True;
  APIClient.Authentication.Basic.Username := 'apiuser';
  APIClient.Authentication.Basic.Password := '...';

  Request := TsgcOpenAPIRequest.Create;
  Response := TsgcOpenAPIResponse.Create;
  APIClient.HTTP_REQUEST(Request, Response);
end;
  1. CORS, answered for youEnable CORSOptions, list the origins, methods and headers you allow, and the server answers the OPTIONS preflight. It applies to your handlers and to files served from DocumentRoot.
  2. Stats in one assignmentAssign TsgcHTTPServerStats to ServerStats for /metrics and /health. Leave it unassigned and no counters are kept at all.
  3. Tenancy before your code runsAssign TsgcHTTPServer_Tenancy and every request is mapped to a tenant first. Your handlers just read Tenant.
  4. Users without a handlerAssign TsgcHTTPServer_Users to Authentication.Users and the built-in Basic gate resolves every credential by itself.
sgcREST quickstart: TsgcHTTPServerStats enables the Metrics and Health endpoints, GET /metrics returns the request counters and GET /health returns a JSON status.
Three lines of setup, then GET /metrics and GET /health answer on their own.

The full feature matrix

Before you buy

Two things worth knowing first.

What sgcREST needs from you, and what it does not. Both answers are short, and both are on this page rather than in the small print.

publish a REST API
TsgcHTTPRESTServer        CORS, ServerStats, Tenancy
TsgcHTTPServerStats       /metrics and /health
TsgcHTTPServer_Tenancy    host, path, header, JWT claim
TsgcHTTPServer_Users      accounts, hashes, roles

publish from an OpenAPI 3.x contract
route table + context     spec-first, Delphi 7 to 13
code-first scanner        attributed class, XE7 and up

consume an API
TsgcOpenAPI_Client        any OpenAPI-described API

TsgcHTTPRESTServer is a TsgcHTTPServer
  descendant, so it publishes from the Port,
  TLS and Authentication you already use.

sgcREST is self-contained

Standalone, the sgcWebSockets Core runtime is included: the HTTP/TLS server and client stack the REST server and every OpenAPI class run on, and the JSON layer that serializes every request and response. One installer, and sgcREST runs on the standard Indy library that ships with RAD Studio.

Code-first OpenAPI needs Delphi XE7+

Generating a spec from an attributed Delphi class relies on the RTTI that arrived in Delphi XE7, so TsgcOpenAPICodeFirstScanner and TsgcOpenAPICodeFirstDispatcher compile from XE7 up. The REST server, its companions and the spec-first engine run on every supported compiler, Delphi 7 to 13.

Nothing in between is a black box

sgcREST implements the REST and OpenAPI surfaces your contract describes rather than wrapping a code generator you do not control. Requests, validation and dispatch are first-class methods and events, and full source code ships with every license, so it all steps through in your own debugger.

Part of sgcWebSockets

One package of sgcWebSockets, licensed on its own.

sgcREST packs the REST and OpenAPI classes of sgcWebSockets into a single package. Every license includes all seven classes, the sgcWebSockets Core runtime, full source code, royalty-free redistribution and 1 year of updates.

Single

1 developer license. Use on one machine at a time.

€249

Team

2 developer licenses. Use on two machines at a time.

€399

Site

Unlimited developers. All company machines.

€649

Renewal is offered at a 50% to 70% discount. Already on sgcWebSockets? The REST server ships in Professional and higher and the Enterprise edition includes the OpenAPI server too, so your edition may already cover you, and the All-Access bundle includes everything. The trial installer is the sgcWebSockets All-Access trial, so all seven classes can be evaluated today.

View pricing and order
Testimonials

What Developers Say

Trusted by Delphi, C++ Builder, Lazarus and .NET developers around the world.

Your sgcWebSockets library is very useful and easy to setup. Keep up the good work!
Simone Moretti Delphi Developer
sgcWebSockets is amazing and your support is the best!
Christian Meyer Founder & CTO
Thanks so much for your help and support, I love your components.
Mark Steinfeld CTO

REST APIs, OpenAPI contracts, native code.

A REST server with CORS, stats, tenancy and users, an OpenAPI server that works spec-first or code-first, and an OpenAPI client for any described API, with the sgcWebSockets Core runtime bundled in and full source code in the box.

More From eSeGeCe

Other Products by eSeGeCe

sgcREST is one of the eSeGeCe component libraries for Delphi, C++ Builder and .NET. They share conventions, they ship with full source, and they deploy royalty-free.

sgcWebSockets

WebSocket, HTTP/2, MQTT, AMQP, WebRTC, AI and 30+ API integrations for Delphi, C++ Builder, Lazarus and .NET. This is where the Core runtime lives, and its Enterprise edition includes the OpenAPI server too.

sgcHTTP

HTTP server, HTTP/2 client, gRPC client and Google Cloud Pub/Sub, Calendar and FCM clients for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.

sgcAuth

OAuth2 and JWT client components plus WebAuthn passkey sign-in, a natural pairing with a REST API's user store.

sgcAI

AI, LLM and MCP components for Delphi and C++ Builder. Seven LLM providers behind one component, plus MCP, embeddings and speech.

sgcMQ

MQTT, AMQP 0.9.1 and 1.0, Apache Kafka and STOMP client components for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.

sgcSocial

Telegram and WhatsApp Business client components for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.

sgcOpenAPI

OpenAPI 3.x parser, native Pascal SDK generator and 1,195+ pre-built cloud SDKs, for offline code generation rather than a runtime client.

sgcHTML

Server-side HTML and UI components on Bootstrap 5 and htmx for Delphi, C++ Builder and .NET.

sgcQUIC

Raw QUIC transport and an HTTP/3 client and server, with WebTransport. An add-on to sgcWebSockets Enterprise.

sgcSign

XAdES, PAdES, CAdES and ASiC for documents, Authenticode, ClickOnce, NuGet and VSIX for code.

sgcPDF

Create, edit, view, sign, redact and validate PDF files in pure Object Pascal, with no DLL to deploy. Licensed on its own.

sgcBiometrics

Windows Hello, fingerprint sensors and the Windows Biometric Framework for Delphi and C++ Builder.

sgcIndy

Updated Indy TCP/IP components with modern TLS, IPv6 and HTTP/2 for Delphi 7 through 13.

Latest from the blog

View all posts →

You are seeing the REST & OpenAPI view of eSeGeCe.

Show me another angle →
30-Day Money-Back GuaranteeNot satisfied? Request a full refund within 30 days of purchase. See refund policy