Everything sgcREST does, mapped across the REST server and its companions, the OpenAPI server engine and the OpenAPI client family. Every capability works the same in Delphi and C++ Builder, and every license ships full source code. Component subpages are not published yet for this launch, each entry below is self-contained on this page.
CORS, stats, tenancy & users
Spec-first & code-first
Consume any OpenAPI-described API
Delphi 7 to 13, C++ Builder
sgcREST is self-contained. It ships with the sgcWebSockets Core runtime bundled in, so it is not an add-on, and it runs on the standard Indy library that ships with RAD Studio.
Code-first OpenAPI needs Delphi XE7 or later. Generating a spec from an attributed Delphi class relies on RTTI introduced in XE7. The REST server, its companions and the spec-first OpenAPI engine run on Delphi 7 to 13.
Four components on the SGC REST palette page, and three code-only OpenAPI server and client classes, declared across the sgcHTTP_REST_Server* and sgcHTTP_OpenAPI_* units.
| Component | Class | Palette? | Description |
|---|---|---|---|
| REST Server | TsgcHTTPRESTServer | Yes | REST API server built on TsgcHTTPServer, with CORS handling and attachable stats/tenancy companions. |
| REST Server Stats | TsgcHTTPServerStats | Yes | Request counters, latency tracking, Prometheus /metrics and JSON /health. |
| REST Server Tenancy | TsgcHTTPServer_Tenancy | Yes | Multi-tenant resolution by host, path, header or JWT claim. |
| REST Server Users | TsgcHTTPServer_Users | Yes | Local account store: add, validate, hash, role-tag and persist users. |
| OpenAPI Server, Spec-First | TsgcOpenAPIServerHandler | No, code-only | Serves an API from a loaded OpenAPI 3.0/3.1 document, with request validation. |
| OpenAPI Server, Code-First | TsgcOpenAPICodeFirstScanner | No, code-only | Generates the OpenAPI spec from an RTTI-attributed Delphi class. Needs Delphi XE7+. |
| OpenAPI Client | TsgcOpenAPI_Client | No, code-only | Generic runtime client for any OpenAPI-described endpoint. |
TsgcHTTPRESTServer is a TsgcHTTPServer descendant, so it starts from the same bindings and TLS handling every sgc HTTP server shares, and layers a REST API's usual extras on top.
| Capability | API | Notes |
|---|---|---|
| CORS | CORSOptions (Enabled, AllowOrigins, AllowHeaders, AllowMethods) | Off by default. Preflight OPTIONS requests are answered automatically once enabled. |
| Stats companion | ServerStats: TsgcHTTPServerStats | Attach a stats component and every request is counted and timed without touching route handlers. |
| Tenancy companion | Tenancy: TsgcHTTPServer_Tenancy, Tenant | Attach a tenancy component to resolve the caller's tenant; Tenant reads the result for the current request. |
| Request counters | TotalRequests, Status1xx to Status5xx | On TsgcHTTPServerStats. Counted per status class as responses are sent. |
| Latency | LatencyMinMs, LatencyAvgMs, LatencyMaxMs | Tracked per request on TsgcHTTPServerStats, reset with Reset. |
| Metrics endpoint | GetMetricsText, IsMetricsRequest | Prometheus text exposition format 0.0.4, served at /metrics. |
| Health endpoint | GetHealthJSON, IsHealthRequest | JSON health payload served at /health, includes UptimeSeconds and ActiveConnections. |
| Per-endpoint stats | GetEndpointStats, Endpoints | One path/count pair per endpoint, for a report or an admin console. |
| Tenant resolution | Resolution, ResolveTenant | On TsgcHTTPServer_Tenancy. Resolves by host suffix, path segment, header or JWT claim. |
| Tenant sources | HostSuffix, PathSegmentIndex, HeaderName, ClaimName, DefaultTenant | The source read for the configured Resolution mode, and the fallback when it yields nothing. |
| Custom resolution | OnResolveTenant | Override or extend the built-in resolution logic. |
| User accounts | AddUser, DeleteUser, FindUser, ValidateCredentials, SetPassword, EnableUser, UserExists | On TsgcHTTPServer_Users. Salted, hashed credentials, never returned in plain form. |
| Roles | AddRole, RemoveRole, UserHasRole, GetUserRoles | Free-form role tags per account, checked from a route handler. |
| Enumeration | Count, GetUserCount, GetUserByIndex, GetUsernames | Read-only views for a report or an admin console; password hash and salt are never included. |
| Persistence | LoadUsers, SaveUsers, SaveToFile, LoadFromFile, ExportUsers, ImportUsers | Storage.EncryptAtRest encrypts the store; OnLoadUsers/OnSaveUsers swap in a custom backend. |
| Events | OnStats, OnResolveTenant, OnValidateCredentials, OnFindUser, OnException | One event per companion for the cases the built-in logic does not cover. |
Both approaches feed the same route table and request context; only the source of the OpenAPI document differs.
| Capability | API | Notes |
|---|---|---|
| Route table | TsgcOpenAPIRouteTable (Add, Match) | Built from a spec's paths section; matches a verb and a path to an operationId. |
| Request context | TsgcOpenAPIServerContext (Request, Response, PathParams, QueryParams) | One instance per matched request, freed when the request ends. |
| Typed parameters | PathParamAsString, PathParamAsInteger, QueryParamAsString, QueryParamAsInteger, QueryParamAsBoolean | Reads and converts a path or query value in one call. |
| Body access | BodyAsString, BodyAsJSON, HeaderValue | Parses the request body once and caches the result. |
| Responding | RespondJSON, RespondError | Writes a JSON body with a status code, or a structured error payload. |
| Request lifecycle | BeforeHandle, AfterHandle, HandleException | On TsgcOpenAPIServerHandler. Override to add logging, auth checks or custom error mapping. |
| Validation | TsgcOpenAPIJSONValidator | Checks request bodies, query and path parameters against the JSON Schemas the spec declares. |
| Spec generation | GenerateSpec, Title, Description, Version, BasePath | On TsgcOpenAPICodeFirstScanner. Produces an OpenAPI 3.0 document from an attributed class's RTTI. |
| Contract attributes | sgcServiceContract, sgcRoute, sgcSummary, sgcDescription, sgcTag, sgcResponse | Class- and method-level attributes that populate the generated spec. |
| Verb attributes | sgcHttpGet, sgcHttpPost, sgcHttpPut, sgcHttpDelete, sgcHttpPatch, sgcHttpHead, sgcHttpOptions | Declares the HTTP verb an annotated method answers. |
| Parameter binding | sgcFromPath, sgcFromQuery, sgcFromHeader, sgcFromBody, sgcRequired | Declares where each method parameter is read from. |
| Dispatch | TsgcOpenAPICodeFirstDispatcher (RegisterController, DispatchOperation, IsRegistered) | Invokes the annotated method registered for an operationId directly, no manual if chain. |
| Dependency | Delphi XE7 or later | Code-first scanning and dispatch rely on System.Rtti, unavailable before XE7. Spec-first has no such requirement. |
A generic client for any OpenAPI-described endpoint, with Basic auth, bearer tokens, generic OAuth2 and generic JWT built in.
| Capability | API | Notes |
|---|---|---|
| Base call | HTTP_REQUEST | On TsgcOpenAPI_Client. Carries a TsgcOpenAPIRequest/TsgcOpenAPIResponse pair to any endpoint. |
| Base URL | SetBaseURL, GetBaseURL | The endpoint every relative path in a request resolves against. |
| Generic authentication | Authentication (Basic, Token, OAuth2, JWT) | Basic auth and bearer tokens, plus generic OAuth2 and JWT flows. |
| Transport | TLSOptions, ProxyOptions, EncodeBodyAsUTF8 | Standard TLS and proxy configuration shared with the rest of the sgc HTTP stack. |
| Progress & logging | OnUpload, OnDownload, Log, LogFileName | Track large request/response bodies and optionally log every call to a file. |
| Request hook | OnBeforeRequest | Inspect or amend a request before it is sent. |
| TLS hooks | OnSSLVerifyPeer, OnSSLGetHandler, OnSSLAfterCreateHandler | Certificate verification and handler customization, shared with the rest of the sgc HTTP stack. |
Public standards on the wire, and the same source across every supported compiler.
| Area | Detail |
|---|---|
| OpenAPI | OpenAPI 3.0 and 3.1, both for the server's spec-first routing and for the JSON Schemas request validation checks against. |
| Client authentication | HTTP Basic authentication and bearer tokens, plus generic OAuth2 and JWT. |
| Metrics | Prometheus text exposition format 0.0.4 at /metrics. |
| Platforms | Windows Win32, Windows Win64, Linux64, macOS, iOS and Android for all seven classes. |
| Dependency | None beyond the bundled sgcWebSockets Core runtime. No additional add-on for any of the seven classes. |
| Compilers | Delphi and C++ Builder 7 through 13. Code-first OpenAPI needs Delphi XE7 or later. |
| Editions | The REST server family also ships inside sgcWebSockets from Professional up, the OpenAPI server from Enterprise up, and the OpenAPI client from Standard up. |
| Licensing | Standalone. The sgcWebSockets Core runtime is bundled in and full source code is included. |