Bubble's Data API lets external applications create and modify database records without using the Bubble editor. You enable the API in Settings, configure authentication tokens, and call specific endpoints for each Data Type. This tutorial walks through enabling the API, authenticating requests, creating new records via POST, and updating existing ones via PATCH with proper field mapping.
Overview: Creating and Modifying Records via Bubble's API
This tutorial covers using Bubble's built-in Data API to let external applications create and update your database records. You will learn to enable the API, set up authentication, construct endpoint URLs, and map fields for both creating and modifying Things. This is essential for integrating Bubble with external services, mobile apps, or automation tools like Zapier and Make.
Prerequisites
- A Bubble app with at least one custom Data Type created
- Basic understanding of REST APIs and JSON
- An API testing tool like Postman or Insomnia
- Your Bubble app's API token (found in Settings → API)
Step-by-step guide
Enable the Data API in Bubble settings
Enable the Data API in Bubble settings
Open your Bubble editor and navigate to Settings in the left sidebar. Click the API tab. Under 'Enable Data API', toggle the switch to ON. You will see a list of your Data Types below — check the box next to each Data Type you want to expose via the API. For each enabled type, toggle individual permissions: Create, Modify, Delete, and View. Make sure to enable at least 'Create' and 'Modify' for the types you need. Copy your API token displayed at the top of this page — you will need it for authentication.
Pro tip: Only expose the Data Types and permissions you actually need. Leaving all types exposed increases your attack surface unnecessarily.
Expected result: The Data API is enabled with specific Data Types and permissions checked, and you have copied your API token.
Construct the endpoint URL for your Data Type
Construct the endpoint URL for your Data Type
Bubble's Data API endpoints follow a predictable pattern. For creating a new record, the URL is: https://yourapp.bubbleapps.io/api/1.1/obj/datatypename. Replace 'yourapp' with your app name and 'datatypename' with your Data Type name in lowercase with spaces replaced by hyphens. For the development version, use: https://yourapp.bubbleapps.io/version-test/api/1.1/obj/datatypename. To modify an existing record, append the record's unique ID to the URL.
1# Endpoint patterns:23# Create a new record (POST)4https://yourapp.bubbleapps.io/api/1.1/obj/product56# Modify an existing record (PATCH)7https://yourapp.bubbleapps.io/api/1.1/obj/product/1234567890x1234589# Development version endpoints10https://yourapp.bubbleapps.io/version-test/api/1.1/obj/productExpected result: You have the correct endpoint URLs for both creating and modifying records in your Data Type.
Create a new record with a POST request
Create a new record with a POST request
Open your API testing tool and create a new POST request. Set the URL to your Data Type's create endpoint. Add an Authorization header with the value 'Bearer YOUR_API_TOKEN'. Set the Content-Type header to 'application/json'. In the request body, include a JSON object with your field names as keys and the values you want to store. Field names must match exactly what you defined in Bubble's Data tab (case-sensitive). For related data type fields, pass the Unique ID of the related Thing.
1{2 "product_name": "Premium Widget",3 "price": 29.99,4 "description": "A high-quality widget for professionals",5 "in_stock": true,6 "category": "1678901234x567890"7}Pro tip: Boolean fields use true/false (not yes/no like in the Bubble editor). Date fields must be in ISO 8601 format: 2026-03-28T12:00:00.000Z.
Expected result: The API returns a response with status 'success' and the new record's unique ID in the 'id' field.
Modify an existing record with a PATCH request
Modify an existing record with a PATCH request
To update an existing record, create a PATCH request to the endpoint with the record's unique ID appended. Use the same Authorization and Content-Type headers. In the request body, include only the fields you want to change — you do not need to send all fields. Bubble will update only the specified fields and leave everything else unchanged. To clear a field, set its value to null in the JSON body.
1{2 "price": 24.99,3 "in_stock": false4}Expected result: The API returns a status of 'success' and the record is updated with the new field values in your Bubble database.
Handle list fields and file uploads via the API
Handle list fields and file uploads via the API
For list fields, pass an array of values in the JSON body. For lists referencing another Data Type, pass an array of unique IDs. To add items to an existing list without replacing it, first GET the current list, append your new items, then PATCH the full array back. For file and image fields, pass the publicly accessible URL — Bubble will download and store it. You cannot upload binary data directly through the Data API. For complex integrations, consider using a backend API workflow with RapidDev's assistance to handle the orchestration.
1{2 "tags": ["premium", "sale", "featured"],3 "related_products": ["1678901234x567890", "1678901234x567891"],4 "product_image": "https://example.com/images/widget.png"5}Pro tip: If you frequently add items to lists, create a backend API workflow instead — it can use the 'add' list operator without fetching the full list first.
Expected result: List fields are populated with all provided values, and file/image fields store the downloaded file from the URL.
Test API calls against the development environment first
Test API calls against the development environment first
Before pointing external services at your live app, always test against your development version. Use the version-test endpoint URL for testing. Check your Bubble Data tab → App data to verify records were created or modified correctly. Look at the Logs tab for errors. Once everything works in development, switch to the live endpoint (without version-test) and deploy your app to ensure API changes are active in production.
Expected result: Records appear correctly in your Bubble database via the Data tab, and you can switch confidently to the live endpoint.
Complete working example
1// BUBBLE DATA API — FULL REQUEST EXAMPLES2// =============================================34// --- CREATE A NEW RECORD (POST) ---5// URL: https://yourapp.bubbleapps.io/api/1.1/obj/product6// Method: POST7// Headers:8// Authorization: Bearer YOUR_API_TOKEN9// Content-Type: application/json1011// Request Body:12{13 "product_name": "Premium Widget",14 "price": 29.99,15 "description": "A high-quality widget",16 "in_stock": true,17 "category": "1678901234x567890",18 "tags": ["premium", "sale"],19 "product_image": "https://example.com/widget.png",20 "release_date": "2026-04-01T00:00:00.000Z"21}2223// Response:24// { "status": "success", "id": "1678901234x999999" }252627// --- MODIFY AN EXISTING RECORD (PATCH) ---28// URL: .../api/1.1/obj/product/1678901234x99999929// Method: PATCH3031// Request Body (only changed fields):32{33 "price": 24.99,34 "in_stock": false,35 "tags": ["premium", "sale", "clearance"]36}3738// Response:39// { "status": "success" }404142// --- DELETE A RECORD (DELETE) ---43// URL: .../api/1.1/obj/product/1678901234x99999944// Method: DELETE45// Headers: Authorization: Bearer YOUR_API_TOKEN4647// Response:48// { "status": "success" }Common mistakes when creating and Modify Records via Bubble's Data API
Why it's a problem: Using field names that don't match the Bubble Data Type exactly
How to avoid: Check the exact field names in Data tab → Data types and use those exact names in your JSON body
Why it's a problem: Forgetting to deploy before testing the live API endpoint
How to avoid: Always deploy your app after Data API configuration changes, or use the version-test endpoint for testing
Why it's a problem: Sending yes/no instead of true/false for boolean fields
How to avoid: Use true and false (without quotes) in your JSON body for yes/no fields
Why it's a problem: Not checking Privacy Rules for API access
How to avoid: In Data tab → Privacy, ensure each rule grants the appropriate API permissions
Best practices
- Always test API calls against the development environment before switching to live
- Store your API token securely and never expose it in client-side code or public repositories
- Only enable Data API permissions for the specific Data Types and operations you need
- Use PATCH instead of full replacements to minimize data sent and reduce error risk
- Log API responses in your external system for troubleshooting failed requests
- For bulk operations, use backend API workflows instead of the Data API for better performance
- Set up Privacy Rules that explicitly allow or deny API access per user role
Still stuck?
Copy one of these prompts to get a personalized, step-by-step explanation.
I have a Bubble.io app with a Data Type called 'Order' that has fields: customer_name (text), total (number), status (text), and items (list of Product). How do I create and update Order records from an external Python script using Bubble's Data API?
Set up my app's Data API so external services can create and modify Product records. I need the Product type to have fields for name, price, description, image, and a category reference. Show me the Settings configuration and explain how to test it.
Frequently asked questions
Do I need a paid Bubble plan to use the Data API?
No. The Data API is available on all Bubble plans including the free plan. However, API calls consume workload units, and the free plan has a limited WU allocation.
Can I bulk create multiple records in one API call?
No. Bubble's Data API processes one record per request. For bulk operations, make multiple API calls or create a backend API workflow that processes items in a loop.
How do I handle date fields in API requests?
Pass dates in ISO 8601 format (e.g., 2026-03-28T12:00:00.000Z). Bubble stores all dates in UTC, so convert to UTC before sending.
What happens if I send a field name that does not exist?
Bubble silently ignores unknown field names without returning an error. Double-check your field names match exactly what is defined in the Data tab.
Can RapidDev help integrate my external system with Bubble's Data API?
Yes. RapidDev specializes in connecting Bubble apps with external services, setting up proper API authentication, and building robust data sync workflows.
Is the Data API affected by Privacy Rules?
Yes. Privacy Rules apply to Data API requests. If a rule blocks API operations, the request will fail. Check your Privacy tab to ensure API access is granted.
Can I use the Data API to upload files?
Not directly. For file and image fields, pass a publicly accessible URL and Bubble will download and store the file. You cannot upload binary data through the Data API.
Talk to an Expert
Our team has built 600+ apps. Get personalized help with your project.
Book a free consultation