// the find
hasura/graphql-engine
Blazing fast, instant realtime GraphQL APIs on all your data with fine grained access control, also trigger webhooks on database events.
Hasura auto-generates a GraphQL (and REST) API directly from your database schema, with row-level permissions baked in. V2 is the battle-tested Haskell core; V3 (DDN) is a ground-up Rust rewrite targeting federated supergraphs across multiple data sources. It's aimed at teams that want an API layer without writing one.
The permission system is genuinely well-designed — you define row-level rules once in metadata and they compile down to SQL WHERE clauses, not app-layer filters. Real-time subscriptions via Postgres logical replication work out of the box without any extra infrastructure. V3's connector model is a real architectural improvement: each data source is an independent service with a typed protocol, so MongoDB and Postgres can participate in the same query without Hasura knowing their internals. The CLI + migrations workflow for metadata-as-code is solid and actually version-controllable.
V2 and V3 are essentially two different products sharing a brand and a repo, with V3 still requiring Hasura DDN (their cloud) for the full feature set — the self-hosted V3 story is incomplete. Complex business logic still needs escape hatches (Actions, Event Triggers) that push you toward maintaining a separate service anyway, which erodes the 'no backend' pitch. The metadata format is a sprawling YAML/JSON config that becomes a maintenance burden at scale — renaming a table touches a dozen files. N+1 query behavior with nested relationships requires careful use of data loaders or you'll hammer the database in ways that are hard to spot without query inspection.