# CalmAPI > CalmAPI 2 is a backend framework for Node.js and MongoDB where every line of framework code lives in your repo: resources, policies, auth, devtools, blocks and an upgrade path. CalmAPI 2 (npm package `calmapi`, Node.js 22.12+, Express 5, MongoDB with Mongoose, ESM) copies its framework code into each project as `calm/`. Resources are declared once with `f.*()` fields and access policies; services, custom routes, blocks and the `calm` CLI build on that. Each link below is the markdown source of a page; the same page is at the URL without `.md`. ## Getting started - [Why CalmAPI](https://docs.calmapi.dev/introduction.md): What CalmAPI 2 is, what makes it different, and what a resource looks like. - [Getting started](https://docs.calmapi.dev/getting-started.md): Create a project with npm create calmapi@latest, run it, and make your first requests with curl. - [Project structure](https://docs.calmapi.dev/project-structure.md): What lives in calm/, app/, calm.config.js and calm.lock, and how #calm and #app imports work. ## Guide - [Resources and fields](https://docs.calmapi.dev/resources.md): Declare a resource once with f.*() fields: schema, validation, visibility, queries, CRUD routes and status codes. - [Policies](https://docs.calmapi.dev/policies.md): Who may do what: policy tokens, combinations, functions, owner scoping and 401, 403 and 404 semantics. - [Services and hooks](https://docs.calmapi.dev/services.md): Business logic with ResourceService: scope(), before and after hooks, filterFor, other services and events. - [Custom routes](https://docs.calmapi.dev/routes.md): Add endpoints with the route builder: options, return values, ctx.reply, ctx.serialize and route order. - [Querying](https://docs.calmapi.dev/querying.md): Filter, search, sort, paginate, include references and pick fields on list endpoints. - [Authentication](https://docs.calmapi.dev/authentication.md): Register, login, sessions, password change and reset, lockout and password rules: every /api/auth endpoint with examples. - [Push notifications](https://docs.calmapi.dev/push-notifications.md): Send notifications to phones and browsers with app.push, register devices, try them on simulated phones in devtools and deliver with Expo or FCM. - [Errors](https://docs.calmapi.dev/errors.md): The error response shape, CalmError helpers, how database errors are mapped, and what never leaks. - [Configuration](https://docs.calmapi.dev/configuration.md): calm.config.js, every config key with its default, environment variables and production defaults. ## Tools - [Devtools](https://docs.calmapi.dev/devtools.md): The local dashboard at /_calm: requests with their MongoDB queries, data privacy lens and sample data, mail, push notifications on simulated phones, installed blocks, act as any user, agent activity and security. - [Testing](https://docs.calmapi.dev/testing.md): Write API tests with createTestApp and node:test against a throwaway database. - [Security audit](https://docs.calmapi.dev/audit.md): calm audit calls every route as every role on a throwaway database and checks policies, field leaks, mass assignment and token handling. - [CLI reference](https://docs.calmapi.dev/cli.md): Every calm command and flag: create, dev, make, add, block, seed, routes, openapi, doctor, audit, admin, keygen, upgrade and mcp. - [AI agents](https://docs.calmapi.dev/ai-agents.md): AGENTS.md, the calm mcp server for coding agents, the activity log that shows what they change, and the mcp-server block. - [Upgrading](https://docs.calmapi.dev/upgrading.md): How calm.lock and calm upgrade merge framework fixes into your edited calm/ folder. ## Blocks - [Blocks](https://docs.calmapi.dev/blocks.md): Production features you copy into your project with calm add: notifications, webhooks, API keys, feature flags, jobs, storage, realtime, push, two-factor auth and more. - [API docs (api-docs)](https://docs.calmapi.dev/blocks/api-docs.md): An interactive API reference at /docs, rendered from your OpenAPI document. - [API keys (api-keys)](https://docs.calmapi.dev/blocks/api-keys.md): Personal and service API keys with scopes for scripts and integrations: shown once, hashed at rest, expiry and revoke. - [Audit log (audit-log)](https://docs.calmapi.dev/blocks/audit-log.md): Who changed what and when, with field-level diffs that never record private values. - [Feature flags (feature-flags)](https://docs.calmapi.dev/blocks/feature-flags.md): Kill switches, gradual rollouts, per user and per role targeting, weighted variants and route gates, stored in MongoDB. - [Idempotency keys (idempotency)](https://docs.calmapi.dev/blocks/idempotency.md): Safe retries for writes: the Idempotency-Key header replays the stored response instead of running an operation twice. - [Background jobs (jobs)](https://docs.calmapi.dev/blocks/jobs.md): A MongoDB job queue and cron: retries, schedules, event triggers and an admin API. No Redis. - [Magic link sign-in (magic-link)](https://docs.calmapi.dev/blocks/magic-link.md): Passwordless sign-in by email: single use links, a cooldown per address, a redirect allowlist and links bound to the browser that asked. - [Email via Resend (mail-resend)](https://docs.calmapi.dev/blocks/mail-resend.md): Deliver password resets and notifications through the Resend HTTP API. - [Email via SMTP (mail-smtp)](https://docs.calmapi.dev/blocks/mail-smtp.md): Deliver email through any SMTP server with Nodemailer. - [MCP server (mcp-server)](https://docs.calmapi.dev/blocks/mcp-server.md): Expose your resources to AI agents as MCP tools, enforced by your API rules. - [Notifications: inbox, push and email (notifications)](https://docs.calmapi.dev/blocks/notifications.md): One call writes the in-app inbox, sends a push and an email, following each user's preferences and quiet hours. - [Privacy: export and delete (privacy)](https://docs.calmapi.dev/blocks/privacy.md): Users download everything they own and delete their account; per resource delete, anonymize or keep, with admin routes and a grace period. - [Push notifications via Expo (push-expo)](https://docs.calmapi.dev/blocks/push-expo.md): Deliver push notifications to Expo and React Native apps through the Expo push service. - [Push notifications via Firebase Cloud Messaging (push-fcm)](https://docs.calmapi.dev/blocks/push-fcm.md): Deliver push notifications to Android, iOS and web through Firebase Cloud Messaging HTTP v1, no SDK. - [Shared rate limits (rate-limit-mongo)](https://docs.calmapi.dev/blocks/rate-limit-mongo.md): Keep rate limit counters in MongoDB so limits hold across instances. - [Realtime (SSE) (realtime-sse)](https://docs.calmapi.dev/blocks/realtime-sse.md): Live resource events over Server-Sent Events, filtered per subscriber by your policies. - [Soft delete (soft-delete)](https://docs.calmapi.dev/blocks/soft-delete.md): Opt-in soft delete per resource, with trash and restore for admins. - [Local file storage (storage-local)](https://docs.calmapi.dev/blocks/storage-local.md): File uploads to local disk with type and size allowlists, magic-byte checks and safe downloads. - [S3 file storage (storage-s3)](https://docs.calmapi.dev/blocks/storage-s3.md): Direct-to-S3 uploads with presigned URLs for AWS S3, Cloudflare R2 and MinIO. - [Two-factor authentication (totp)](https://docs.calmapi.dev/blocks/totp.md): Authenticator-app codes on login, with single-use recovery codes, replay protection and secrets encrypted at rest. - [Webhooks (webhooks)](https://docs.calmapi.dev/blocks/webhooks.md): Outgoing webhooks for resource events: signed, queued, retried and logged, filtered by what each subscriber may read, SSRF safe. - [Building your own block](https://docs.calmapi.dev/building-blocks.md): Write a block with definePlugin: settings, env vars, routes, guards, credentials, named policies, doctor checks, the auth service helpers, and the calm make block, block check, block pack and gh: installs toolkit. - [Publishing your own block](https://docs.calmapi.dev/publishing-blocks.md): The registry item format, hosting blocks on GitHub or any static host, and registries of your own for calm add. ## Production - [Deployment](https://docs.calmapi.dev/deployment.md): Run CalmAPI in production: environment, health checks, graceful shutdown, proxies, Docker and several instances. - [Security](https://docs.calmapi.dev/security.md): Reporting vulnerabilities, secure defaults, encryption at rest, login lockout, security events, the exposure matrix and calm doctor. - [Security advisories](https://docs.calmapi.dev/security-advisories.md): Published advisories for code CalmAPI copied into projects, with the fix for each. - [Migrating from CalmAPI 1.x](https://docs.calmapi.dev/migrate-v1.md): Move a CalmAPI 1.x project to 2.0: concept map, API changes for clients, auth changes and a step by step plan. ## Reference - [Quick reference](https://docs.calmapi.dev/quick-reference.md): A one-page cheat sheet: fields, policies, services, routes, queries, auth endpoints and CLI. ## Optional - [All CalmAPI 2 docs in one file](https://docs.calmapi.dev/llms-full.txt): every page above, concatenated - [Block registry](https://docs.calmapi.dev/r/index.json): official blocks in the shadcn registry-item format, one item per block at https://docs.calmapi.dev/r/.json - [CalmAPI 1.x docs (legacy)](https://docs.calmapi.dev/v1): documentation for the previous major version, no longer developed