curl --request POST \
--url https://api.dynamosql.com/v1/schemas \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"schemaName": "myschema",
"region": "us-east-1",
"accountId": "123456789012",
"roleArn": "arn:aws:iam::123456789012:role/DynamoSQLReadRole",
"externalId": "dsql-ext-7f3a9c2b",
"tableAllowlist": [
"Users",
"Orders",
"Products"
]
}
'{
"success": true,
"data": {
"tenantId": "tenant-abc123",
"schemaName": "myschema",
"region": "us-east-1",
"accountId": "123456789012",
"roleArn": "arn:aws:iam::123456789012:role/DynamoSQLReadRole",
"externalId": "dsql-ext-7f3a9c2b",
"tableAllowlist": [
"Users",
"Orders",
"Products"
],
"status": "active",
"createdAt": "2026-03-11T10:00:00.000Z",
"updatedAt": "2026-03-11T10:00:00.000Z"
}
}{
"success": false,
"error": {
"message": "startDate must be before or equal to endDate"
}
}{
"success": false,
"error": {
"message": "Unauthorized"
}
}{
"success": false,
"error": {
"message": "Tenant admin access required"
}
}{
"success": false,
"error": {
"message": "A schema with that name already exists"
}
}Create Schema
Connect DynamoSQL to DynamoDB tables in your AWS account.
curl --request POST \
--url https://api.dynamosql.com/v1/schemas \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"schemaName": "myschema",
"region": "us-east-1",
"accountId": "123456789012",
"roleArn": "arn:aws:iam::123456789012:role/DynamoSQLReadRole",
"externalId": "dsql-ext-7f3a9c2b",
"tableAllowlist": [
"Users",
"Orders",
"Products"
]
}
'{
"success": true,
"data": {
"tenantId": "tenant-abc123",
"schemaName": "myschema",
"region": "us-east-1",
"accountId": "123456789012",
"roleArn": "arn:aws:iam::123456789012:role/DynamoSQLReadRole",
"externalId": "dsql-ext-7f3a9c2b",
"tableAllowlist": [
"Users",
"Orders",
"Products"
],
"status": "active",
"createdAt": "2026-03-11T10:00:00.000Z",
"updatedAt": "2026-03-11T10:00:00.000Z"
}
}{
"success": false,
"error": {
"message": "startDate must be before or equal to endDate"
}
}{
"success": false,
"error": {
"message": "Unauthorized"
}
}{
"success": false,
"error": {
"message": "Tenant admin access required"
}
}{
"success": false,
"error": {
"message": "A schema with that name already exists"
}
}schemas:writeAuthorizations
Bearer token obtained from POST /v1/auth/token. Pass in the Authorization header as Bearer <token>.
Body
Logical name for this schema. Used in SQL as the schema qualifier: SELECT * FROM {schemaName}.{tableName}. Must be unique within the tenant. Case-insensitive at query time; stored as-provided.
"myschema"
AWS region where the DynamoDB tables reside. Must be a valid AWS region identifier (e.g., us-east-1, eu-west-2).
"us-east-1"
12-digit AWS account ID that owns the DynamoDB tables.
"123456789012"
Full ARN of the IAM role to assume. The role must have a trust policy permitting DynamoSQL to assume it with the provided externalId. See the IAM Setup guide for the required trust policy and permission set.
"arn:aws:iam::123456789012:role/DynamoSQLReadRole"
External ID to include in sts:AssumeRole. Must match the sts:ExternalId condition in the role's trust policy. Generate a random string (UUID recommended) and store it in both DynamoSQL and your IAM role.
"dsql-ext-7f3a9c2b"
Optional list of DynamoDB table names this schema may access. Omit to allow all tables visible to the role. Pass ["*"] to explicitly allow all tables with wildcard validation. Individual names are matched exactly (case-sensitive).
["Users", "Orders"]
Response
Schema created. A background metadata refresh has been started.
true when the request was processed without errors, false otherwise. Always present.
A DynamoSQL schema record. A schema connects a logical name to the IAM role and AWS region DynamoSQL uses to access DynamoDB on your behalf via cross-account role assumption.
Show child attributes
Show child attributes
Present in the response body when success is false.
Show child attributes
Show child attributes