ERMrest (rhymes with "earn rest") is a general relational data storage service for web-based, data-oriented collaboration. It allows general entity-relationship modeling of data resources manipulated by RESTful access methods.

ERMrest is research software, but its core features have proven stable enough to use in several production science projects.

Known Issues: See our list of known issues at GitHub.

As a protocol, the ERMrest REST API can be easily accessed by browser-based applications or any basic HTTP client library. Its main features:

• Exposes a PostgreSQL RDBMS containing science data.
• Model neutrality
  • Allows use of natural, domain-specific relational data schema rather than forcing a fixed and generic schema.
  • Supports schema and data introspection by clients to allow generic presentation of tabular data rather than only hard-coded and domain-specific clients.
• An expressive set of data access methods
  • Set-based single and bulk whole-entity (table row) create/read/update/delete (CRUD);
  • Set-based single and bulk partial-entity (table cell) read/update (RU);
  • Aggregate and grouped aggregate queries;
  • Convenient ERM navigation to map common relational inner join idioms into URL path structures.
• Multi-tenancy to easily allow multiple catalogs, each with its own schema and data content.

ERMrest is developed and tested primarily on an enterprise Linux distribution with Python 2.6. It has a conventional web service stack:

• Apache HTTPD
• mod_wsgi
• web.py lightweight web framework
• psycopg2 database driver
• PostgreSQL 9.2 or later
• webauthn security adaptation layer (another product of our group)

See ERMrest Installation (CentOS 6).

1. The HTTP(S) connection is terminated by Apache HTTPD.
2. The ERMrest service code executes as the ermrest daemon user.
3. The service configuration is loaded from ~ermrest/ermrest_config.json:

• Core access control policies
• Data type presentation.

1. All dynamic data is stored in the RDBMS.
2. Client authentication context is determined by callouts to the webauthn module:

• Client identity
• Client roles/group membership.

1. Authorization of service requests is determined by the service code:

• ACLs retrieved from RDBMS
• ACLs are intersected with authenticated client context.

1. The RDBMS is accessed using deployed service credentials which have no necessary relation to client security model.

Please direct questions and comments to the project issue tracker at GitHub.

ERMrest is made available as open source under the Apache License, Version 2.0. Please see the LICENSE file for more information.

ERMrest is developed in the Informatics group at the USC Information Sciences Institute. The primary design team is:

• Karl Czajkowski
• Carl Kesselman
• Rob Schuler
• Serban Voinea