Platform Capabilities

Everything you need to build, automate, and scale enterprise applications.

Dynamic Schema Engine

  • ✓ 28 field types covering every enterprise need
  • ✓ LOOKUP and MASTER_DETAIL relationships with automatic FK management
  • ✓ Formula expressions and rollup summaries (COUNT, SUM, MIN, MAX, AVG)
  • ✓ Field-level validation rules with regex, min/max, and custom expressions
  • ✓ Auto-number sequences with configurable prefix and padding
  • ✓ Immutable schema versioning across every change
Dynamic Schema Engine invoices v14 customer LOOKUP amount CURRENCY dueDate DATE status PICKLIST total FORMULA lineCount ROLLUP customers name email invoices ↺ changed at runtime — no deploy

Auto-Generated REST API

  • ✓ Full CRUD at /{tenant}/{collection} — JSON:API compliant
  • ✓ Relationship includes with multi-level transitive resolution
  • ✓ Sparse fieldsets, filtering, sorting, and pagination
  • ✓ Atomic operations for bulk create/update/delete
  • ✓ WebSocket realtime subscriptions via NATS bridge
  • ✓ Auto-generated OpenAPI 3.0 docs with Swagger UI
  • ✓ Global full-text search via PostgreSQL tsvector
Auto-Generated REST API GET /acme/invoices ?filter[status][eq]=overdue &include=customer&sort=-dueDate &fields[invoices]=amount,dueDate&page[size]=25 200 OK application/vnd.api+json { "data": [ { "type": "invoices", "id": "…", "attributes": { "amount": 1240.00, … }, "relationships": { "customer": … } } ], "included": [ … ], "meta": { "total": 12 } } auto-generated

Visual Flow Builder

  • ✓ 8 state types: Task, Choice, Parallel, Map, Wait, Pass, Succeed, Fail
  • ✓ 19 built-in action handlers for data, comms, integration, and flow control
  • ✓ Durable execution — every state transition persisted, survives pod restarts
  • ✓ Record-triggered, webhook, scheduled (cron), NATS-message, and autolaunched triggers
  • ✓ Full JSONPath data flow with InputPath, ResultPath, OutputPath
  • ✓ React Flow-based visual designer with drag-and-drop
Visual Flow Builder TRIGGER invoice.updated Choice status? = sent = paid Task EMAIL_ALERT Task UPDATE_RECORD ✓ every transition persisted · survives pod restarts · JSONPath in / out

Authentication & Identity

  • ✓ Internal OIDC provider — no external identity server required
  • ✓ Federated identity brokering (Google, Okta, Azure AD, any OIDC)
  • ✓ TOTP MFA with QR code enrollment and recovery codes
  • ✓ SMS OTP with rate limiting and E.164 validation
  • ✓ Per-tenant password policies and account lockout
  • ✓ Personal access tokens with SHA-256 hashing and Redis revocation
Authentication & Identity kelta-auth OIDC provider sessions · MFA · PATs password policy · lockout Google Okta Azure AD any OIDC federated brokering TOTP QR enrol · recovery codes SMS OTP rate-limited · E.164 PAT klt_… · SHA-256

Role-Based Access Control

  • ✓ Profiles and Groups with most-permissive-wins resolution
  • ✓ 15 system permission types and per-object CRUD permissions
  • ✓ Field-level security (VISIBLE, READ_ONLY, HIDDEN)
  • ✓ Custom ABAC rules with CEL expressions via Cerbos Policy Engine
  • ✓ 7 built-in profiles from System Administrator to Minimum Access
  • ✓ Authorization testing UI for debugging permission decisions
Role-Based Access Control user Profile Solution Manager Permission Sets + export, + billing Groups finance-eu OR effective access invoices CRUD amount READ_ONLY margin HIDDEN payroll — + Cerbos ABAC rules (CEL)

Multi-Tenancy & Governor Limits

  • ✓ URL-based or custom domain (CNAME) tenant routing
  • ✓ PostgreSQL schema isolation with Row Level Security
  • ✓ Per-tenant governor limits: API calls, storage, users, collections
  • ✓ Real-time usage tracking with Redis counters
  • ✓ Governor limits dashboard in admin UI
Multi-Tenancy & Governor Limits gateway tenant resolution api.kelta.io/acme/… crm.acme.com (CNAME) acme RLS · tenant_id API calls / day 82% globex RLS · tenant_id API calls / day 41% initech RLS · tenant_id API calls / day 12% one database · row-level security · per-tenant governor limits

Observability & Monitoring

  • ✓ OpenTelemetry traces, logs, and metrics over OTLP (Grafana Tempo, Loki, Mimir out of the box)
  • ✓ Structured log aggregation with MDC enrichment
  • ✓ Metrics dashboard: request counts, error rates, latency percentiles
  • ✓ Setup audit trail with before/after values
  • ✓ Prometheus metrics for HPA autoscaling
  • ✓ 7 monitoring pages in the admin UI
Observability & Monitoring request latency p50 p95 p99 traces OTLP → Tempo logs OTLP → Loki metrics OTLP → Mimir OpenTelemetry end to end · audit trail on every setup change

AI & Model Context Protocol

  • ✓ Built-in MCP server — two endpoints per tenant: /{tenant}/mcp/admin and /{tenant}/mcp/user
  • ✓ 39 admin tools: collections, fields, picklists, validation rules, unique constraints, flows, layouts, list views, pages, menus, dashboards
  • ✓ 15 data tools: query, get, create, update, delete, bulk apply, execute flow, flow runs, approvals, keyword and semantic search
  • ✓ Import an OpenAPI spec and materialize it as a live collection from the agent
  • ✓ MCP resources expose your schema, the generated OpenAPI, and the authoring docs to the model
  • ✓ PAT-authenticated, tenant-scoped, rate-limited; admin tools unreachable from the data endpoint
  • ✓ kelta mcp install <client> — one command for Claude Code, Claude Desktop, Cursor, and others; local stdio bridge adds sandbox, promote, and metadata tools
  • ✓ In-app assistant and governed agents on the same runtime: schema-aware prompts, proposals you approve, bounded tool-use loops, per-tenant token accounting
AI & Model Context Protocol AI agent Claude Code · Cursor Claude Desktop · … Bearer klt_… MCP MCP /{tenant}/mcp/admin 39 tools create_collectionadd_fieldcreate_flowapply_layoutapply_pageapply_menuimport_api_speccreate_picklist /{tenant}/mcp/user 15 tools query_collectioncreate_recordbulk_applyexecute_flowlist_approvalssemantic_search same RBAC, rate limits, and audit trail as the UI · resources: schema, OpenAPI, docs

Sandboxes, Promotion & CLI

  • ✓ Clone a tenant into an isolated sandbox tenant; refresh it from its source at any time
  • ✓ Export tenant metadata as a package; diff sandbox against production by natural key
  • ✓ Promote changes between environments with preview, approval, execute, and rollback
  • ✓ Apply metadata from files — CI-friendly, idempotent
  • ✓ Generate typed SDK artifacts for your collections with kelta sdk
  • ✓ Self-updating cross-platform CLI; every command also available as an MCP tool
Sandboxes, Promotion & CLI sandbox acme--feature-x staging acme--staging production acme promote promote sandbox refresh from source $ kelta metadata diff · kelta promote preview → approve → execute · kelta sdk

Integration

  • ✓ HTTP callouts with header, method, and body templating
  • ✓ Inbound and outbound webhooks (Svix-powered)
  • ✓ NATS event publishing from any flow
  • ✓ Per-tenant SMTP email with async delivery and templates
  • ✓ Embedded analytics via Apache Superset
  • ✓ On-the-fly image transformations via URL parameters
Integration flow action handlers HTTP callout any REST API Webhooks Svix in/out NATS publish events Email per-tenant SMTP Superset embedded analytics Images URL transforms

Architecture at a Glance

Service Technology Purpose
Gateway Java 25, Spring Cloud Gateway API ingress, auth, tenant routing, rate limiting, WebSocket
Auth Java 25, Spring Authorization Server OIDC provider, identity federation, MFA, sessions
Worker Java 25, Spring Boot 4 Business logic, CRUD, flows, schema, integrations
Admin UI React 19, Vite 7, TypeScript, Tailwind 4 160+ page admin console and app runtime
PostgreSQL v18 Primary data store with RLS and full-text search
Redis v7 Rate limiting, caching, session storage
NATS JetStream Event streaming, realtime bridge, config propagation
Cerbos PDP Fine-grained ABAC policy engine
MCP Server Java 25, MCP Java SDK Admin + data tool endpoints per tenant for AI agents
AI Java 25, Anthropic API In-app assistant, proposals, governed agent runtime
CLI TypeScript, single binary Metadata export/diff/apply, sandboxes, promotion, SDK generation, MCP bridge

See it in action

Clone the repo, run docker-compose up, and explore the full platform.

Get Started on GitHub