Django REST Framework development
An API on the Django app you already trust.
Django REST Framework turns a Django app into an API that a web frontend, a mobile app, or a partner can use. Acasa Labs builds DRF backends for multi-tenant SaaS and internal platforms. SigmaCPM runs several products, a web app, and a Chrome extension on one DRF backend.
The problem
The second client is where a Django app starts to hurt.
A server-rendered Django app is fine until a mobile app, a React frontend, or a customer's system needs the same data. Then permissions written into views, serializers that grew by copy and paste, and endpoints that return the whole table become the bottleneck. A DRF backend designed for several clients from the start avoids that.
What we build with Django
- 01
Multi-tenant APIs
Organizations, seats, and roles enforced in one place, so every endpoint is scoped to the tenant without each view remembering to filter.
- 02
Permissions you can read
Object-level permissions and per-module entitlements as DRF permission classes, covered by tests, instead of checks scattered through views.
- 03
APIs for web, mobile, and partners
Versioned endpoints, pagination and filtering that do not load the whole table, and an OpenAPI schema your frontend team can generate a client from.
- 04
Background work off the request
Imports, document processing, and AI calls queued and tracked, with the API returning a job your client can poll.
From production
From SigmaCPM's DRF backend.
Entitlements per module
SigmaCPMOrganizations, seats, and per-module entitlements live in the backend, so the construction product and a sibling password-sharing product share accounts and billing.
Clients beyond the web app
SigmaCPMThe same DRF API serves the web app, a public API, and a Chrome extension. Each client gets the endpoints it needs, not a copy of the database.
Jobs with leases
SigmaCPMTender extraction and OCR run on a Postgres-backed job queue with leases, orphan reclaim, and skip-locked selection, so a crashed worker does not lose a tender.
Citations stored with the data
SigmaCPMExtracted line items keep the quote and the page they came from, so the API can show a person where every value was found.
Honest trade-offs
When DRF is not the right layer
For a backend that is mostly streaming, WebSockets, or a single AI service, we use FastAPI, sometimes next to an existing Django app. For a simple internal tool used only in the browser, plain Django views and the admin may be all you need.
What we reach for
- Django, Django REST Framework
- drf-spectacular for OpenAPI
- Postgres, Redis
- Celery or a Postgres job queue
- pytest-django
- Next.js, React Native clients
Proof
Shipped, not pitched.
01Our product
SigmaCPM
Construction project management where AI reads the tender and shows its work.
One project record for civil contractors, from tender to closeout: bids, contracts, RFIs, vendor quotes, and drawings. The AI pulls line items and bond terms out of tender PDFs and cites the page for every value.
Web · API · Chrome extension
Questions
Django REST Framework questions we get asked.
Can you add an API to our existing Django app?
Yes. DRF sits on your existing models, so we add serializers, permissions, and endpoints without moving the data. We usually start with the endpoints your new client needs first.
How do you handle multi-tenancy in Django?
With a tenant on every request and querysets scoped to it in one place, plus tests that try to read another tenant's data. Schema-per-tenant is an option when isolation rules require it.
Will the API work for our mobile app?
That is usually why it gets built. We version the endpoints so an older app version in the store keeps working while the next one ships.
How do you keep a DRF API fast?
Most slow DRF endpoints are slow queries. We select and prefetch related rows in the queryset instead of per object, paginate every list, return only the fields a client needs, and move anything heavy, like imports or document processing, to a background job.
How do you test a Django REST Framework API?
With pytest-django against a real Postgres database. The tests that matter most are the permission ones: each role, and each tenant trying to read or change data that is not theirs. Those run on every change before deploy.
Can partners or customers use the API too?
Yes. We add API keys or OAuth for outside clients, rate limits per key, and an OpenAPI schema they can read. SigmaCPM exposes an API alongside its web app and Chrome extension.
Django REST Framework development
Need a second client on your Django app?
Tell us what the mobile app, frontend, or partner needs. We will tell you what the API should look like and what it would take.