DelphiMVCFramework REST and JSON-RPC Development for Delphi

DelphiMVCFramework's Scope for Delphi Web Development

DelphiMVCFramework addresses the need to build server-side web applications and APIs without assembling every layer separately in Object Pascal. It targets developers working in Delphi 10.2 Tokyo or later who need REST resources, JSON-RPC 2.0 endpoints, database access, authentication, or HTML rendering within the same project structure.

The framework supports two API styles. RESTful services can reach Richardson Maturity Model Level 3, while JSON-RPC 2.0 services support automatic object remotization. Controllers provide the application structure, middleware handles cross-cutting request and response processing, and MVCActiveRecord handles persistence through FireDAC-supported databases. This makes the project relevant to teams that want an integrated Delphi stack rather than separate routing, ORM, and serialization components.

It is less suitable as a general-purpose frontend framework. The documented deployment targets include console applications, Windows Services, Linux daemons, VCL and FMX applications, Apache modules, and IIS ISAPI extensions. The server side is broad, but the project remains tied to the Delphi toolchain and its supported platforms. Android support is explicitly marked as experimental, so it should not be treated as an equivalent deployment path to Windows or Linux.

Controllers, Middleware, and MVCActiveRecord Request Flow

DelphiMVCFramework follows an MVC organization in which controllers represent application endpoints and domain models describe application data. For a REST service, an incoming HTTP request is associated with a controller action, which can invoke MVCActiveRecord for database work and return a serialized response. The README describes REST support through resource-oriented endpoints and content negotiation, although it does not provide a complete request trace for a specific controller.

Middleware forms the processing layer around requests and responses. The listed facilities cover JWT authentication, HTTP Basic Authentication, CORS, JWT Blacklist handling for token revocation, static files, file transfers, compression, rate limiting, and Server-Sent Events. Logging and profiling are also listed as development and operational features. These concerns commonly affect every endpoint, so placing them in middleware avoids requiring each controller action to implement them independently.

MVCActiveRecord adds CRUD operations, RQL queries, named queries, transaction management, and connection pooling. Entity generation can create entities from a database schema. The database-specific SQL generator covers PostgreSQL, Microsoft SQL Server, MySQL, MariaDB, Firebird, InterBase, SQLite, and Oracle. FireDAC supplies the wider database compatibility layer, but SQL behavior is not identical. Features such as RETURNING, sequence generation, pagination syntax, and generated-key retrieval vary by database, which is important when selecting the target database.

REST, JSON-RPC, WebSocket, and Serialization Capabilities

The API surface is broader than ordinary controller routing. JSON-RPC 2.0 support includes automatic object remotization, which reduces the amount of manual wire-format handling when published objects can be serialized. REST support adds resources, content negotiation, HATEOAS, and OpenAPI or Swagger documentation generation. The README also lists WebSocket support for bidirectional real-time communication on both server and client sides, plus SSE for one-way server updates.

Serialization supports JSON and dataset conversion, nullable types, custom serializers, and several naming conventions, including camelCase, PascalCase, and snake_case. Attribute-based field mapping allows a domain model to define its serialized representation independently of the Pascal declaration. These controls matter when an existing Delphi data model must interoperate with clients whose JSON field names or null handling are fixed.

The README gives feature names rather than a complete compatibility matrix for every API option. It does not explain when automatic object remotization should be replaced with a custom serializer, nor does it provide message size or concurrency limits for WebSocket and SSE endpoints. Developers adopting a real-time endpoint should inspect the relevant guide and samples rather than assuming that every REST serialization rule applies unchanged to JSON-RPC, WebSocket frames, or event streams.

Authentication, Middleware Boundaries, and Database Constraints

JWT authentication and authorization are built into the project, as are HTTP Basic Authentication and extension points for custom authentication. A JWT Blacklist middleware is listed specifically for token revocation. CORS handling is also included. These facilities address common API requirements, but the README does not document key-management defaults, token lifetime policy, refresh-token behavior, or production hardening settings. Those details must be verified in the authentication documentation and application configuration.

Rate limiting has in-memory and Redis-backed implementations. The in-memory option can fit a single-process deployment, while the Redis option is intended to coordinate state across processes or instances. The README does not say how eviction, failure behavior, or atomicity is configured, so choosing between them requires a clear deployment topology. A multi-instance service should not assume that process-local state is shared.

Database compatibility is similarly conditional. PostgreSQL RETURNING behavior differs from InterBase's sequence approach, SQLite has no sequences, and pagination has database-specific syntax. Microsoft SQL Server's OFFSET/FETCH support requires version 2012 or later. The documented minimum versions are useful for an initial compatibility check, but they do not prove that every ORM operation is supported with identical behavior on every database.

Installing DelphiMVCFramework and Making a First REST Request

The repository does not include a package-manager command in the README, so this article does not invent one. Installation is delegated to `docs/installation_guide.md`, while `docs/quickstart_guide.md` is the documented five-minute starting point. The repository also contains `samples/`, including `samples/basicdemo_server/` and `samples/activerecord_restful_crud/`, which are direct starting points for a first server and a database-backed REST resource.

A practical first use begins with the installation guide, followed by the quick-start guide. The quick start is expected to create a minimal Delphi project and connect its server host to a controller. For database work, the `samples/activerecord_restful_crud/` sample is the relevant reference because its name identifies CRUD behavior and MVCActiveRecord. The IDE Wizard is also listed for project creation, but the README does not document its dialog sequence or generated project settings.

The repository's `requirements.txt` lists Python tooling such as `invoke` and `pyinvoke`, but the README does not state that a normal application deployment requires these packages. They appear associated with repository tasks or tooling rather than a documented runtime prerequisite. The presence of `packages/`, `lib/`, and `sources/` shows where Delphi code is organized, but no exact IDE installation command can be confirmed from the README.

Server Hosts, Unit Tests, and Maintenance Signals

DelphiMVCFramework supports Standalone, Apache module, IIS ISAPI, and Linux daemon deployment, with Windows Services also listed as a target. The unit testing documentation is concrete: the README reports 872 tests running against five server hosts, namely Classic, Indy Direct, HTTP.sys, Apache 2.4, and ISAPI. `docs/unit_tests.md` is the stated source for prerequisites and execution details. This breadth matters because an endpoint may work under one host and require separate verification under another.

The repository is not archived. Its last push was on 2026-10-12, and the listed release history includes v3.5.0-silicon-rc7 on 2026-09-22, v3.5.0-silicon-rc6 on 2026-08-23, and v3.4.3-aluminium on 2026-01-04. The version naming indicates that the 3.5.0 line is represented by release candidates, while 3.4.3 is the listed stable version in the README. The README does not document upgrade compatibility between these lines, so an existing project should review `docs/changelog.md` before changing versions.

The repository uses Apache-2.0. That license permits use and modification under its terms, but this review does not interpret legal obligations. The practical maintenance cost comes from Delphi version changes, database-specific SQL, deployment-host differences, and migration work required between stable and release-candidate releases.

DMVCFramework Compared with Separate Delphi API Components

The main alternative is to assemble separate Delphi libraries for HTTP routing, controller organization, ORM access, JSON serialization, authentication, and deployment. That approach can provide narrower control over each dependency, but it also requires the adopter to resolve integration questions across several components. DelphiMVCFramework instead presents these capabilities as one framework with shared controllers, middleware, serializers, and MVCActiveRecord integration.

The distinction matters for teams that already have a mature database layer or a custom HTTP server abstraction. Replacing those pieces with MVCActiveRecord and the framework's middleware model may add migration work. The project is more directly aligned with a new Delphi web service or an existing Object Pascal application that can use FireDAC and the listed server hosts. It is not an automatic fit for a non-Delphi runtime, and the Android target is described as experimental.

The framework's breadth also creates evaluation work. A team should compare database behavior, host-specific execution, authentication configuration, and serialization requirements rather than selecting it only for the number of listed features. The first prototype should use the smallest relevant sample, then test the exact deployment host and database combination planned for production.

Editorial conclusion

DelphiMVCFramework fits Delphi teams building REST, JSON-RPC, middleware-backed web services, or MVCActiveRecord applications that can use one of its documented server hosts. It is a poor match for non-Delphi runtimes, teams unwilling to adopt its ORM and request model, or Android deployments treated as production-ready. Verify first the exact database and server host combination, the authentication and rate-limiting configuration for the intended topology, and the upgrade notes between the selected stable and release-candidate versions.

Frequently asked questions

Official sources

1. danieleteti/delphimvcframework on GitHub
2. Issues
3. License: Apache-2.0
4. README
5. Releases