Can you share what parts of PostgREST way of doing things you found nice and what parts are lacking?
Nice things: simple tool that does one thing well. As mentioned above, it lets the database itself decide on permissions. If you want SSL support, just put it behind an NGINX reverse proxy. It lets you get creative with queries in the query-string part of your url. Lacking: I didn't really find anything lacking; it was able to do everything I needed. I'm a pretty basic end-user, not an expert. At first I was confound…
Also, exposing ONLY views and stored procedures is the recommended way.