Most Strapi vs Directus writeups focus on licensing and whether you're modeling content from scratch or wrapping an existing database. Both are real questions, but if you're picking a headless CMS specifically to build an app or integration on top of its API, a different set of details actually decides it: does GraphQL come built in, is there real-time support, and which permission features are free versus paywalled. That's the comparison most reviews skip.
We package both Strapi and Directus as AWS AMIs, so this isn't a pitch for either one. Here's the API-first breakdown: GraphQL depth, real-time subscriptions, and what's actually free to self-host versus gated behind a paid plan.
Quick answer
Jump to a section
How to choose for an API-first project
Three questions matter more here than the usual feature checklist:
- Do you need real-time updates pushed to clients? Directus ships WebSockets and GraphQL Subscriptions natively. Strapi has no built-in equivalent, you'd wire that up yourself.
- How granular do your permission rules need to be, and can you pay for it? Directus's field-level and row-level access control is free in the self-hosted core. Strapi's advanced RBAC granularity is a paid feature.
- Is GraphQL a first-class requirement or a nice-to-have? If GraphQL is central to your integration, Directus has it in core from day one. Strapi's plugin approach works fine but is one more thing to install and maintain.
Directus: GraphQL, real-time, and granular permissions, all in core
Directus describes itself as a data platform rather than a CMS, and its API reflects that: point it at an existing PostgreSQL or MySQL database and it generates REST and GraphQL APIs over your tables automatically, no separate GraphQL install required. Real-time support ships in core too, WebSockets and GraphQL Subscriptions, so a client can subscribe to content changes as they happen instead of polling. Its permission system is policy-based, letting you write field-level and even row-level access rules per role, free in the self-hosted edition, not gated behind a paid tier.
Key facts
- REST and GraphQL both ship in core, no plugin needed for either
- Native WebSockets and GraphQL Subscriptions for real-time updates
- Free, policy-based field-level and row-level permissions in the self-hosted core
- Flows: built-in no-code automation triggered by API events, webhooks, or schedules
Strapi: a rock-solid REST-first API, with GraphQL as an add-on
Strapi is built REST-first, and that API is mature, well-documented, and where most of its plugin ecosystem plugs in. GraphQL is available through an official plugin rather than shipping in core, functionally solid once installed but an extra dependency to add and maintain rather than something present from the first request. There's no built-in real-time or subscription layer, if your app needs push updates, you're building that yourself with lifecycle hooks and an external WebSocket service. Where Strapi pulls ahead is automation flexibility for developers: lifecycle hooks let you write custom code that fires before or after any operation on a content type, and its larger plugin marketplace covers more pre-built integrations than Directus's extensions ecosystem currently does.
Key facts
- REST API in core, mature and heavily documented
- GraphQL available via an official plugin, not built in by default
- No native real-time or subscription layer, custom code required for push updates
- Lifecycle hooks for custom automation, plus a larger plugin marketplace
API depth: GraphQL and real-time
This is the clearest technical gap between the two. Directus treats GraphQL as a first-class citizen alongside REST, both come from the same core install with no additional plugin. Strapi's REST API is arguably just as capable day to day, but GraphQL support arrives through an official plugin layered on top, one more piece to install, version, and keep compatible with core updates. Real-time is a starker difference: Directus ships WebSockets and GraphQL Subscriptions out of the box, genuinely useful for apps that need to reflect content changes live (a dashboard, a collaborative tool, a notification feed). Strapi has no equivalent built in, which is a real limitation if live updates are part of your product, not a nice-to-have.
Permissions: what's actually free
Both tools ship role-based access control, but the granularity you get for free differs. Directus's policy-based permission system lets you define field-level and row-level rules per role in the self-hosted core, no upgrade required, useful if different roles need to see different fields on the same record, or only rows matching certain conditions. Strapi's basic RBAC covers straightforward role assignment well, but its more granular advanced permission controls sit behind a paid plan. If your project genuinely needs fine-grained, conditional access rules and you want to self-host for free, that's a real point in Directus's favor, not just a checkbox feature.
Automation: hooks vs Flows
Strapi's lifecycle hooks are code-first: you write a function that runs before or after create, update, delete, or other operations on a content type, full control, but you're writing and maintaining that code yourself. Directus's Flows is the no-code equivalent, a visual builder for automations triggered by API events, incoming webhooks, or schedules, without writing custom server code for common cases like sending a notification or syncing to another system. Neither approach is strictly better, developers who want full code control may prefer Strapi's hooks, teams that want non-developers able to configure automations may prefer Directus's Flows.
Strapi vs Directus: the API facts
| Criterion | Directus | Strapi |
|---|---|---|
| GraphQL | Ships in core | Official plugin, not core |
| Real-time / subscriptions | Native WebSockets and GraphQL Subscriptions | Not built in, custom implementation needed |
| Field-level permissions | Free in self-hosted core | Advanced tiers are a paid feature |
| Row-level permissions | Free, policy-based | Limited without paid features |
| No-code automation | Flows, built in | Not built in, use lifecycle hooks instead |
| Plugin/extension ecosystem | Smaller, growing | Larger, longer-running marketplace |
What about licensing and architecture?
Licensing and architecture are real, separate questions from API depth, and we've covered them thoroughly elsewhere rather than repeating the full breakdown here. In short: Strapi's Community Edition is MIT licensed and free to self-host at any company size, while Directus is BSL 1.1 licensed, free to self-host only under $5 million in annual revenue. Architecturally, Strapi is code-first (it owns the schema), Directus is database-first (it wraps an existing one). If those two factors are what's actually deciding your evaluation, our other Strapi vs Directus: Which Headless CMS Should You Self-Host? comparison covers both in full.
Where I'd start
Building an app or integration that needs live updates, GraphQL from day one, and free granular permissions: Directus, its core is built for exactly that. Building a content API where REST is enough, you want the largest plugin ecosystem, and licensing simplicity matters more than API depth: Strapi. Both produce a genuinely solid API, the real question is whether your project needs what ships in core versus what you're willing to add yourself.
Our Directus developer guide and Directus AWS deployment guide cover the self-hosted setup end to end, with our Directus GCP developer guide covering that platform too. Our Strapi developer guide and Strapi install guide cover the same for Strapi.
Frequently Asked Questions
What is the best open source cms api for building a real app on top of?
Directus, if native GraphQL, real-time WebSocket subscriptions, and free field-level permissions matter to your app. Its core ships all three without a paid plan. Strapi's REST API is equally solid, but GraphQL is an add-on plugin and there's no built-in real-time layer.
Does Strapi support GraphQL the same way Directus does?
Not quite. Directus ships GraphQL in core alongside REST, no extra install. Strapi supports GraphQL too, but through an official plugin you add on top of its REST-first core, functionally similar once installed, but not there by default the way Directus's is.
Which headless CMS has real-time updates, Strapi or Directus?
Directus, natively. It ships WebSockets and GraphQL Subscriptions in core, so clients can subscribe to content changes as they happen. Strapi doesn't have an equivalent built-in real-time layer, you'd build that yourself with lifecycle hooks and an external WebSocket service.
Is granular API permission control free in both Strapi and Directus?
Not equally. Directus includes policy-based access control, field-level and row-level rules per role, free in its self-hosted core. Strapi's basic role-based access control is free too, but its more granular advanced permission features sit behind a paid plan.
Strapi vs Directus: which is better for automating content workflows?
Both can do it, differently. Strapi uses lifecycle hooks, custom code you write that fires before or after operations on a content type. Directus has a built-in no-code automation feature called Flows, triggered by API events, webhooks, or schedules, useful if you'd rather configure automation than write functions for it.
Strapi vs Directus vs the licensing question: does that still matter for an API-first project?
It can, separately from API depth. Directus's self-hosted license is free only under $5M in annual revenue (BSL 1.1); Strapi's Community Edition is MIT and free at any company size. We cover that comparison, along with code-first vs database-first architecture, in full in our other Strapi vs Directus breakdown.
Launch Directus on AWS in Minutes
Launch a pre-configured Directus server on AWS with GraphQL, real-time subscriptions, and free granular permissions ready to build on.
Get Directus on AWS Marketplace
