Integrations

Works with what you already run

Databases, storage, identity, secrets, deployment, observability and AI clients. Each one is marked by how it is checked: run against the real software in CI on every change, walked through in a how-to guide, or supported through a standard it implements.

46 integrations·23 tested in CI on every change
01 · Databases

Saved queries, grants, masking and the audit trail work the same on every one.

PostgreSQLTested in CITier 1. Every feature, under the compatibility promise.Guide 02 →MySQLTested in CITier 1. Writes on transactional tables.Guide 02 →SQLiteTested in CITier 1. Also the default store for a single instance.Guide 02 →DuckDBTested in CITier 1. Embedded, and the engine that reads files as tables.Guide 02 →ClickHouseTested in CITier 1. Analytics at scale, streamed exports.Guide 02 →MongoDBTested in CIfind() queries with the same grants and limits.Guide 04 →TrinoTested in CIExperimentalOne connection to many catalogs, fully governed.Guide 61 →H2Tested in CIExperimentalThrough the -h2 image variant, which includes Java.Guide 02 →Generic JDBCTested in CIExperimentalOracle, SQL Server, DB2, Snowflake and anything with a driver jar.Guide 03 →
02 · Files and object storage

Parquet, CSV and JSON are queried where they are, through DuckDB, locked to the paths a connection names.

Amazon S3Tested in CITested against an S3-compatible server; scheduled exports deliver here too.Guide 41 →Google Cloud StorageWorks withRead through its S3-compatible API.Database connections →Cloudflare R2Works withRead through its S3-compatible API.Database connections →Apache ParquetTested in CIRead as tables, and written by exports with column types kept.API reference →
03 · Identity and sign-in

Callers sign in with a key or a token from your provider; administrators sign in to the Console through OIDC.

KeycloakIn a guideThe worked example for AI clients signing in over OAuth.Guide 46 →OktaWorks withAny OpenID Connect provider: tokens checked against its keys.Signed-in users →Auth0Works withApp users call as themselves, mapped to a role.Signed-in users →Microsoft Entra IDWorks withAzure AD tokens, by its published signing keys.Signed-in users →Amazon CognitoWorks withUser-pool tokens, by its published signing keys.Signed-in users →FirebaseWorks withFirebase Auth tokens, by its published signing keys.Signed-in users →
04 · Secrets

Connection passwords stay out of the store: encrypted at rest, referenced from a file, or issued short-lived.

HashiCorp VaultTested in CIShort-lived database credentials, each role bound to its host. Tested against Vault 1.21.Guide 56 →AWS Secrets ManagerTested in CIExperimentalSecrets by reference; tested against a stand-in.Secrets →Amazon RDS IAMWorks withExperimentalToken-based sign-in to RDS; the signature is tested, RDS itself only in RDS.Secrets →Secrets from filesTested in CI${file:…} references, for Docker and Kubernetes secrets.Guide 22 →
05 · Deploy and scale

One container to start; several instances on PostgreSQL and Redis when you need them.

PyPITested in CIpip install queryapigate; drivers as extras.Install →DockerTested in CISigned image on ghcr, non-root, with an -h2 variant.Guide 32 →Kubernetes and HelmTested in CISigned chart, installed and upgraded under load on a real cluster.Guide 54 →RedisTested in CIOne cache, one rate-limit budget, one event stream across instances. Three real servers in CI.Deployment →PostgreSQL as the storeTested in CIThe shared store for several instances, with upgrades tested.Deployment →CaddyIn a guideThe load balancer in the multi-instance Compose setup.Deploy page →
06 · Observability and audit

Counts and timings to your metrics, spans to your tracing, and a signed audit trail to your SIEM.

PrometheusIn a guide/metrics behind a token: requests, latencies, pools, rejections.Guide 35 →GrafanaIn a guideA bundled dashboard to import.Guide 35 →OpenTelemetryIn a guideExperimentalSpans from the request to the database call, never a value or a row.Guide 51 →JaegerIn a guideThe tracing backend in the worked example.Guide 51 →Tempo, Honeycomb, DatadogWorks withAny backend that takes OTLP.Guide 51 →Your SIEMTested in CISyslog over mutual TLS or OTLP; tested on every push against rsyslog, syslog-ng and the OpenTelemetry Collector.Guide 53 →
07 · AI agents and clients

Saved queries become MCP tools, OpenAPI endpoints and typed clients, from the same definition.

MCP Python SDKTested in CIThe official MCP client library; MCP is exercised with it in CI.Guide 24 →ClaudeWorks withClaude Code and Claude Desktop, by key or by OAuth sign-in.MCP page →GitHub CopilotWorks withVS Code agent mode, with the key prompted once and kept out of the file.MCP page →CursorWorks withAny MCP client that speaks Streamable HTTP and sends a header.MCP reference →LangChainWorks withAgent frameworks call saved queries as tools.MCP reference →OpenAPI GeneratorTested in CIA typed client in about 50 languages; generated clients called against a live server.API reference →PostmanIn a guideA collection per collection, exported from the Console.Guide 12 →Swagger UITested in CIBuilt in at /docs, pinned with Subresource Integrity.API reference →
08 · Scheduling and pipelines

Exports run from whatever already schedules your jobs, incrementally, with no server needed.

cron and systemdIn a guidequeryapigate export on a timer, with an atomic rename and a non-zero exit on failure.Guide 30 →Kubernetes CronJobIn a guideThe same command as a CronJob.Guide 30 →Apache AirflowWorks withOver HTTP with a token of its own; it can pass TRACEPARENT into the run.Guide 44 →

Missing something you run? Most databases with a JDBC driver work through generic JDBC today, and anything that issues standard OIDC tokens or takes OTLP or syslog works without a dedicated integration. Ask on GitHub.