So a security or platform team can evaluate QueryAPIGate against specs they already trust, and so it drops into existing identity, observability and compliance infrastructure. Each entry names the standard, the RFC or specification, and what QueryAPIGate uses it for.
How agents and applications reach the server, and how the server describes itself.
| Standard | Reference | What QueryAPIGate uses it for |
|---|---|---|
| Model Context Protocol (MCP) | modelcontextprotocol.io · Streamable HTTP transport ↗ | How AI agents call saved queries as governed tools. |
| OpenAPI | OpenAPI 3.0 ↗ | The machine-readable description of the whole REST API, served at /openapi.json. |
| Server-Sent Events (SSE) | WHATWG HTML · text/event-stream ↗ | The live /events stream of query runs to many clients at once. |
| OpenAI-compatible embeddings API | de-facto request/response shape ↗ | Semantic search calls any embeddings endpoint that speaks the OpenAI {input, model} → {data: [{embedding}]} shape. |
Agent and user access is standard OAuth 2.0 / OpenID Connect. QueryAPIGate is a resource server that trusts your identity provider, never a parallel password store.
| Standard | Reference | What QueryAPIGate uses it for |
|---|---|---|
| OAuth 2.0 / 2.1 | The OAuth authorization framework ↗ | The authorization model for the MCP server and JWT-authenticated REST. |
| OpenID Connect + Discovery | OIDC Core and Discovery ↗ | Signing in users from any OIDC provider: Keycloak, Okta, Entra, Auth0, Cognito, Firebase. |
| Authorization Server Metadata | RFC 8414 ↗ | Finding an identity provider's keys and endpoints from its published metadata. |
| Protected Resource Metadata | RFC 9728 ↗ | The MCP server advertises itself at /.well-known/oauth-protected-resource: what it is, who issues its tokens, and the scope required. |
| Resource Indicators for OAuth | RFC 8707 ↗ | The token's audience (aud) must be the server's own URI: a token minted for the MCP server is refused against REST or anything else. |
| JWT Profile for OAuth Access Tokens | RFC 9068 ↗ | Reading scopes from an access token (scope / scp). |
| Authorization Code + PKCE | RFC 7636 ↗ | The Console sign-in flow runs in the browser with PKCE, so the browser never holds a long-lived token. |
| JWT / JWS / JWK and JWKS | RFC 7519 / 7515 / 7517 ↗ | The token format, its signature, and fetching the provider's public keys from a JWKS URL (cached, refreshed on an unknown key id). |
| JWT Best Current Practices | RFC 8725 ↗ | Only the configured algorithms are accepted (RS256), never none, never an HMAC downgrade; exp, iss and aud are validated. |
On the roadmap: opaque access tokens via Token Introspection (RFC 7662); JWT access tokens only in the current release.
How the record leaves the server, and what the tools you already run can read.
| Standard | Reference | What QueryAPIGate uses it for |
|---|---|---|
| Syslog protocol | RFC 5424 ↗ | The format of audit entries streamed to a SIEM (facility 13, "log audit"). |
| Syslog over TLS | RFC 5425 ↗ | Encrypted delivery of the audit stream (tls://host:6514). |
| Syslog over TCP (octet counting) | RFC 6587 ↗ | Framed, loss-detectable delivery over TCP; UDP is refused. |
| OpenTelemetry | OTel tracing and semantic conventions ↗ | Distributed traces, with connection types mapped to the db.system semantic convention. |
| Prometheus exposition format | Prometheus text format ↗ | Metrics at /metrics. |
| HTTP Caching | RFC 9111 ↗ | Correct Cache-Control semantics, including no-store, so a CDN or caching proxy never serves one caller's rows to another. |
| Deprecation HTTP header | RFC 9745 ↗ | Deprecated API routes carry a Deprecation header with the date. |
What protects data in flight and at rest, and the primitives behind keys and the audit chain.
| Standard | Reference | What QueryAPIGate uses it for |
|---|---|---|
| TLS / mutual TLS | X.509 path validation · RFC 5280 ↗ | Transport security; optional client-certificate authentication, validated strictly against a configured CA. |
| Fernet (AES-128-CBC + HMAC-SHA256) | The cryptography library's Fernet ↗ | Encrypting stored connection passwords and secrets at rest under QUERYAPIGATE_SECRET_KEY. |
SHA-256 / HMAC-SHA256 | FIPS 180-4 · RFC 2104 ↗ | API keys and admin tokens are stored only as a SHA-256 hash (the secret is shown once); the audit log is an HMAC-SHA256 hash chain, each entry hashed over the previous. |
| CORS | WHATWG Fetch ↗ | Controlling which browser origins may call the API. |
| CIDR notation | RFC 4632 ↗ | Per-key IP allow-lists (allowed_ips). |
Every reference on this page is implemented as of v0.40.0 unless marked "on the roadmap", and was verified against the QueryAPIGate codebase.
How these fit together is on the Security and Trust pages; the reasoning behind each control is in the threat model; the cryptography in detail is on the Enterprise page.