# QueryAPIGate

> One governed gate between your databases and everything that asks them for data: saved SQL published as REST endpoints, MCP tools for AI agents, live events and scheduled exports, with identity, grants, parameter validation, masking and an audit record on every call. Self-hosted, Python, Apache-2.0.

Site: https://anantharajuc.github.io/QueryAPIGate-website/
Repository: https://github.com/AnanthaRajuC/QueryAPIGate
Everything below in one file: https://anantharajuc.github.io/QueryAPIGate-website/llms-full.txt
Documentation MCP server (search these docs and read any page from an AI agent; read-only, no sign-in): https://queryapigate-docs.queryapigate-docs-mcp.workers.dev/mcp
Each link below is the markdown of a page; the site renders it at the address that follows.

## Documentation, guides and blog posts

- [Installation and setup](https://anantharajuc.github.io/QueryAPIGate-website/documentation/INSTALLATION_AND_SETUP.md): documentation, Run it. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=INSTALLATION_AND_SETUP
- [Configuration](https://anantharajuc.github.io/QueryAPIGate-website/documentation/CONFIGURATION.md): documentation, Run it. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=CONFIGURATION
- [Deployment](https://anantharajuc.github.io/QueryAPIGate-website/documentation/DEPLOYMENT.md): documentation, Run it. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=DEPLOYMENT
- [Database connections](https://anantharajuc.github.io/QueryAPIGate-website/documentation/DATABASE_CONNECTION_CONFIGURATION.md): documentation, Run it. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=DATABASE_CONNECTION_CONFIGURATION
- [API reference](https://anantharajuc.github.io/QueryAPIGate-website/documentation/API.md): documentation, Reference. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=API
- [MCP server](https://anantharajuc.github.io/QueryAPIGate-website/documentation/MCP.md): documentation, Reference. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=MCP
- [Features](https://anantharajuc.github.io/QueryAPIGate-website/documentation/FEATURES.md): documentation, Reference. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=FEATURES
- [Example APIs](https://anantharajuc.github.io/QueryAPIGate-website/documentation/EXAMPLES.md): documentation, Reference. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=EXAMPLES
- [Query metadata](https://anantharajuc.github.io/QueryAPIGate-website/documentation/QUERY_METADATA_MANAGEMENT.md): documentation, Reference. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=QUERY_METADATA_MANAGEMENT
- [A tour of the Console](https://anantharajuc.github.io/QueryAPIGate-website/documentation/SCREENSHOTS.md): documentation, Reference. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=SCREENSHOTS
- [Performance, v5: a Rust data plane in front of /q/](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE_V5.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE_V5
- [Performance, v4: what 0.43 changed on PostgreSQL](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE_V4.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE_V4
- [Performance on MySQL, v2: what 0.43 changed](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE_MYSQL_V2.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE_MYSQL_V2
- [Performance, v3: an OLTP benchmark on PostgreSQL](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE_V3.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE_V3
- [Performance on MySQL, v1: microservice databases, per-user queries](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE_MYSQL_V1.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE_MYSQL_V1
- [Performance, v2: an OLTP benchmark on PostgreSQL](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE_V2.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE_V2
- [Performance](https://anantharajuc.github.io/QueryAPIGate-website/documentation/PERFORMANCE.md): documentation, Performance. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=PERFORMANCE
- [Threat model](https://anantharajuc.github.io/QueryAPIGate-website/documentation/THREAT_MODEL.md): documentation, Security. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=THREAT_MODEL
- [Where data goes](https://anantharajuc.github.io/QueryAPIGate-website/documentation/DATA_PROTECTION.md): documentation, Security. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=DATA_PROTECTION
- [Security policy](https://anantharajuc.github.io/QueryAPIGate-website/SECURITY.md): documentation, Security. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=SECURITY
- [Architecture overview](https://anantharajuc.github.io/QueryAPIGate-website/security-pack/ARCHITECTURE.md): documentation, Security. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=ARCHITECTURE
- [Security questionnaire answers](https://anantharajuc.github.io/QueryAPIGate-website/security-pack/QUESTIONNAIRE.md): documentation, Security. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=QUESTIONNAIRE
- [SBOM and release verification](https://anantharajuc.github.io/QueryAPIGate-website/security-pack/SBOM.md): documentation, Security. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=SBOM
- [Why QueryAPIGate](https://anantharajuc.github.io/QueryAPIGate-website/documentation/WHY.md): documentation, Project. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=WHY
- [Technology stack](https://anantharajuc.github.io/QueryAPIGate-website/documentation/TECHNOLOGY_STACK.MD): documentation, Project. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=TECHNOLOGY_STACK
- [Contributing](https://anantharajuc.github.io/QueryAPIGate-website/CONTRIBUTING.md): documentation, Project. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=CONTRIBUTING
- [Code of conduct](https://anantharajuc.github.io/QueryAPIGate-website/CODE_OF_CONDUCT.md): documentation, Project. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?d=CODE_OF_CONDUCT
- [Guide 01: Turn your first SQL query into a REST API](https://anantharajuc.github.io/QueryAPIGate-website/how-to/01-turn-your-first-sql-query-into-a-rest-api.md): how-to, Start. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=01-turn-your-first-sql-query-into-a-rest-api
- [Guide 02: Connect to PostgreSQL, MySQL, SQLite, DuckDB, ClickHouse or H2](https://anantharajuc.github.io/QueryAPIGate-website/how-to/02-connect-a-database.md): how-to, Start. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=02-connect-a-database
- [Guide 03: Connect to anything else via generic JDBC](https://anantharajuc.github.io/QueryAPIGate-website/how-to/03-connect-via-generic-jdbc.md): how-to, Start. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=03-connect-via-generic-jdbc
- [Guide 04: Connect to MongoDB](https://anantharajuc.github.io/QueryAPIGate-website/how-to/04-connect-to-mongodb.md): how-to, Start. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=04-connect-to-mongodb
- [Guide 05: Try it without any setup, using the built-in example APIs](https://anantharajuc.github.io/QueryAPIGate-website/how-to/05-try-the-built-in-example-apis.md): how-to, Start. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=05-try-the-built-in-example-apis
- [Guide 06: Use bound parameters safely](https://anantharajuc.github.io/QueryAPIGate-website/how-to/06-use-bound-parameters-safely.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=06-use-bound-parameters-safely
- [Guide 07: Group related queries into a collection](https://anantharajuc.github.io/QueryAPIGate-website/how-to/07-group-queries-into-a-collection.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=07-group-queries-into-a-collection
- [Guide 08: Cache a saved query's response](https://anantharajuc.github.io/QueryAPIGate-website/how-to/08-cache-a-saved-query.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=08-cache-a-saved-query
- [Guide 09: Export a large result without running out of memory](https://anantharajuc.github.io/QueryAPIGate-website/how-to/09-stream-a-large-export.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=09-stream-a-large-export
- [Guide 10: Allow a saved query to write data](https://anantharajuc.github.io/QueryAPIGate-website/how-to/10-allow-a-saved-query-to-write-data.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=10-allow-a-saved-query-to-write-data
- [Guide 11: Browse a connection's schema before writing a query](https://anantharajuc.github.io/QueryAPIGate-website/how-to/11-browse-a-connections-schema.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=11-browse-a-connections-schema
- [Guide 12: Export a Postman collection for a set of APIs](https://anantharajuc.github.io/QueryAPIGate-website/how-to/12-export-a-postman-collection.md): how-to, Queries. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=12-export-a-postman-collection
- [Guide 13: Set up your first scoped API key](https://anantharajuc.github.io/QueryAPIGate-website/how-to/13-set-up-a-scoped-api-key.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=13-set-up-a-scoped-api-key
- [Guide 14: Give an external partner access to exactly one query](https://anantharajuc.github.io/QueryAPIGate-website/how-to/14-give-a-partner-one-query-only.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=14-give-a-partner-one-query-only
- [Guide 15: Create a role and stamp out several keys from it](https://anantharajuc.github.io/QueryAPIGate-website/how-to/15-create-a-role.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=15-create-a-role
- [Guide 16: Restrict a key to specific tables](https://anantharajuc.github.io/QueryAPIGate-website/how-to/16-restrict-a-key-to-tables.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=16-restrict-a-key-to-tables
- [Guide 17: Rate-limit a key, or the whole server](https://anantharajuc.github.io/QueryAPIGate-website/how-to/17-rate-limit-a-key.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=17-rate-limit-a-key
- [Guide 18: Restrict a key to specific source IPs](https://anantharajuc.github.io/QueryAPIGate-website/how-to/18-restrict-a-key-to-ips.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=18-restrict-a-key-to-ips
- [Guide 19: Give a key an expiry date](https://anantharajuc.github.io/QueryAPIGate-website/how-to/19-give-a-key-an-expiry-date.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=19-give-a-key-an-expiry-date
- [Guide 20: Read the audit log to answer "who changed this, and when"](https://anantharajuc.github.io/QueryAPIGate-website/how-to/20-read-the-audit-log.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=20-read-the-audit-log
- [Guide 21: Verify who can reach what](https://anantharajuc.github.io/QueryAPIGate-website/how-to/21-verify-who-can-reach-what.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=21-verify-who-can-reach-what
- [Guide 22: Keep connection passwords out of the store](https://anantharajuc.github.io/QueryAPIGate-website/how-to/22-encrypt-passwords-at-rest.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=22-encrypt-passwords-at-rest
- [Guide 23: Put QueryAPIGate behind a reverse proxy with real TLS](https://anantharajuc.github.io/QueryAPIGate-website/how-to/23-put-it-behind-a-reverse-proxy.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=23-put-it-behind-a-reverse-proxy
- [Guide 24: Let an AI agent call your saved queries via MCP](https://anantharajuc.github.io/QueryAPIGate-website/how-to/24-let-an-agent-call-your-queries-via-mcp.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=24-let-an-agent-call-your-queries-via-mcp
- [Guide 25: Let an agent explore your schema and run ad-hoc SQL](https://anantharajuc.github.io/QueryAPIGate-website/how-to/25-mcp-ad-hoc-tools.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=25-mcp-ad-hoc-tools
- [Guide 26: Read structured MCP results properly](https://anantharajuc.github.io/QueryAPIGate-website/how-to/26-mcp-structured-results.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=26-mcp-structured-results
- [Guide 27: Check whether your MCP server is running, from the Console](https://anantharajuc.github.io/QueryAPIGate-website/how-to/27-check-the-mcp-server-from-the-console.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=27-check-the-mcp-server-from-the-console
- [Guide 28: Build a client that watches your saved queries run in real time](https://anantharajuc.github.io/QueryAPIGate-website/how-to/28-build-a-client-that-watches-queries-run.md): how-to, Events & exports. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=28-build-a-client-that-watches-queries-run
- [Guide 29: Give each user of your app their own private activity feed](https://anantharajuc.github.io/QueryAPIGate-website/how-to/29-per-key-live-feeds.md): how-to, Events & exports. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=29-per-key-live-feeds
- [Guide 30: Run a scheduled export with cron, systemd or a Kubernetes CronJob](https://anantharajuc.github.io/QueryAPIGate-website/how-to/30-schedule-an-export.md): how-to, Events & exports. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=30-schedule-an-export
- [Guide 31: Get the exact CLI command for a saved query](https://anantharajuc.github.io/QueryAPIGate-website/how-to/31-get-the-cli-command-for-a-query.md): how-to, Events & exports. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=31-get-the-cli-command-for-a-query
- [Guide 32: Deploy with Docker for real](https://anantharajuc.github.io/QueryAPIGate-website/how-to/32-deploy-with-docker.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=32-deploy-with-docker
- [Guide 33: Back up and restore the store](https://anantharajuc.github.io/QueryAPIGate-website/how-to/33-back-up-and-restore.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=33-back-up-and-restore
- [Guide 34: Upgrade to a new version safely](https://anantharajuc.github.io/QueryAPIGate-website/how-to/34-upgrade-safely.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=34-upgrade-safely
- [Guide 35: Wire up Prometheus and Grafana](https://anantharajuc.github.io/QueryAPIGate-website/how-to/35-wire-up-prometheus-and-grafana.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=35-wire-up-prometheus-and-grafana
- [Guide 36: Read the logs and trace one request end to end](https://anantharajuc.github.io/QueryAPIGate-website/how-to/36-trace-a-request-in-the-logs.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=36-trace-a-request-in-the-logs
- [Guide 37: Diagnose and tune the connection pool](https://anantharajuc.github.io/QueryAPIGate-website/how-to/37-tune-the-connection-pool.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=37-tune-the-connection-pool
- [Guide 38: Allow a browser-based frontend to call the API directly](https://anantharajuc.github.io/QueryAPIGate-website/how-to/38-allow-a-browser-frontend-cors.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=38-allow-a-browser-frontend-cors
- [Guide 39: Read the example APIs as a template for your own](https://anantharajuc.github.io/QueryAPIGate-website/how-to/39-walk-through-the-example-apis.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=39-walk-through-the-example-apis
- [Guide 40: Use the threat model to decide how to expose QueryAPIGate](https://anantharajuc.github.io/QueryAPIGate-website/how-to/40-read-the-threat-model.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=40-read-the-threat-model
- [Guide 41: Publish Parquet, CSV or JSON files in S3 as an API](https://anantharajuc.github.io/QueryAPIGate-website/how-to/41-publish-files-in-s3-as-an-api.md): how-to, Events & exports. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=41-publish-files-in-s3-as-an-api
- [Guide 42: Run several instances behind a load balancer](https://anantharajuc.github.io/QueryAPIGate-website/how-to/42-run-several-instances.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=42-run-several-instances
- [Guide 43: Give your team their own admin access](https://anantharajuc.github.io/QueryAPIGate-website/how-to/43-give-your-team-their-own-admin-access.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=43-give-your-team-their-own-admin-access
- [Guide 44: Deliver a daily file to a partner's bucket](https://anantharajuc.github.io/QueryAPIGate-website/how-to/44-deliver-a-daily-file-to-a-partners-bucket.md): how-to, Events & exports. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=44-deliver-a-daily-file-to-a-partners-bucket
- [Guide 45: Hide personal data from a partner or an AI agent](https://anantharajuc.github.io/QueryAPIGate-website/how-to/45-hide-personal-data-from-a-partner-or-an-ai-agent.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=45-hide-personal-data-from-a-partner-or-an-ai-agent
- [Guide 46: Let AI clients sign in through your identity provider](https://anantharajuc.github.io/QueryAPIGate-website/how-to/46-let-ai-clients-sign-in-through-your-identity-provider.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=46-let-ai-clients-sign-in-through-your-identity-provider
- [Guide 47: Tell AI agents what your data means, and see what they did](https://anantharajuc.github.io/QueryAPIGate-website/how-to/47-tell-agents-what-your-data-means-and-see-what-they-did.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=47-tell-agents-what-your-data-means-and-see-what-they-did
- [Guide 48: Sign in to the Console through your identity provider](https://anantharajuc.github.io/QueryAPIGate-website/how-to/48-sign-in-to-the-console-through-your-identity-provider.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=48-sign-in-to-the-console-through-your-identity-provider
- [Guide 49: Let an AI agent write - with a person approving each write](https://anantharajuc.github.io/QueryAPIGate-website/how-to/49-let-an-agent-write-with-a-person-approving-each-write.md): how-to, Agents. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=49-let-an-agent-write-with-a-person-approving-each-write
- [Guide 50: Rotate an API key without downtime](https://anantharajuc.github.io/QueryAPIGate-website/how-to/50-rotate-an-api-key-without-downtime.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=50-rotate-an-api-key-without-downtime
- [Guide 51: See QueryAPIGate in your traces](https://anantharajuc.github.io/QueryAPIGate-website/how-to/51-see-queryapigate-in-your-traces.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=51-see-queryapigate-in-your-traces
- [Guide 52: Give a partner a quota and a concurrency cap](https://anantharajuc.github.io/QueryAPIGate-website/how-to/52-give-a-partner-a-quota-and-a-concurrency-cap.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=52-give-a-partner-a-quota-and-a-concurrency-cap
- [Guide 53: Send the audit log to your SIEM, and prove nobody edited it](https://anantharajuc.github.io/QueryAPIGate-website/how-to/53-send-the-audit-log-to-your-siem.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=53-send-the-audit-log-to-your-siem
- [Guide 54: Install on Kubernetes with Helm](https://anantharajuc.github.io/QueryAPIGate-website/how-to/54-install-on-kubernetes-with-helm.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=54-install-on-kubernetes-with-helm
- [Guide 55: Manage your setup as code, and promote it from dev to prod through a pull request](https://anantharajuc.github.io/QueryAPIGate-website/how-to/55-promote-a-setup-from-dev-to-prod-through-a-pull-request.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=55-promote-a-setup-from-dev-to-prod-through-a-pull-request
- [Guide 56: Use short-lived database credentials from Vault](https://anantharajuc.github.io/QueryAPIGate-website/how-to/56-use-short-lived-database-credentials-from-vault.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=56-use-short-lived-database-credentials-from-vault
- [Guide 57: Answer a security questionnaire about data and cryptography](https://anantharajuc.github.io/QueryAPIGate-website/how-to/57-answer-a-security-questionnaire-about-data-and-cryptography.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=57-answer-a-security-questionnaire-about-data-and-cryptography
- [Guide 58: Keep the server's own secrets, and its metrics, in](https://anantharajuc.github.io/QueryAPIGate-website/how-to/58-keep-the-servers-own-secrets-and-metrics-in.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=58-keep-the-servers-own-secrets-and-metrics-in
- [Guide 59: Verify a release before you run it](https://anantharajuc.github.io/QueryAPIGate-website/how-to/59-verify-a-release-before-you-run-it.md): how-to, Govern. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=59-verify-a-release-before-you-run-it
- [Guide 60: Give each team its own workspace](https://anantharajuc.github.io/QueryAPIGate-website/how-to/60-give-each-team-its-own-workspace.md): how-to, Access. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=60-give-each-team-its-own-workspace
- [Guide 61: Connect to Trino](https://anantharajuc.github.io/QueryAPIGate-website/how-to/61-connect-to-trino.md): how-to, Start. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=61-connect-to-trino
- [Guide 62: See what's being used, from the Console](https://anantharajuc.github.io/QueryAPIGate-website/how-to/62-see-whats-being-used-from-the-console.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=62-see-whats-being-used-from-the-console
- [Guide 63: Tune a deployment for throughput](https://anantharajuc.github.io/QueryAPIGate-website/how-to/63-tune-a-deployment-for-throughput.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=63-tune-a-deployment-for-throughput
- [Guide 64: Try the Rust data plane in front of /q/](https://anantharajuc.github.io/QueryAPIGate-website/how-to/64-try-the-rust-data-plane.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=64-try-the-rust-data-plane
- [Guide 65: Keep run history and the event log in ClickHouse](https://anantharajuc.github.io/QueryAPIGate-website/how-to/65-keep-runs-in-clickhouse.md): how-to, Operate. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?g=65-keep-runs-in-clickhouse
- [The 30% that was in the build](https://anantharajuc.github.io/QueryAPIGate-website/blog/the-30-percent-in-the-build.md): blog, Benchmark, 2026-10-31. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=the-30-percent-in-the-build
- [Every run, recorded](https://anantharajuc.github.io/QueryAPIGate-website/blog/every-run-recorded.md): blog, Benchmark, 2026-10-29. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=every-run-recorded
- [Python decides, Rust serves](https://anantharajuc.github.io/QueryAPIGate-website/blog/python-decides-rust-serves.md): blog, Benchmark, 2026-10-28. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=python-decides-rust-serves
- [One MySQL server, six services, one gateway](https://anantharajuc.github.io/QueryAPIGate-website/blog/one-mysql-six-services.md): blog, Benchmark, 2026-10-25. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=one-mysql-six-services
- [What a governed call costs](https://anantharajuc.github.io/QueryAPIGate-website/blog/what-a-governed-call-costs.md): blog, Benchmark, 2026-10-24. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=what-a-governed-call-costs
- [Agents can write now. A person approves each write.](https://anantharajuc.github.io/QueryAPIGate-website/blog/agents-can-write-now.md): blog, Release, 2026-10-11. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=agents-can-write-now
- [Why every front door runs the same eight steps](https://anantharajuc.github.io/QueryAPIGate-website/blog/why-every-front-door-runs-the-same-eight-steps.md): blog, Design note, 2026-10-11. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=why-every-front-door-runs-the-same-eight-steps
- [One worker, many threads, and what Redis is actually for](https://anantharajuc.github.io/QueryAPIGate-website/blog/one-worker-many-threads.md): blog, Design note, 2026-10-11. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=one-worker-many-threads
- [SQL2API is now QueryAPIGate](https://anantharajuc.github.io/QueryAPIGate-website/blog/sql2api-is-now-queryapigate.md): blog, Migration, 2026-10-11. On the site: https://anantharajuc.github.io/QueryAPIGate-website/Guide.dc.html?p=sql2api-is-now-queryapigate

## Glossary

- **Ad-hoc SQL**: SQL a caller sends directly to /execute_sql or the MCP execute_sql tool, rather than a saved query. Only for keys granted a connection, one statement, read-only unless allowed, and confined to allowed_tables. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#ad-hoc-sql)
- **Admin roles**: The four fixed administrator roles: owner (everything), admin (everything but administrators), developer (saved queries and collections, no keys) and auditor (read only, no SQL). (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#admin-roles)
- **Administrator**: A named person or pipeline that manages QueryAPIGate, holding one of four fixed roles and signing in with their own admin tokens, so every change in the audit log has someone behind it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#administrator)
- **ADR**: Architecture decision record: a short, numbered document in the product repository that records a design decision, what was weighed and why. The docs cite them, as ADR 0028 for the data plane. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#adr)
- **Agent usage**: GET /api/v1/usage/agents: what each AI agent did over MCP, per agent: calls, rows, errors, masked calls, the queries and connections it used, its ad-hoc calls and what it was refused. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#agent-usage)
- **Agent writes**: How an AI agent changes data: only through a saved query its author marked agent_writes, either held for a person’s approval (approval) or as a single idempotent insert (insert). (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#agent-writes)
- **Alerts**: Live conditions worked out on each request, such as key_expiring or writes_awaiting_approval, shown in the Console and at GET /api/v1/alerts, and gone once the cause is. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#alerts)
- **allowed_paths**: The files a DuckDB connection may read: local folders, s3://, gs:// and r2:// prefixes, and single files on the web. Nothing outside the list can be read from SQL. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#allowed-paths)
- **allowed_tables**: A grant that confines a key’s ad-hoc SQL to named tables. The SQL is parsed, not pattern-matched, and a table outside the list answers as if it did not exist. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#allowed-tables)
- **API key**: The credential an application calls with, sent as X-API-Key. Stored only as a SHA-256 hash; it can be scoped, rate-limited, pinned to IP ranges, given an expiry and rotated. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#api-key)
- **Approval (write request)**: A held agent write, wr_…, that an administrator with writes.approve approves or rejects in the Console. Once approved it runs once, for that caller, with exactly the arguments shown, before it expires. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#approval-write-request)
- **Audit log**: The record of every administrative change: who changed what, with the fields that changed. Each entry is chained to the one before, and the log can stream to your SIEM. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#audit-log)
- **Break-glass key**: QUERYAPIGATE_API_KEY: a full-access key that keeps working as an owner when the identity provider is down. Its use raises an alert. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#break-glass-key)
- **Catalogue**: GET /catalog: what the calling key may run, and on what terms, such as whether a query is cached, whether this key may write through it, and its rate limit. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#catalogue)
- **Client SDK**: A typed client generated from /openapi.json with openapi-generator, for Java, TypeScript, Go or any of about 50 languages. The spec is checked in CI against the official validator. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#client-sdk)
- **Collection**: A named group of saved queries. A key or role granted a collection reaches every query in it, including ones added later; it can be renamed, exported, imported and handed out as a Postman collection. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#collection)
- **Column masking**: Hiding a column from a caller: hash, mask, null or drop. Traced through aliases, CTEs and joins to the source column; a query whose columns can’t be traced is refused rather than answered unmasked. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#column-masking)
- **Compatibility promise**: What changes only with notice: REST endpoints and responses, CLI commands, environment variables, the storage format, grant fields, the saved-query format, the MCP tool contract and error codes. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#compatibility-promise)
- **Configuration as code**: config export, config diff and config apply: the whole setup as one YAML file with no secret in it, reviewed in a pull request and applied all or nothing. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#configuration-as-code)
- **Connection**: A named database, or a folder or bucket of files, that QueryAPIGate reaches with its own credentials. Callers never see those credentials. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#connection)
- **Connection pool**: Database connections kept open and reused between requests, for every type but SQLite: QUERYAPIGATE_POOL_SIZE idle ones per connection setting, 8 by default. A connection used by a failed or timed-out request is closed, never reused. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#connection-pool)
- **Console**: The built-in administration UI at /console: connections, saved queries, keys and roles, a SQL editor, history, the audit log, alerts and approvals. Everything it does is also on the Management API. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#console)
- **Console sign-in (SSO)**: Administrators sign in to the Console through your identity provider over OpenID Connect, with its MFA and policies, and their role comes from their groups. One provider at a time; no SAML. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#console-sign-in-sso)
- **CORS**: Calling the API from a browser frontend on another origin. Off unless QUERYAPIGATE_CORS_ORIGINS names the origins allowed. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#cors)
- **Data dictionary**: An MCP resource per connection, queryapigate://connections/<name>/dictionary, telling an agent what each table and column means and which columns are masked for it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#data-dictionary)
- **Data plane Exp**: queryapigate-dataplane, a Rust process in the image that takes the public port and serves saved-query reads from plans the Python server gives it, forwarding everything else unchanged. Measured at 3-9x the calls a second per core, with every run still recorded; in the Helm chart, dataplane.enabled: true. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#data-plane)
- **Descriptions**: Plain-language notes on connections, tables, columns and parameters, imported from database comments or written by you, and given to agents and docs alike. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#descriptions)
- **Destination**: Where exports may write: an s3://, gs:// or r2:// prefix, or a local folder inside QUERYAPIGATE_EXPORT_DIRS, with credentials stored like a connection password. Every write goes through a DuckDB connection locked to that prefix. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#destination)
- **Draft and published**: A saved query has at most one published version: the one /q/<name> runs and OpenAPI, MCP and Postman describe. Newer versions are drafts, invisible to callers until published. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#draft-and-published)
- **DuckDB connection**: An embedded analytical database that also reads Parquet, CSV and JSON files where they are, on disk, in a bucket or on the web, with no import step. One type for a .duckdb file or for views over files; tier 1. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#duckdb-connection)
- **The eight stages**: What every call passes, whichever front door it used: identify the caller, apply its limits, check the grant, validate parameters, guard the SQL, run it, mask and format, record it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#the-eight-stages)
- **Encryption at rest**: With QUERYAPIGATE_SECRET_KEY set to a Fernet key, every literal connection password is encrypted before it touches disk and decrypted only in memory when a connection opens. The ciphertext is never returned to a client. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#encryption-at-rest)
- **Erasure**: queryapigate history forget jwt:<subject> deletes a signed-in person’s runs, events and usage counts, in the store and in Redis. The audit log records the erasure by the caller’s SHA-256, not their name. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#erasure)
- **Error code**: The stable code field on every error, such as param_invalid or forbidden. Part of the compatibility promise: an existing code is never renamed or repurposed. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#error-code)
- **Event log**: Every run, written to the store in the same batch as its history row. Live events come from it, so a client that reconnects with Last-Event-ID gets what it missed, nothing repeated. Kept 24 hours by default. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#event-log)
- **Events server**: queryapigate events: a separate asyncio server from the same image that serves /events to many clients at once. The main server’s own GET /events holds a thread per stream, so it serves only a few. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#events-server)
- **Example APIs**: Four worked scenarios installed by queryapigate examples load: reporting, dashboard data, a streaming export and a partner integration, each with a collection, a role and a ready key, removable with one command. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#example-apis)
- **Experimental**: A feature that works but sits outside the compatibility promise until it graduates, labelled wherever you meet it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#experimental)
- **Export**: queryapigate export or a saved export: a full result written to a file or a bucket through the same streaming path, incrementally from a watermark, with no server needed. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#export)
- **FIPS mode**: Running on a validated OpenSSL in FIPS mode, such as RHEL 9 or Ubuntu Pro FIPS, with Python and cryptography from the distribution rather than PyPI. Validation belongs to the cryptographic module, not to the application. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#fips-mode)
- **from_claim**: A parameter whose value comes from the caller’s sign-in token instead of the request, so a user can only ever ask for their own rows. A caller who sends it anyway is refused. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#from-claim)
- **Front door**: One of the ways a call arrives: REST, MCP, live events, exports or the Management API. All of them pass the same governance code. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#front-door)
- **Generic JDBC Exp**: db: "jdbc": any database with a JDBC driver, such as Oracle, SQL Server, DB2 or Snowflake, through an embedded JVM and the vendor’s driver jar. It has no query time limit and no schema browser. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#generic-jdbc)
- **Grant**: What a key or role may reach: whole connections, named saved queries or collections, tables for ad-hoc SQL, and which writes, if any. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#grant)
- **Health check**: GET /health: public and never rate-limited, it answers the status, version and time zone. A load balancer skips an instance that fails it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#health-check)
- **Helm chart**: The Kubernetes chart, published with every release at the server’s version. store.type: sqlite runs one pod; store.type: postgres runs several on PostgreSQL with Redis, rolled one at a time. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#helm-chart)
- **Identity provider**: Keycloak, Okta, Auth0, Entra ID or another OpenID Connect provider. It signs people in and issues the tokens QueryAPIGate checks, for signed-in users, the Console and AI clients; QueryAPIGate never sees a password. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#identity-provider)
- **Instances**: GET /api/v1/instances: every serve, mcp and events process using the store, seen in the last 90 seconds, with its version, and problems such as instances whose versions differ. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#instances)
- **Interactive docs**: /docs: Swagger UI over /openapi.json, listing every saved query as its own endpoint with its parameters, types and defaults. The SQL is never included. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#interactive-docs)
- **IP allow-list**: allowed_ips: the addresses or CIDR ranges, IPv4 or IPv6, a key may be used from. A call from anywhere else fails like a wrong key, a 401 that says nothing about why. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#ip-allow-list)
- **Key expiry**: expires_at: a date after which a key stops working on its own. It works through the end of that day, and it is checked on every request, so there is nothing to schedule. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#key-expiry)
- **Key rotation**: POST /api/v1/api-keys/{name}/rotate: a new secret, shown once, while the old one keeps working for grace_minutes, 60 by default and at most a week. The name, grants and history stay. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#key-rotation)
- **Last used**: last_used_at on a key: roughly when it last authenticated, updated at most once a minute. It shows a stale key to revoke, or a new one that was never wired up. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#last-used)
- **list_tables and describe_table**: MCP tools for exploring a connection: its tables and columns, with types and keys, a masked column flagged as such. Listed only for a key with access to whole connections. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#list-tables-and-describe-table)
- **Live events**: Server-sent events as saved queries run, per key if you want, from GET /events or the separate queryapigate events server for many clients. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#live-events)
- **Management API**: /api/v1: everything the Console does, over HTTP, for scripts and pipelines. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#management-api)
- **MCP**: The Model Context Protocol, the standard AI agents use to call tools. QueryAPIGate’s MCP server publishes saved queries as tools under the same rules as REST. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#mcp)
- **MCP tool**: A published saved query as an agent sees it: a name, a description, an input schema built from its parameters, and structured results. mcp: false hides a query from MCP while it still serves REST. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#mcp-tool)
- **Metadata cache**: QUERYAPIGATE_METADATA_CACHE_TTL: seconds the key, saved query and connection a call reads from the store are reused instead of read again. Off by default; a change through another instance is seen up to that long later. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#metadata-cache)
- **Metrics**: /metrics: Prometheus text-format metrics, for a Grafana dashboard or alerting. Public unless QUERYAPIGATE_METRICS_TOKEN is set. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#metrics)
- **MongoDB connection**: find() queries only, with filter, projection, sort and bound parameters, ad hoc or saved. Nothing else is ever sent, and server-side JavaScript such as $where is refused. Tier 1 since 0.37. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#mongodb-connection)
- **OAuth for AI clients**: A hosted AI client signs in through your identity provider, following the MCP specification’s OAuth 2.1. QueryAPIGate is the resource server: it checks tokens and issues none. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#oauth-for-ai-clients)
- **OpenAPI**: /openapi.json: a standard OpenAPI 3.0 document of the API and every saved query. Postman and Insomnia import it by URL, and openapi-generator turns it into clients. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#openapi)
- **Paging**: page and page_size (10 by default, at most 1000 unless the server says otherwise), within the statement’s own LIMIT. Responses carry X-Page, X-Page-Size and X-Has-More. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#paging)
- **Parameter rules**: What a :name parameter accepts: type, default, required, enum, numeric range, length and pattern. Values are bound, never spliced into SQL, and a request breaking a rule gets a 400 listing every problem. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#parameter-rules)
- **Parquet**: A columnar file format. ?format=parquet and exports write it on every database type through DuckDB, with decimals kept exact. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#parquet)
- **Per-key limits**: max_concurrent, query_timeout and max_rows on a key or role. Each narrows the server’s own limit, never widens it; over max_concurrent a call gets a 429, not a place in a queue. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#per-key-limits)
- **Per-query write access**: A queries entry such as {"name": "submit_order", "allow_writes": true}: write access to that one query and nothing else. A wildcard never carries write access. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#per-query-write-access)
- **Query time limit**: QUERYAPIGATE_QUERY_TIMEOUT, 30 seconds by default, enforced by each database itself so the statement is really cancelled. A request or a key can lower it, never raise it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#query-time-limit)
- **Quota**: Calls and rows per day or month for a key, with X-Quota-Remaining-* headers on every response and an alert before it runs out. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#quota)
- **Rate limit**: A request budget: a server-wide limit by client address, and an optional per-key rate_limit. A request must pass both; over it, the answer is a 429 with retry_after. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#rate-limit)
- **Redis**: Shared state for several instances: rate limits and the response cache. Optional for one instance, which it gives a cache that survives restarts; required for several. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#redis)
- **Request ID**: An identifier on every response, X-Request-Id, also in the error body and on every log line written for that request. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#request-id)
- **Response cache**: Optional HTTP caching a saved query opts into with cache_ttl: ETag, conditional requests and 304, never for a query that writes. In-process, or shared through Redis. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#response-cache)
- **Response formats**: json, ndjson, csv, tsv, xml, yaml, xlsx or parquet, chosen with ?format=. The first is the default. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#response-formats)
- **Role**: A reusable template of grants and limits, copied onto a key once when the key is created. Editing or deleting a role later never changes a key made from it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#role)
- **Rolling upgrade**: Replacing instances on one store one at a time, with no downtime. Within 1.x a release changes the store only by adding to it, so instances still on the previous release keep working; CI checks it. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#rolling-upgrade)
- **Run history**: The record of each run: when, which connection, which key, through which front door, how long and how many rows. MCP runs carry "transport": "mcp". (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#run-history)
- **Run store Exp**: QUERYAPIGATE_RUN_STORE_URL: run history, the event log and usage rollups kept in ClickHouse instead of the store, for a data plane’s rates. Keys, queries and the audit log stay where they are. A prototype. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#run-store)
- **Saved query**: SQL with a name, description, parameters, permissions and optional cache settings, published as GET /q/<name>, an MCP tool and an export from the one definition. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#saved-query)
- **Schema browser**: A connection’s tables and views, with columns, types, nullability and keys, in the Console and at GET /connections/<name>/schema. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#schema-browser)
- **Scoped key**: An API key restricted to a set of connections, an allow-list of saved queries or collections, or both, so it reaches only what it was given. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#scoped-key)
- **Secret reference**: ${VAR}, ${file:...} or ${vault:...} in place of a password, resolved when it is needed, so the secret is never kept in the store. Vault can also issue short-lived database credentials. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#secret-reference)
- **Security headers**: nosniff, a Content-Security-Policy, no-referrer, no-store and, when configured, HSTS, set on every response by the server itself rather than left to a proxy. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#security-headers)
- **Semantic search Exp**: A text parameter marked "embed": true: the server turns the caller’s words into an embedding and binds it, so the SQL can rank rows by pgvector similarity. PostgreSQL only, and off unless an embeddings endpoint is set. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#semantic-search)
- **Several instances**: Any number of interchangeable instances behind a load balancer, sharing a PostgreSQL store and Redis. The reference deployment is three instances behind Caddy in one Compose file. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#several-instances)
- **SIEM streaming**: Every audit entry, as it is written, to Splunk, Sentinel, Elastic, QRadar or a log forwarder, over syslog with TLS or over OTLP. UDP is refused, because it loses entries silently. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#siem-streaming)
- **Signed release**: From 0.31, every image and Helm chart is signed keyless with cosign by the release workflow, with SLSA provenance, an SBOM and a GitHub attestation, so you can check what you run. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#signed-release)
- **Signed-in user**: An app user who calls with their own Authorization: Bearer token from your identity provider instead of a shared key, and is mapped to a role. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#signed-in-user)
- **SQL guard**: The check that lets only single SELECT, WITH, SHOW, DESCRIBE and EXPLAIN statements through by default, before anything reaches the database. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#sql-guard)
- **Store**: Where QueryAPIGate keeps its own state: saved queries, keys, roles, history and the audit log. A SQLite file by default, or PostgreSQL for several instances. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#store)
- **Streaming**: ?stream=true: the whole result sent straight from the database cursor instead of built in memory, so an export larger than memory still downloads. CSV, TSV, NDJSON and Parquet only, and always read-only. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#streaming)
- **Structured results**: An MCP tool’s answer as data: structuredContent matching its outputSchema, {"rows": [...], "truncated": <bool>}, so code reads rows rather than parsing text. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#structured-results)
- **Tamper-evident chain**: Each audit entry carries a sequence number, the previous entry’s hash and its own, so a changed, removed, inserted or reordered entry breaks every hash after it. With QUERYAPIGATE_AUDIT_KEY, someone without the key can’t re-sign an edit. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#tamper-evident-chain)
- **Text placeholder**: The older {name} form in saved SQL, substituted as text, so its value may only be a number, a boolean or a plain string. Bound :name parameters are preferred. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#text-placeholder)
- **Threat model**: The documented account of what is at risk, who might attack it and from where, the control for each, and what QueryAPIGate does not defend against. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#threat-model)
- **Tier 1**: The database types with every feature, tested against a real server in CI and covered by the compatibility promise. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#tier-1)
- **Tracing Exp**: OpenTelemetry spans sent over OTLP to Jaeger, Tempo, Honeycomb, Datadog and others, showing where a request’s time went. Install the otel extra and set OTEL_EXPORTER_OTLP_ENDPOINT. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#tracing)
- **Trino connection Exp**: The Trino engine, which federates Hive, Iceberg, Delta, Kafka and other databases, as one governed source, with masking, the schema browser, the query time limit and catalog-qualified table grants. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#trino-connection)
- **Watermark**: For an incremental export, the largest value of a column it last delivered, bound to :since on the next run so only what changed is sent. It moves only once the file is written, so a failed run is sent again. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#watermark)
- **Workspace Exp**: An experimental way to run several teams on one server, each with its own connections, queries, keys, roles, history and audit entries. Every route also answers at /w/<workspace>/…. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#workspace)
- **Write granularity**: allowed_write_ops: narrowing a key that may write to specific operations, such as only INSERT, or only on one curated query. (https://anantharajuc.github.io/QueryAPIGate-website/Glossary.dc.html#write-granularity)