Skip to content

SQL2API

Turn SQL queries into secure, governed REST APIs.

SQL2API is a self-hosted, single Flask service that runs SQL against your databases and returns the results as JSON, NDJSON, XML, YAML, CSV, TSV or Excel. Save a query once and it becomes a versioned endpoint with typed, injection-safe parameters and run history - without writing a controller, a repository layer, pagination, auth or serialization boilerplate for it.

Write SQL. Configure the query. Apply access controls. Get an API.

See it in one request

$ curl 'http://127.0.0.1:5000/q/actor_by_id?id=7'
[{"actor_id": 7, "first_name": "GRACE", "last_name": "MOSTEL"}]

$ curl 'http://127.0.0.1:5000/q/films_by_rating?rating=PG&max_length=60&format=csv&page_size=2'
film_id,title,rating,length
410,HEAVEN FREEDOM,PG,48
443,HURRICANE AFFAIR,PG,49

Both endpoints above came from the bundled example database - no setup beyond the four commands below.

Quickstart

pip install sql2api
git clone https://github.com/AnanthaRajuC/SQL2API.git && cd SQL2API/examples
cp db_connections.example.json db_connections.json
sql2api serve

That's a running server with two sample SQLite databases and two saved queries already configured - the exact requests above will work against it immediately. For your own database, see the full Installation and setup guide.

Why SQL2API

  • No boilerplate. A saved query becomes a documented, versioned REST endpoint - no controller, repository layer, pagination or serialization code to write for it.
  • Governed, not just exposed. Scoped API keys, reusable permission roles, per-query write curation, rate limiting, IP allowlisting, key expiry and a durable audit log of every administrative change - see Authentication and permissions.
  • Read-only by default. A single-statement SQL guard blocks writes and multi-statement injection unless a connection or key explicitly opts in, narrowed further to specific write operations if needed.
  • Handles small and huge results the same way. Paginated JSON/CSV/XML/YAML/XLSX for typical results, constant-memory streaming exports (?stream=true) for exports too large to hold in memory - see Streaming exports.
  • Every major database, one interface. Native drivers for MySQL, PostgreSQL, ClickHouse, SQLite, H2 and DuckDB, plus generic JDBC for anything else with a driver jar.
  • Observable from day one. Structured logs, request IDs, per-key metrics and a Prometheus /metrics endpoint - see Observability.
  • A real admin UI included. Manage connections, saved queries, API keys and roles, run ad-hoc SQL with a schema browser, and review the audit log - all from /ui, with no separate tool to install.

Where to go next