Execute SQL queries against your database. Only DML statements are allowed.
/organizations/:orgId/databases/:dbId/queryExecute a SQL query. Supports SELECT, INSERT, UPDATE, and DELETE.
{
"query": "SELECT * FROM users WHERE active = ?",
"params": [true]
}{
"rows": [
{ "id": 1, "email": "alice@example.com", "name": "Alice", "active": 1 },
{ "id": 2, "email": "bob@example.com", "name": "Bob", "active": 1 }
]
}{
"query": "INSERT INTO users (email, name) VALUES (?, ?)",
"params": ["carol@example.com", "Carol"]
}{
"id": 3
}Send input values in the optional params array, using one unquoted ? per value. A value-count mismatch is rejected before execution with 400. Old requests without params still work. Never interpolate raw user input.
Parameters accept strings, finite numbers, booleans and null. Send large integers and exact decimals as strings. Keep table and column names fixed. LIMIT ? is not supported: validate a bounded integer before placing a LIMIT number in SQL.
Each call is one statement. Separate requests do not share a transaction.
Connecting, preparing and executing a query share a 20-second budget. This is not a deadline for the entire HTTP request. A timeout before execution returns 503 with retryAfter; if execution has started, 502 means the result is uncertain. Check saved data before repeating a write.
SELECT responses are limited to 5 MiB, including UTF-8 JSON wrapping and escaping. An oversized result returns 400, not a truncated success. Select fewer columns or rows and fetch large results in pages.