Turn a Aiven SQL query into a REST API endpoint
Save a query in Query Builder, click New endpoint, and you have a URL at api.querystreams.com with its own key. The SQL runs read-only on the Agent that already sits with your Aiven database; the caller gets JSON or CSV and never sees the SQL, the schema or a password. Nothing to host, no port to open. About 90 seconds from a saved query, and the Free plan covers your first endpoint.
What you’ll end up with
A URL at api.querystreams.com that returns the rows of your saved Aiven query as JSON or CSV to anyone holding a key, tested from the console in the portal before you share it. Like this:
| Key | Value | Description |
|---|---|---|
city string Optional | Seattle | Callable filter from the saved query |
X-API-Key | qsapi_AB•••••••••• | Your secret token |
{
"city": "Seattle"
}| Header | Value | Description |
|---|---|---|
X-API-Key | qsapi_AB•••••••••• | Your secret token. One per caller, revoke anytime. |
Content-Type | application/json | The parameters travel as a JSON body |
Accept | application/json | JSON back; ask for text/csv and you get CSV |
curl -X POST "https://api.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19" \
-H "X-API-Key: qsapi_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"city": "Seattle"}'{
"columns": [ { "name": "customer_id", "type": "integer" }, { "name": "name", "type": "string" }, { "name": "city", "type": "string" } ],
"rows": [
{ "customer_id": 1042, "name": "Northwind Traders", "city": "Seattle" },
{ "customer_id": 1057, "name": "Alpine Outfitters", "city": "Denver" },
{ "customer_id": 1063, "name": "Harbour Foods", "city": "Halifax" }
],
"meta": { "row_count": 3, "agent_duration_ms": 41, "request_id": "req_7Hq2mKd9" }
}| Header | Value | Description |
|---|---|---|
content-type | application/json; charset=utf-8 | The envelope on the Body tab |
content-length | 412 | Bytes returned; the Size badge above |
Aiven holds your data in the cloud, run by its provider. Someone else wants a slice of it in their app, their dashboard or their script, and the usual answers all hand over too much: a database login that outlives the project, a nightly export that is stale by breakfast, or a small API server that somebody now has to run and patch. Query Streams makes the endpoint a saved query plus a key. The Agent that already sits with your Aiven service runs the query, api.querystreams.com checks the key and the rate limit, and the caller gets rows. The SQL, the schema and the credentials never leave your account.
What you’ll need
A Query Streams account
Every plan has the REST API. Free gives you one endpoint, two keys and 250 rows per call, which is enough to build this guide. Sign up at my.querystreams.com.
The Agent on any always-on computer, with the Aiven connection added
It only needs internet access.
A saved query in Query Builder
The endpoint wraps exactly one saved query. Write the SELECT, run it once, save it. Add a Dynamic Filter (a @variable in the WHERE clause) if callers should be able to filter.
Who can create endpoints? Owners, Admins and Creators. If the API item is missing from your top bar, an Admin can switch it on for your user under Account → Permissions. Anyone you share an endpoint with only needs a Query Streams account, on any plan.
Set it up in four steps
-
Save the query
In Query Builder pick your Aiven connection, write the SELECT you want to publish and run it once so you can see the rows. Keep it to the columns the caller needs; the endpoint returns exactly what the query returns.
Saved query · customersSELECT customer_id, name, city FROM public.customers ORDER BY name LIMIT 100;
If callers should be able to filter, add a Dynamic Filter, for example
WHERE city = @city. Each@variablebecomes an API parameter in step 3. Click Save and give the query a name; that name becomes the endpoint’s display name. -
Create the endpoint
Open API in the top bar and click New endpoint. The wizard has four steps, Pick query, Configure, Lock params and Share. On Pick query, click the query you just saved; queries whose Agent is offline are greyed out. Click Next.
Shortcut. From Query Builder you can expose the open query directly; the wizard then starts at Configure with the query already chosen.
-
Configure and lock parameters
On Configure the defaults are right for a first endpoint: Display name filled from the query, Lifespan Permanent (choose Expiring for a temporary share), Response mode Static (one JSON response; pick Streaming for results beyond your plan’s static row cap), Inner format JSON. Response mode and format are fixed once created, so decide them here. Click Next.
On Lock params every Dynamic Filter in the query is listed. Leave the ones callers may set as Callable and give each a Query string name; tick Required if a call without it should fail. Pin a value the caller must not change with Locked, or a date scenario such as Start of month. Hidden keeps the query’s own default and rejects any attempt to set it. Click Next.
-
Share and get your key
On Share you can invite People by email or add a Service key for a server or an automation tool, or skip both for now. Click Create & get my key. The success screen shows the endpoint URL and your key: a 49-character string starting
qsapi_. Copy it. You can reveal it again later from the endpoint’s Sharing tab, so it is not lost if you close the screen.Click Send in the console to make the first call from the portal itself. The response pane shows Status, Time and Size, the Body tab shows the JSON, and the call appears on the Activity tab a few seconds later.
That’s it. Your Aiven service now answers on a URL, read-only, to the keys you hand out. Nothing was installed, no port was opened, and the SQL stayed in your account.
Call it from anywhere
Replace the endpoint id with yours from the console’s URL bar and qsapi_YOUR_KEY with your key. Callable parameters go in the query string on GET; here the saved query exposes city:
curl "https://api.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19?city=Seattle" \ -H "X-API-Key: qsapi_YOUR_KEY"
{
"columns": [ { "name": "customer_id", "type": "integer" }, { "name": "name", "type": "string" }, { "name": "city", "type": "string" } ],
"rows": [
{ "customer_id": 1042, "name": "Northwind Traders", "city": "Seattle" },
{ "customer_id": 1057, "name": "Alpine Outfitters", "city": "Denver" },
{ "customer_id": 1063, "name": "Harbour Foods", "city": "Halifax" }
],
"meta": { "row_count": 3, "agent_duration_ms": 41, "request_id": "req_7Hq2mKd9" }
}Rows come back as objects keyed by column name, with the column list and a meta block that tells you how many rows there are, whether the result was clipped, and the request id you can quote to support. The same call as a POST puts the parameters in a JSON body, which is the right choice for long lists of values:
curl -X POST "https://api.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19" \
-H "X-API-Key: qsapi_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"params": {"city": "Seattle"}}'?format=csv- CSV instead of JSON, header row included.
Accept: text/csvdoes the same. Streaming endpoints return NDJSON (one JSON object per line) with a final{"_summary": true, "row_count": N}line; check that last line. ?sample=true- At most five rows, not billed. Good for wiring up a client.
?compression=lz4- An LZ4-frame body for high-volume callers with a decoder; the Code tab has the decoder snippet per language. Plain gzip happens on its own when your client sends
Accept-Encoding: gzip. Authorization: Bearer qsapi_…- Accepted as an alias for
X-API-Key. Use it from browser code.
Where it plugs in
Excel and Power BI
Export → Power Query M (.pq) gives you a ready-made query. Paste it into the Advanced Editor (Excel: Data → Get Data → From Other Sources → Blank Query; Power BI: Home → Transform data → New Source → Blank Query) and replace the placeholder with your qsapi_ key.
Postman, Insomnia, Hoppscotch
The same Export menu downloads a Postman v2.1 collection, an Insomnia v5 export or a Hoppscotch collection with the parameters filled in and a placeholder for the key.
Your own code
The Code tab has working samples for cURL, Python, JavaScript, TypeScript, Java, C#, Go, PHP, PowerShell and Ruby. Export → OpenAPI 3.1 spec feeds any client generator or Swagger UI.
n8n, Zapier, Make, cron
Create a Service key for the tool, paste the URL and the key into its HTTP node, and schedule it. Each tool gets its own key, so you can revoke one without touching the others.
What the plans allow
| Plan | Endpoints | Keys per endpoint | People per endpoint | Rows per call (static) | Rows per call (streaming) | Calls per minute, per key |
|---|---|---|---|---|---|---|
| Free | 1 | 2 | 1 | 250 | 250 | 3 |
| Personal Core | 2 | 3 | 2 | 5,000 | 250,000 | 15 |
| Personal Plus | 5 | 5 | 5 | 10,000 | 500,000 | 30 |
| Business Core | 5 | 10 | 10 | 50,000 | 1,000,000 | 300 |
| Business Plus | 10 | 20 | 25 | 100,000 | 5,000,000 | 600 |
| Business Max | 25 | 30 | 50 | 250,000 | 10,000,000 | 600 |
| Enterprise Core | 50 | 50 | 100 | 500,000 | 25,000,000 | 1,000 |
| Enterprise Plus | 100 | 100 | 250 | 1,000,000 | 50,000,000 | 1,000 |
| Enterprise Max | 250 | 200 | 500 | 2,500,000 | 100,000,000 | 1,500 |
Every call also has a fixed 60-second query timeout and an 8 MiB response cap, and the bytes it returns count against your plan’s monthly data allowance, the same allowance the Excel and Google Sheets add-ins use. Free has one endpoint and 5 MB a month, which comfortably covers a small table called many times a day. See the pricing page for the allowances by plan.
Free is a plan you keep. It is not a trial that expires. See exactly what it includes on the pricing page.
Keeping it safe
The SQL stays yours
Callers get rows. They never see the query, the table names or the connection details, and they cannot change what the endpoint runs.
One key, one endpoint, one caller
A key works for exactly one endpoint. Give each person or tool their own, and every call is logged against it. Revoke one and the others keep working; revocation takes effect within about five minutes.
Read-only, on your side of the wall
The Agent runs the one saved SELECT and nothing else, from inside your network, over its own outbound connection. There is no port to open and no credential on the internet.
Every call in the ledger
The Activity tab shows each call with time, recipient, status, rows, bytes and duration, including refused ones. Set an Expiring lifespan for a temporary share and the endpoint switches itself off on the date.
When something doesn’t work
| Status | Code | What to do |
|---|---|---|
| 401 | API_KEY_REQUIRED / API_KEY_INVALID | The header is missing or the key is wrong. Send X-API-Key: qsapi_…, the whole 49 characters. Keys can be copied again from the endpoint’s Sharing tab. |
| 403 | API_KEY_ENDPOINT_MISMATCH | A valid key used on a different endpoint. Each key belongs to one endpoint. |
| 403 | API_KEY_REVOKED / API_ENDPOINT_EXPIRED | The key was revoked or the endpoint reached its expiry date. Mint a new key or restore the endpoint. |
| 400 | API_PARAM_NOT_OVERRIDABLE | You sent a parameter the owner did not mark Callable. The body lists the allowed names. |
| 414 | API_QUERY_TOO_LARGE | The GET query string passed 8 KB or 200 list values. Send the same parameters as a POST JSON body. |
| 413 | API_OUTPUT_TOO_LARGE | The result passed the 8 MiB cap. Narrow the query, or switch the endpoint to Streaming. |
| 429 | API_RATE_LIMITED | Too many calls this minute for the key or the endpoint. Wait for the Retry-After seconds, or raise Rate limit under API Settings → Defaults within your plan. |
| 429 | API_DATA_REALM_EXHAUSTED | The owner’s monthly data allowance is used up. It resets with the billing month; upgrade for more. |
| 503 | API_AGENT_NOT_CONNECTED | The Agent behind your Aiven database is offline. Check it under Data → Data Agents; calls succeed again as soon as it reconnects. |
| 504 | API_QUERY_TIMEOUT | The query took longer than 60 seconds. Add a filter or an index, or save a narrower query. |
Every error body has the shape {"error": {"code": "…", "message": "…"}} and every response carries an X-QS-Request-Id header. Quote the id when you write to support.
Questions people ask
Does my data get copied to Query Streams?
No. The Agent runs the query where your data is and sends only the rows the call asked for. Nothing is synced or cached in between; every call runs the query.
Can callers change the SQL or ask for other tables?
No. An endpoint runs one saved query. Callers can only set the parameters you marked Callable, and the values are bound safely: text is quoted and escaped, numbers are range-checked, lists are expanded.
How do I hand this to a partner?
On the endpoint’s Sharing tab choose People and enter their email. They get a magic link, sign in with that address (a Free account is fine) and mint their own key; you see their calls by name on the Activity tab. For a server or an automation tool, create an API key with a label instead.
What happens when I edit the saved query?
The endpoint runs the new SQL on the next call and its OpenAPI spec regenerates. The URL and the keys do not change. If you add or remove a filter, revisit Lock params so callers see the right parameters.
Does the Free plan really cover this?
Yes. Free is a plan you keep, not a trial that expires. It includes one endpoint, two keys and 250 rows per call. See exactly what it includes on the pricing page.
Does the endpoint speak Aiven’s SQL dialect?
Yes, because the SQL is yours. You wrote and ran it against your Aiven service in Query Builder; the endpoint runs that exact statement through the same connection, with your parameter values bound in the way Aiven expects.
Does my Aiven service have to be reachable from the internet?
No. Only the Agent has to reach it, from any always-on computer with internet access. The Agent makes one outbound connection to Query Streams; callers talk to api.querystreams.com and never to your server.
Related guides
Every guide for Aiven
Setup trouble?
- Want the Agent to sign in with a login that can only read? Create a read-only database user, with copy-paste SQL for each database → Create a read-only database user
- Agent shows Offline, or Test connection and Browse are greyed out? Check that the Agent is online → Is the Agent online?

