View Categories

Database REST API: Turn Any SQL Query into an Endpoint

Database REST API · the hub

Turn any SQL query into a REST API endpoint

Write a query in Query Builder against any of the 59 connectors, click New endpoint, and you have a URL at api.querystreams.com with its own key. The SQL runs read-only on the Agent that already sits with your data; callers get JSON or CSV and never see the SQL, the schema or a credential. No server to host, no port to open, and every plan including Free has it. This page is the overview; each connector has its own guide below.

About 90 seconds from a saved query No server to host Data stays on your network One key per caller, revoke anytime
Stuck at any point? Just ask us. Open Support in Query Streams (top-right menu → Support) and send us a message. Real people read it, and “I don’t know what this screen is asking for” is a perfectly good question.

What you’ll end up with

A URL that returns the rows of a saved query to anyone holding a key, tested from the console in the portal before you share it. Like this:

POSTapi.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19
KeyValueDescription
city string OptionalSeattleCallable filter from the saved query
X-API-Keyqsapi_AB••••••••••Your secret token
{
  "city": "Seattle"
}
HeaderValueDescription
X-API-Keyqsapi_AB••••••••••Your secret token. One per caller, revoke anytime.
Content-Typeapplication/jsonThe parameters travel as a JSON body
Acceptapplication/jsonJSON back; ask for text/csv and you get CSV
curl -X POST "https://api.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19" \
  -H "X-API-Key: qsapi_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"city": "Seattle"}'
Status 200 OKTime 84 msSize 412 BTruncated no
{
  "columns": [ { "name": "customer_id", "type": "integer" }, { "name": "name", "type": "string" }, { "name": "city", "type": "string" } ],
  "rows": [
    { "customer_id": 1042, "name": "Northwind Traders", "city": "Seattle" },
    { "customer_id": 1057, "name": "Alpine Outfitters", "city": "Denver" },
    { "customer_id": 1063, "name": "Harbour Foods", "city": "Halifax" }
  ],
  "meta": { "row_count": 3, "agent_duration_ms": 41, "request_id": "req_7Hq2mKd9" }
}
HeaderValueDescription
content-typeapplication/json; charset=utf-8The envelope on the Body tab
content-length412Bytes returned; the Size badge above
Read-only: one saved query, nothing else SQL never leaves your account Every call on the Activity tab

Most tools that put a REST API on a database, PostgREST, Hasura, DreamFactory, Directus and the frameworks you would write yourself, expose the schema: every table becomes an endpoint and the caller browses. Query Streams does the opposite. One saved query defines exactly what an endpoint returns. The caller gets those rows and nothing else about how they were produced, and you never run an API server, because the Agent you already have runs the query and api.querystreams.com does the HTTP.

WHERE THE DATABASE LIVESyour office network or server roomYour own databasestays on your networkQuery Streams Agentruns the saved queryapi.querystreamschecks the keyHTTPS · rows only, never the SQLWHOEVER HOLDS A KEYyour app, a dashboard, a partner, a scriptGET or POST with X-API-KeyJSON, CSV or NDJSON back
The Agent lives with your data and runs the query. api.querystreams.com checks the key and rate limit and passes the rows on. The caller never reaches your network.

What you’ll need

A Query Streams account

Every plan has the REST API. Free gives you one endpoint, two keys and 250 rows per call, which is enough to build this guide. Sign up at my.querystreams.com.

The Agent on a computer that can reach your own database, with the connection added

Often the database server itself or an always-on computer on the same network.

A saved query in Query Builder

The endpoint wraps exactly one saved query. Write the SELECT, run it once, save it. Add a Dynamic Filter (a @variable in the WHERE clause) if callers should be able to filter.

Who can create endpoints? Owners, Admins and Creators. If the API item is missing from your top bar, an Admin can switch it on for your user under Account → Permissions. Anyone you share an endpoint with only needs a Query Streams account, on any plan.

Set it up in four steps

  1. Save the query

    In Query Builder pick a connection, write the SELECT and run it once. A @variable in the WHERE clause becomes an API parameter:

    Saved query · with one Dynamic Filter
    SELECT customer_id, name, city
    FROM customers
    WHERE city = @city
    ORDER BY name;

    Click Save; the name becomes the endpoint’s display name.

  2. Create the endpoint

    Open API in the top bar, click New endpoint, and on Pick query click the query you saved. Click Next.

  3. Configure and lock parameters

    On Configure keep Lifespan Permanent, Response mode Static and Inner format JSON for a first endpoint; mode and format are fixed once created. On Lock params leave city as Callable, or Lock it to a fixed value the caller cannot change. Click Next.

  4. Share and get your key

    Invite People by email, add a Service key for a tool, or skip for now, then click Create & get my key. Copy the 49-character key starting qsapi_; it can be revealed again later from the Sharing tab. Click Send in the console to make the first call.

That’s it. The query answers on a URL, read-only, to the keys you hand out. Each connector guide below walks the same four steps with that connector’s own SQL and the things that are particular to it.

Call it from anywhere

Replace the endpoint id with yours and qsapi_YOUR_KEY with your key:

GET · parameters in the query string
curl "https://api.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19?city=Seattle" \
  -H "X-API-Key: qsapi_YOUR_KEY"
Response · 200 OK · application/json
{
  "columns": [ { "name": "customer_id", "type": "integer" }, { "name": "name", "type": "string" }, { "name": "city", "type": "string" } ],
  "rows": [
    { "customer_id": 1042, "name": "Northwind Traders", "city": "Seattle" },
    { "customer_id": 1057, "name": "Alpine Outfitters", "city": "Denver" },
    { "customer_id": 1063, "name": "Harbour Foods", "city": "Halifax" }
  ],
  "meta": { "row_count": 3, "agent_duration_ms": 41, "request_id": "req_7Hq2mKd9" }
}

Rows come back as objects keyed by column name, with the column list and a meta block that tells you how many rows there are, whether the result was clipped, and the request id you can quote to support. The same call as a POST puts the parameters in a JSON body, which is the right choice for long lists of values:

POST · parameters in a JSON body
curl -X POST "https://api.querystreams.com/v1/endpoints/8f2c4d1e-6b3a-4f7e-9c21-5d0a7b3e2f19" \
  -H "X-API-Key: qsapi_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"params": {"city": "Seattle"}}'
?format=csv
CSV instead of JSON, header row included. Accept: text/csv does the same. Streaming endpoints return NDJSON (one JSON object per line) with a final {"_summary": true, "row_count": N} line; check that last line.
?sample=true
At most five rows, not billed. Good for wiring up a client.
?compression=lz4
An LZ4-frame body for high-volume callers with a decoder; the Code tab has the decoder snippet per language. Plain gzip happens on its own when your client sends Accept-Encoding: gzip.
Authorization: Bearer qsapi_…
Accepted as an alias for X-API-Key. Use it from browser code.

Where it plugs in

Excel and Power BI

Export → Power Query M (.pq) gives you a ready-made query. Paste it into the Advanced Editor (Excel: Data → Get Data → From Other Sources → Blank Query; Power BI: Home → Transform data → New Source → Blank Query) and replace the placeholder with your qsapi_ key.

Postman, Insomnia, Hoppscotch

The same Export menu downloads a Postman v2.1 collection, an Insomnia v5 export or a Hoppscotch collection with the parameters filled in and a placeholder for the key.

Your own code

The Code tab has working samples for cURL, Python, JavaScript, TypeScript, Java, C#, Go, PHP, PowerShell and Ruby. Export → OpenAPI 3.1 spec feeds any client generator or Swagger UI.

n8n, Zapier, Make, cron

Create a Service key for the tool, paste the URL and the key into its HTTP node, and schedule it. Each tool gets its own key, so you can revoke one without touching the others.

Guides by connector

Every connector Query Streams supports can be published this way. Pick yours:

Databases you run

Data warehouses

Hosted databases

Folders of files and logs

SaaS and API connectors

Consumer-side guides: Power BI and Excel via Power Query M.

What the plans allow

PlanEndpointsKeys per endpointPeople per endpointRows per call (static)Rows per call (streaming)Calls per minute, per key
Free1212502503
Personal Core2325,000250,00015
Personal Plus55510,000500,00030
Business Core5101050,0001,000,000300
Business Plus102025100,0005,000,000600
Business Max253050250,00010,000,000600
Enterprise Core5050100500,00025,000,0001,000
Enterprise Plus1001002501,000,00050,000,0001,000
Enterprise Max2502005002,500,000100,000,0001,500

Every call also has a fixed 60-second query timeout and an 8 MiB response cap, and the bytes it returns count against your plan’s monthly data allowance, the same allowance the Excel and Google Sheets add-ins use. Free has one endpoint and 5 MB a month, which comfortably covers a small table called many times a day. See the pricing page for the allowances by plan.

Free is a plan you keep. It is not a trial that expires. See exactly what it includes on the pricing page.

Keeping it safe

The SQL stays yours

Callers get rows. They never see the query, the table names or the connection details, and they cannot change what the endpoint runs.

One key, one endpoint, one caller

A key works for exactly one endpoint. Give each person or tool their own, and every call is logged against it. Revoke one and the others keep working; revocation takes effect within about five minutes.

Read-only, on your side of the wall

The Agent runs the one saved SELECT and nothing else, from inside your network, over its own outbound connection. There is no port to open and no credential on the internet.

Every call in the ledger

The Activity tab shows each call with time, recipient, status, rows, bytes and duration, including refused ones. Set an Expiring lifespan for a temporary share and the endpoint switches itself off on the date.

When something doesn’t work

StatusCodeWhat to do
401API_KEY_REQUIRED / API_KEY_INVALIDThe header is missing or the key is wrong. Send X-API-Key: qsapi_…, the whole 49 characters. Keys can be copied again from the endpoint’s Sharing tab.
403API_KEY_ENDPOINT_MISMATCHA valid key used on a different endpoint. Each key belongs to one endpoint.
403API_KEY_REVOKED / API_ENDPOINT_EXPIREDThe key was revoked or the endpoint reached its expiry date. Mint a new key or restore the endpoint.
400API_PARAM_NOT_OVERRIDABLEYou sent a parameter the owner did not mark Callable. The body lists the allowed names.
414API_QUERY_TOO_LARGEThe GET query string passed 8 KB or 200 list values. Send the same parameters as a POST JSON body.
413API_OUTPUT_TOO_LARGEThe result passed the 8 MiB cap. Narrow the query, or switch the endpoint to Streaming.
429API_RATE_LIMITEDToo many calls this minute for the key or the endpoint. Wait for the Retry-After seconds, or raise Rate limit under API Settings → Defaults within your plan.
429API_DATA_REALM_EXHAUSTEDThe owner’s monthly data allowance is used up. It resets with the billing month; upgrade for more.
503API_AGENT_NOT_CONNECTEDThe Agent behind your own database is offline. Check it under Data → Data Agents; calls succeed again as soon as it reconnects.
504API_QUERY_TIMEOUTThe query took longer than 60 seconds. Add a filter or an index, or save a narrower query.

Every error body has the shape {"error": {"code": "…", "message": "…"}} and every response carries an X-QS-Request-Id header. Quote the id when you write to support.

Questions people ask

Does my data get copied to Query Streams?

No. The Agent runs the query where your data is and sends only the rows the call asked for. Nothing is synced or cached in between; every call runs the query.

Can callers change the SQL or ask for other tables?

No. An endpoint runs one saved query. Callers can only set the parameters you marked Callable, and the values are bound safely: text is quoted and escaped, numbers are range-checked, lists are expanded.

How do I hand this to a partner?

On the endpoint’s Sharing tab choose People and enter their email. They get a magic link, sign in with that address (a Free account is fine) and mint their own key; you see their calls by name on the Activity tab. For a server or an automation tool, create an API key with a label instead.

What happens when I edit the saved query?

The endpoint runs the new SQL on the next call and its OpenAPI spec regenerates. The URL and the keys do not change. If you add or remove a filter, revisit Lock params so callers see the right parameters.

Does the Free plan really cover this?

Yes. Free is a plan you keep, not a trial that expires. It includes one endpoint, two keys and 250 rows per call. See exactly what it includes on the pricing page.

How is this different from PostgREST, Hasura or DreamFactory?

Those expose your schema as an API and you host them. Here one saved query is one endpoint, the SQL and the schema stay private, and there is nothing to host: the Agent you already run executes the query and api.querystreams.com serves the HTTP, the keys, the rate limits and the ledger.

Can one endpoint join data from two databases?

Yes. Save a federated (cross-source) query in Query Builder and expose it; federated endpoints run in Static mode.

Can I stream large results?

Choose Streaming as the response mode when you create the endpoint. Rows arrive as NDJSON or CSV in chunks up to your plan’s streaming row cap, with a summary line at the end.

Still stuck? Open Support in Query Streams and tell us which step you are on and what you see. We will get you connected.

Setup trouble?

  • Agent shows Offline, or Test connection and Browse are greyed out? Check that the Agent is online → Is the Agent online?
Updated on September 27, 2026

Powered by BetterDocs