Search the tenant's subject-app limit rows. Reads the Postgres mirror: the runtime row is keyed on (tenant, subject), so a tenant-wide listing has no runtime query at all. Filters narrow by subject, by app, and by state; empty filters return every live row in the tenant.

POST rather than GET: the filters are repeated fields, which the gateway cannot carry as query parameters. Pagination is keyset-based over (pksk), the storage primary key, so a concurrent write to a filtered field cannot duplicate or omit a row across pages the way an offset page can.