---
title: "Run one read-only query on an app's database"
method: POST
path: "/apps/{id}/query"
tags: ["Apps"]
---

# Run one read-only query on an app's database

`POST /apps/{id}/query`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/apps/{id}/query`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `sites:read`)

Runs one SELECT on the app's own database and returns at most 50 rows, to see what is in it while building or debugging. It only reads: anything that writes or changes the schema is refused, and the query runs as a subquery with the row limit outside it. Email addresses and phone numbers in the result are masked, long text is cut and binary values show only their size. Per-user tables can be read here (the project owns the data); every query is logged in the project's activity, without its SQL. At most 120 queries per hour per project.

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `sql` string, required: One SELECT (or WITH ... SELECT). Nothing that writes or changes the schema.
  - `limit` integer: Rows to return, 1 to 50 (default 20).

## Response `200`

The rows.

- object
  - `columns` string[], required
  - `rows` object[], required
  - `row_count` integer, required
  - `limit` integer, required
  - `truncated` boolean, required: true when there were more rows than limit.
  - `per_user_tables` string[], required: Per-user tables this query read.
  - `masked` string, required

## Other responses

- `400`: Bad Request: invalid_json.
- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required.
- `404`: Not Found: not_found.
- `409`: Conflict: conflict.
- `422`: Unprocessable Content: validation_failed, query_failed.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)