# Data-plane views

These routes let the console, the SDK, and agents look inside a running
environment without holding its database credentials. All are scoped under:

```
/v1/organizations/{org}/projects/{project}/environments/{env}
```

and require a Bearer token with access to the organization. When a service is
unreachable or not yet deployed, the list routes return an empty result with a
`notes` explanation instead of an error.

| Method & path (relative) | Returns | SDK |
|---|---|---|
| `GET /auth/users` | Auth users | `auth.listUsers(ref)` |
| `GET /auth/providers` | Configured sign-in providers | `auth.listProviders(ref)` |
| `GET /auth/policies` | Row-level security policies | `auth.listPolicies(ref)` |
| `GET /database/tables` | `public` tables, columns, and access rules | `database.tables(ref)` |
| `POST /database/query` | Result of one read-only statement (`SELECT`, `WITH`, `EXPLAIN`) | — |
| `GET /storage/buckets` | Buckets | `storage.listBuckets(ref)` |
| `GET /storage/buckets/{bucket}/objects` | Objects in a bucket | `storage.listObjects(ref, bucket)` |
| `GET /functions` | Deployed edge functions | `functions.list(ref)` |
| `POST /functions` | Deploy (create or replace) a function: `{"name", "source"}` | `functions.deploy(ref, {...})` |
| `POST /functions/{name}/invoke` | Invoke a function with a JSON payload | `functions.invoke(ref, name, payload)` |
| `GET /realtime/channels` | Active realtime channels | `realtime.channels(ref)` |
| `GET /queues` | Queues and their depth | `queues.list(ref)` |
| `GET /queues/{queue}/messages` | Messages waiting in a queue (not consumed) | `queues.peek(ref, queue)` |
| `GET /metrics` | Connection, query, and storage metrics | `metrics.get(ref)` |
| `GET /insights` | Analyzed findings with remediations | `insights.get(ref)` |
| `GET /logs` | Recent service log lines, newest first (`limit`, `level`, `from`) | `environments.logs(ref)` |
| `GET /usage` | Flat-price usage envelope | `usage.get(ref)` |

## Read-only queries

`POST /database/query` runs a single statement inside a bounded read-only
transaction and returns capped rows, or the plan for `EXPLAIN`. Writes and DDL
are rejected before execution and again by the database itself. Use
[migrations](https://docs.scribase.com/docs/api/migrations.md) to change schema.

```sh
curl -X POST "$SCRIBASE_API_URL/v1/organizations/acme/projects/store/environments/production/database/query" \
  -H "Authorization: Bearer $SCRIBASE_ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"query": "select count(*) from orders"}'
```