Run SQL on a branch

Runs a script on one of the branch's Postgres databases on a fresh connection as the database's owner (Admin only), or, with role, as that role: the connection logs in as your own hidden member role on the branch, which can only become the roles you were granted (and what they can become), then runs SET ROLE to role, so a script that resets its role is never the owner. When the run ends (however it ends), its session is ended, whatever the script made as the member role itself is handed to role, and every privilege, default privilege or policy naming the member role is dropped. An Admin acting as a role a member role can't hold (LOGIN, owner-level, or reaching a reserved role) uses the owner's connection and SET ROLE; naming the owner runs as the owner. The script is sent unchanged as one simple query, so multi-statement scripts, explicit transactions and commands like VACUUM work. Unless confirm is true, risky statements (drops, truncates, DELETE/UPDATE without WHERE, also under EXPLAIN ANALYZE or PREPARE, and anything that doesn't parse) and, on a protected branch, every statement that isn't a read are held back with 409 sql_confirm_required. Errors before the connection opens are JSON; then the answer is 200 application/x-ndjson, one JSON event per line: notice, columns (statement, columns: [{name, type}]), rows (statement, at most 200 rows of text-or-null values), complete (statement, tag, rows, truncated: over 1,000 rows), error (statement, code, message, detail, hint, position: 1-based in the sent text), heartbeat (after 15 s without another event) and, always last, done (outcome: ok, error, cancelled, timeout or truncated_response past 10 MiB; duration_ms). Closing the stream cancels the run. Every run is logged with its command tags and a SHA-256 of the script, never the script.

Path ParametersCopy Anchor Link

Response BodyCopy Anchor Link