Named queries

SQL lives in .appbricx/backend/queries/<name>.sql with Mustache parameters. The UI and workflows call the same name — never paste raw SQL into React.

File layout

.appbricx/backend/queries/
  list_leads.sql
  list_leads.meta.json      # optional params + allow list
  create_lead.sql

Example SQL

SELECT id, email, status, created_at
FROM leads
ORDER BY created_at DESC
LIMIT {{limit}}

From the frontend

import { runtime } from "@appbricx/runtime";

const result = await runtime.queries.run("list_leads", { limit: 50 });
if (!result.ok) throw new Error(result.error?.message);
const rows = result.rows;

HTTP

curl -sS -X POST "$ORIGIN/__appbricx/queries/list_leads" \
  -H "Authorization: Bearer $DATA_TOKEN" \
  -H "x-appbricx-data-api: 1" \
  -H "x-appbricx-app-session: $APP_SESSION" \
  -H "content-type: application/json" \
  -d '{"params":{"limit":50}}'

Rules

• Parameters use {{param}} and compile to bind variables — not string concatenation.
• Forbidden: {{{raw}}} / identifier interpolation.
• When the app runtime is enabled, inventing db.query SQL inside UI files is rejected.
• Prefer runtime.test_query / Backend → Queries to verify.

Related: Workflows · Auth & RLS