MongoDB

Read collections in a MongoDB database you run: a hosted cluster or your own replica set.

Connect it in the console under Integrations > Connectors. See Connectors for how connectors work and who can use them.

Create a read-only credential

Add a database user with the built-in read role on your database, and copy the mongodb+srv:// connection string for that user. If the cluster only admits listed addresses, add VAIF Studio’s (below).

The host must resolve to a public address: VAIF Studio refuses private, loopback, link-local and cloud metadata addresses, and connects to the address it checked, so a DNS change cannot redirect it.

Settings

Setting		Notes
Connection string	Required	Stored encrypted and never shown again.
Database	Required	For example app.

The connection string is either mongodb+srv://user:password@cluster0.example.mongodb.net or a mongodb:// list of hosts. Every host in it, and every host a mongodb+srv:// record points to, must resolve to a public address.

Tables

Table	Filters	Returns
collections	None	Collections in the database.
find	collection (required), filter, projection, sort	Documents in one collection (filter, projection and sort are JSON).
aggregate	collection (required), pipeline (required)	Run a read-only aggregation pipeline ($out and $merge refused). Needs the developer role.

Query from the API

curl -s -X POST "https://api.vaif.studio/database/connector/$VAIF_PROJECT_ID/query" \
  -H "Authorization: Bearer $VAIF_TOKEN" -H "Content-Type: application/json" \
  -d '{"wrapperId":"mongodb_fdw","table":"find","filters":{"collection":"orders","filter":"{\"status\":\"paid\"}","sort":"{\"createdAt\":-1}"},"limit":50}'

$VAIF_TOKEN is a console access token. See Connectors for the routes.

How it stays read-only

$out and $merge write data and are refused anywhere in a pipeline, including inside $facet and $lookup. Every query has a 15-second maxTimeMS, and a $limit is added to every pipeline. ObjectId values come back as strings, and dates as ISO strings.