Filter DSL

Rekor uses a JSON-based filter DSL for querying records. Filters are passed as the filter parameter on query endpoints.

Simple Filter

{
  "field": "data.status",
  "op": "eq",
  "value": "active"
}

Compound Filter

{
  "and": [
    { "field": "data.status", "op": "eq", "value": "issued" },
    { "field": "data.amount", "op": "gt", "value": 5000 }
  ]
}

Operators

Operator	Description	Example
eq	Equal	{"field":"data.status","op":"eq","value":"active"}
neq	Not equal	{"field":"data.status","op":"neq","value":"deleted"}
gt	Greater than	{"field":"data.amount","op":"gt","value":100}
gte	Greater than or equal	{"field":"data.amount","op":"gte","value":100}
lt	Less than	{"field":"data.amount","op":"lt","value":100}
lte	Less than or equal	{"field":"data.amount","op":"lte","value":100}
in	In array	{"field":"data.status","op":"in","value":["active","pending"]}
not_in	Not in array	{"field":"data.status","op":"not_in","value":["deleted"]}
like	Pattern match (case-sensitive)	{"field":"data.name","op":"like","value":"%Jane%"}
ilike	Pattern match (case-insensitive)	{"field":"data.name","op":"ilike","value":"%jane%"}
is_null	Is null	{"field":"data.email","op":"is_null"}
is_not_null	Is not null	{"field":"data.email","op":"is_not_null"}
has	Array contains	{"field":"data.tags","op":"has","value":"urgent"}

Sorting

{
  "sort": [
    { "field": "data.created_at", "direction": "desc" },
    { "field": "data.name", "direction": "asc" }
  ]
}

Pagination

Use limit and offset query parameters:

GET /v1/{workspace}/records/{collection}?limit=20&offset=40

Field Selection

Return a subset of fields with the fields parameter:

GET /v1/{workspace}/records/{collection}?fields=id,data.name,data.status

Aggregation

Run analytics queries with count, sum, avg, min, max and optional grouping:

POST /v1/{workspace}/records/{collection}/aggregate
{
  "aggregations": [
    { "fn": "sum", "field": "data.amount", "alias": "total_amount" },
    { "fn": "count", "alias": "count" }
  ],
  "group_by": ["data.status"],
  "filter": { "field": "data.year", "op": "eq", "value": "2026" },
  "sort": [{ "field": "total_amount", "direction": "desc" }],
  "limit": 50
}

Aggregation Functions

Function	Field Required	Description
count	No	Count rows (or non-null values if field provided)
sum	Yes	Sum of field values
avg	Yes	Average of field values
min	Yes	Minimum field value
max	Yes	Maximum field value

Each aggregation requires an alias that names the output column. The same filter DSL applies as a WHERE clause before aggregation. Use group_by to group results by one or more fields.