RunQueryAPI mirrors the erdo_run_query MCP tool as a REST endpoint.
Authorizations
An Erdo API key (erdo_api_...) or scoped token (erdo_token_...).
Path Parameters
Body
which has always supported this and which every internal admin/debug read already uses. External callers had no way to reach it, and that turned a default filter into something nobody outside Erdo could see past — including the person who created it.
That matters because default filters are how rows get hidden on purpose: test submissions, and now a lead somebody marked as never having been an enquiry. Hiding a row from the numbers is right; making it unreadable is not. Reviewing what you excluded, and deciding whether you were wrong, needs the row itself.
It is not an access bypass: RBAC decides who may read the dataset at all, and this only chooses whether a presentation default is applied to a read the caller is already entitled to make. Absent means true, so every existing caller is unaffected.

