Data.get() and Products.get({ filter }) accept: a bounded, Mongo-style grammar with nine field operators and root-level $and and $or. The platform compiles it against each entry’s data fields only, so a filter can never reach ownership fields such as the agent or the end user. Anything outside the grammar is rejected with a FILTER_* error before the query runs.
Verified against lua-cli 3.33.0.
Quick example
Grammar
Field predicates
A scalar is a string, a finite number, a boolean, or
null.
Operators
Logical operators
$and and $or take a non-empty array of filters, each compiled with the same rules. They are valid at the root of a filter and inside another logical branch, never under a field: { price: { $or: [...] } } is rejected.
Rules
- An operator object holds operators only; mixing an operator with a field key (
{ price: { $gt: 1, currency: 'USD' } }) is rejected. - A field path is one or more dotted segments. A segment may not be empty, start with
$, contain a null byte, or be__proto__,prototype, orconstructor. - Two keys that compile to the same path (
{ a: { b: 1 }, 'a.b': 2 }) are rejected. - An empty nested object is rejected.
- Every operator outside the nine listed, including
$regex,$where,$expr,$text,$not,$nor, and$elemMatch, is rejected.
Limits
Errors
A rejected filter fails the call with one of these codes and the JSON path of the offending key.Types
The three exported types describe the shape; placement and limits are enforced when the query runs.string | number | boolean | null
An operand or an equality value.
object
Optional
$eq, $ne, $gt, $gte, $lt, $lte (scalar), $in, $nin (readonly scalar array), and $exists (boolean).Record<string, LuaQueryValue>
Each key is a field path or a root logical operator; each value is a scalar, a scalar array, a
LuaQueryFieldOperators, a nested LuaQuery, or an array of LuaQuery branches.See also
Data—get()takes a Lua QueryProducts—get({ filter })takes a Lua Query- Store and search data — how-to
- Custom data REST API — the same filter as a query-string parameter

