Call DeltaStream’s REST API
This page describes how you can use DeltaStream's REST API from your applications to submit statements and run queries.
DeltaStream exposes a single POST endpoint for executing SQL statements:
POST https://<your-org-endpoint>/v2/statements
Content-Type: application/json
Authorization: Bearer <API_TOKEN>
Body: {"statement": "<DeltaStream SQL>"}Some statements return rows (e.g., SELECT), others return only acknowledgements (e.g., CREATE MATERIALIZED VIEW). The response is JSON and easy to parse.
1) Create an API token
In the DeltaStream web UI, go to Integration → API Tokens.
Click Create, give the token a name, choose a Role (this controls permissions), and click Create again.
Copy the token once and store it securely (you won’t be able to view it again).
Tip: Use the least-privileged role that still lets your statements succeed.

2) Find your API endpoint
In the DeltaStream UI, click the ? (Help) icon (bottom-left). Copy the API ENDPOINT for your org. See the screenshot below for details.

3) Make a request (recommended CURL patterns)
Use environment variables (safer)
Why the funny quoting?
Inside a single-quoted bash string, use '\'' to embed a single quote in SQL. If you don’t like that, use a heredoc:
Windows PowerShell
Sample JSON response (trimmed)
How to read this
data: array of rows (each row is an array aligned to metadata.columns).
metadata.columns: names, types, and nullability for each column in order.
sqlState: SQL status code (
00000indicates success).statementID: server-side identifier for auditing/debugging.
createdOn: request processing timestamp (epoch seconds).
If your statement doesn’t return rows (e.g., CREATE MATERIALIZED VIEW, INSERT, REFRESH), data may be empty while sqlState still indicates success.
Common pitfalls & fixes
401/403: invalid/missing token or insufficient role permissions. Regenerate or change role.
400: malformed JSON (check quoting) or invalid SQL.
Wrong endpoint: ensure you’re hitting
.../v2/statementson your org’s API domain.Quoting issues: prefer heredocs or use the environment-variable pattern above.
Quick JS example (for agents/actions)
Security notes
Never hard-code tokens in code or docs. Use env vars / secret managers.
Rotate any token that was exposed publicly.
Always use HTTPS.
Scope tokens to the minimal role needed.
TL;DR
Create a token → 2) copy your org’s API endpoint → 3)
POST /v2/statementswith{"statement":"<SQL>"}and a Bearer token. That’s it.
Last updated

