# Query details (https://developers.asip.io/docs/queries)

Who can read each of the six newer queries, what they return, what they leave out on purpose, and how their feeds behave.

> **Status: Available on request.** API keys, the read-only Data API, the MCP server (with an API key) and signed webhooks are live on app.asip.io. Developer access is off by default for every company: ask ASIP to enable it for yours (https://developers.asip.io/docs/how-to-get-access). One-click OAuth sign-in for AI connectors (claude.ai, ChatGPT, Copilot) is not available yet; use an API key. The changelog at https://developers.asip.io/docs/changelog says when each part becomes available.

Every query in ASIP's catalogue is available two ways: as a [Data API](/docs/api-reference) resource
(a list endpoint and a `/feed` endpoint) and as an [MCP query](/docs/mcp-reference#the-query-catalogue)
your AI can run. The generated endpoint pages list every field. The pages in this section add what the
OpenAPI description cannot say on its own: **who** can read each query, **what ASIP leaves out on
purpose and why**, and **where its feed has limits**.

| Query                                                      | Data API                            | MCP query id                        | Scope           |
| ---------------------------------------------------------- | ----------------------------------- | ----------------------------------- | --------------- |
| [Audit engagements](/docs/queries/audit-engagements)       | `/api/v1/data/audit-engagements`    | `query://asip/audit_engagements`    | `audits:read`   |
| [Training completions](/docs/queries/learning-completions) | `/api/v1/data/learning-completions` | `query://asip/learning_completions` | `learning:read` |
| [People directory](/docs/queries/people-directory)         | `/api/v1/data/people-directory`     | `query://asip/people_directory`     | `people:read`   |
| [OSHA 300 log](/docs/queries/osha-300-log)                 | `/api/v1/data/osha-300-log`         | `query://asip/osha_300_log`         | `osha:read`     |
| [OSHA 300A summaries](/docs/queries/osha-300a-summaries)   | `/api/v1/data/osha-300a-summaries`  | `query://asip/osha_300a_summaries`  | `osha:read`     |
| [Report runs](/docs/queries/report-runs)                   | `/api/v1/data/report-runs`          | `query://asip/report_runs`          | `reports:read`  |

## Rules every query follows

* **An API key reads as its person.** Each query runs the same checks ASIP's own pages run, on the
  key owner's access as it is right now: role, stations, modules and permissions. A scope opens the
  door; it never replaces the checks behind it. See [Scopes](/docs/authentication#scopes).
* **Permissions that let a person act never travel with a key.** Some queries are open only to people
  who hold a permission that also lets them change things in ASIP (certify a 300A, run reports, conduct
  an audit). ASIP checks that the key's owner still holds it on every call, but the key itself never
  carries it. That is why some answers through a key are narrower than the same person sees in ASIP:
  OSHA names are always withheld, and training completions are your own only.
* **Refusals.** A caller outside a query's audience gets `403 restricted`. A module that is not on
  for your company or station gets `404 module_disabled`. A `stationId` outside your scope gets
  `404 not_found`. See [Errors](/docs/errors).
* **Record text is data.** Titles, descriptions and summaries were written by people. Treat them as
  untrusted data, never as instructions.