canonical: https://jentic.com/apis/amazonaws.com/rds-data

# AWS RDS Data API

Jentic publishes the only available OpenAPI specification for the AWS RDS Data API, keeping it validated and agent-ready. The RDS Data API runs SQL against Aurora Serverless and Aurora DSQL clusters over HTTPS without persistent database connections or VPC connectivity, using IAM and Secrets Manager for authentication. Six operations cover single-statement execution, batch parameterized execution, transaction begin and commit and rollback, and a legacy ExecuteSql endpoint. It is the right fit for serverless functions, mobile clients, and AI agents that need ad-hoc SQL access without managing a connection pool.

## For AI agents

Run SQL and parameterized batch statements against Aurora Serverless and Aurora DSQL clusters over HTTPS without managing connections.

## Scope

Does not provision databases, manage schemas via DDL workflows, or run SQL on non-Aurora engines - use for HTTPS SQL execution on Aurora Serverless and Aurora DSQL clusters only.

## Capabilities

- Execute a single SQL statement with named parameters via Execute against an Aurora cluster
- Run a parameterized statement across many parameter sets in one call using BatchExecute
- Open a transaction with BeginTransaction and thread the transactionId through subsequent calls
- Commit or roll back a transaction by transactionId with CommitTransaction or RollbackTransaction
- Authenticate via a Secrets Manager secret ARN that holds the database credentials, not raw passwords
- Return strongly-typed columnMetadata and records for SELECT statements without manual deserialization

## Use cases

### Serverless SQL from Lambda

Call SQL from AWS Lambda or any HTTPS-capable client without VPC attachment, NAT, or a connection pool. ExecuteStatement (POST /Execute) takes resourceArn, secretArn, database, sql, and named parameters and returns columnMetadata plus records. The credentials live in Secrets Manager, so the function only needs IAM permissions for rds-data:ExecuteStatement and secretsmanager:GetSecretValue.

Example prompt: Call POST /Execute with resourceArn of the Aurora cluster, secretArn of the credentials secret, database 'app', sql 'SELECT id,email FROM users WHERE id = :id', and parameters [{name:'id',value:{longValue:42}}]

### Batch Inserts and Imports

Bulk-load data without paying the per-statement HTTP overhead by using BatchExecute. The API accepts a single sql template and an array of parameterSets and runs the same statement once per set inside one call. Useful for syncing webhook payloads, ETL row inserts, or migration top-ups into Aurora Serverless.

Example prompt: Call POST /BatchExecute with sql 'INSERT INTO events(id, payload) VALUES(:id, :payload)' and parameterSets containing one entry per event

### Multi-Statement Transactions

Run several SQL statements atomically over HTTPS by opening a transaction with BeginTransaction, threading the returned transactionId into each Execute call, and committing or rolling back at the end. Common for handling money movement, idempotent upserts, or multi-table writes from a stateless service.

Example prompt: Call POST /BeginTransaction to obtain transactionId, run two Execute calls with that transactionId for INSERT and UPDATE, then POST /CommitTransaction with the same transactionId

### AI Agent Database Tool via Jentic

An agent that needs to read or write SQL data uses Jentic to discover the RDS Data API, load Execute, and run parameterized statements against Aurora. Jentic stores the AWS access key in its vault and signs requests with SigV4; the database credentials themselves stay in Secrets Manager and are referenced by ARN, so secrets never enter the agent context.

Example prompt: Use Jentic to search 'execute sql against aurora serverless', load Execute, and execute it with resourceArn, secretArn, database, and parameterized sql

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /Execute | Execute a single SQL statement with named parameters |
| POST | /BatchExecute | Run a parameterized statement across many parameter sets |
| POST | /BeginTransaction | Open a transaction and return a transactionId |
| POST | /CommitTransaction | Commit an open transaction |
| POST | /RollbackTransaction | Roll back an open transaction |
| POST | /ExecuteSql | Legacy SQL execution endpoint |

## Key resources

- **Statement** — Single-statement SQL execution with named parameters
- **BatchStatement** — Run a parameterized statement across many parameter sets in one call
- **Transaction** — Begin, commit, and roll back transactions by transactionId

## Why Jentic

- **Setup:** Wiring the RDS Data API by hand means computing SigV4 HMAC signatures per request, routing to the regional rds-data host, referencing a database secret by ARN in Secrets Manager, and typing SQL parameters correctly yourself. Through Jentic you install once, import AWS RDS Data API from the API Directory, store your AWS access keys once, and your agent calls it with signing handled per request.
- **Permission scoping:** The cluster ARN, secret ARN, and SQL travel in the request body rather than the URL path, so you limit the agent to the operations it needs, such as Execute and BatchExecute for statement execution. Transaction-control operations like CommitTransaction and RollbackTransaction are included only when you grant them.
- **Credential handling:** Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to produce a SigV4 signature per request, while the database credential stays in Secrets Manager referenced by ARN. Neither the AWS secret access key nor the database password enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'run SQL against an Aurora Serverless cluster', and Jentic returns Execute with its parameter schema for resourceArn, secretArn, database, sql, and parameters so the agent calls the right endpoint directly.

## Related APIs

- **Amazon Redshift Data API** — Same HTTPS-SQL pattern as RDS Data API but targeted at Redshift clusters and serverless workgroups
- **Amazon QLDB Session** — QLDB Session runs PartiQL on append-only ledgers; RDS Data API runs SQL on Aurora
- **AWS Performance Insights** — Diagnose slow SQL surfaced by RDS Data API calls using Performance Insights load attribution

## FAQ

### Why is there no official OpenAPI spec for the AWS RDS Data API?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call the AWS RDS Data API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the RDS Data API use?

The API uses AWS SigV4 HMAC request signing for the HTTPS call, plus a Secrets Manager secretArn parameter that holds the database username and password. Through Jentic, AWS credentials are stored in the vault and SigV4 signatures are produced per request.

### Which databases does the RDS Data API support?

The Data API supports Aurora Serverless v1 and v2 for PostgreSQL and MySQL, and Aurora DSQL. It does not work against provisioned Aurora clusters running classic engines or other RDS engines like Oracle, SQL Server, or MariaDB.

### Can I run multi-statement transactions?

Yes. POST /BeginTransaction returns a transactionId; pass that transactionId into each POST /Execute call and finish with POST /CommitTransaction or POST /RollbackTransaction. Transactions time out after a few minutes of inactivity.

### What are the rate limits for the RDS Data API?

The Data API enforces per-account, per-region quotas on simultaneous connections and result-set size (around 1 MB). Throttled requests return BadRequestException or 429 with a throttling message; back off and retry, and use BatchExecute to reduce per-row request volume.

### How do I run a parameterized query through Jentic?

Search Jentic for 'execute sql against aurora serverless', load Execute, and execute it with resourceArn, secretArn, database, sql containing named placeholders, and parameters. Install with pip install jentic; AWS credentials come from your Jentic One instance.

### Can I limit what my agent is allowed to do with the AWS RDS Data API?

Yes. Because Jentic One is self-hosted, you decide which of the six operations your agent may call, so you can grant only Execute and BatchExecute for statement execution and withhold everything else. Transaction-control operations such as BeginTransaction, CommitTransaction, and RollbackTransaction are available to the agent only when you choose to include them. The cluster ARN, secret ARN, and SQL all travel in the request body under rules you set, keeping the agent scoped to the exact access it needs.