# Reading a deployed application's data

> Evaluates one read-only Osy# expression against an application on Osyrin Cloud and prints what it answered — the remote twin of `osy query`. The expression is checked before it runs, so anything that writes is refused, and it is read under the application's own security rules, as anonymous or as the login you name.

<!-- id: zones-reading-an-applications-data · area: zones · stability: preview · html: https://osysharp.com/reference/zones/reading-an-applications-data/ -->

## Summary        {#summary}
`osy query` reads the app on your computer. `osyrin app query` reads the deployed one.

```console
$ osyrin app query "Job.Where(j => !j.Done).Count()" --app billing-acme
2

$ osyrin app query "Job.OrderBy(j => j.Position)" --app billing-acme --as ada@example.com
[
  { "Title": "re-plaster the hall", "Position": 10 }
]
```

## Signature      {#signature}
```console
osyrin app query "<expression>" --app <slug>                      // read as ANONYMOUS
osyrin app query "<expression>" --app <slug> --as ada@example.com // read as one of the app's users
osyrin app query "<expression>" --app <slug> --json               // the whole answer, for a script
```

## Description    {#description}

### The same verb as `osy query`   {#same-verb}
The expression goes through the same compiler your source goes through, and the answer has the same shapes: rows, a
number, a list of values, one row. See [Reading your data](https://osysharp.com/reference/local/reading-your-data/) for what an expression may say and what each shape
looks like.

### Who may run it   {#who}
Whoever may deploy the application may query it: a platform operator, an owner or admin of its organization, or a member
of the application. The platform's Admin checks that, then signs a short-lived grant for this one operation, and the
command sends the grant to the zone that serves the application. Your sign-in never goes to the zone.

### What it can read   {#what}
⛔ **It reads, it never writes.** An expression that creates, updates or deletes is refused before it runs:

```console
$ osyrin app query "new Job { Title = \"sneaky\" }" --app billing-acme
✗ `query` READS — this expression writes data, so it is refused here. …
```

The read runs under the application's own `security { }`. With no `--as` it reads what a signed-out visitor sees, often
nothing. With `--as <login>` it reads what that user sees, and no more. `--as` takes no password, because the expression
has been checked as a read. Changing a user's data stays behind their own password, with `osyrin app run`.

### A zone on an older release   {#older-release}
A zone running platform release 0.17.0 or older does not accept a query grant. The command then says which release the
zone needs and that your sign-in is fine. Until the zone is upgraded, restore a backup into a copy (`osyrin app restore`)
and read its rows with `osyrin app restore-download`.

## See also       {#see-also}
- [Reading your data](https://osysharp.com/reference/local/reading-your-data/) — the same verb on your computer, and what an expression may say
- [Running a function](https://osysharp.com/reference/local/running-a-function/) — making the app do something
- [Downloading your daily backups](https://osysharp.com/reference/zones/downloading-your-daily-backups/) — a copy of the whole database
- [The security model](https://osysharp.com/reference/security/index/) — the rules `--as` shows you