Skip to main content

MongoDB

DoubleDino supports MongoDB through the /query endpoint.

The query format adds the collection name to a standard MongoDB filter:

collection;filter

For example:

users;{"is_active": true}

The filter portion uses native MongoDB query syntax. DoubleDino passes the filter to MongoDB and transforms the returned documents.

Query​

Find active users:

curl -G "http://localhost:8080/query" \
  --data-urlencode 'q=users;{"is_active": true}' \
  -H "x-api-key: your-api-key"

Example response:

{
  "_id": "84sfg730",
  "email": "[email protected]",
  "is_active": true,
  "profile": {
    "name": "Dkyr"
  }
}

The document structure remains intact while sensitive values are transformed.

For example:

XTD-1234L → JHG-9685K
Alice      → Dkyr

The exact transformed value depends on the configured secret key.

MongoDB filters​

The filter supports standard MongoDB query syntax.

Match a field:

users;{"is_active": true}

Match a nested field:

users;{"profile.country": "AU"}

Multiple conditions:

users;{"is_active": true, "role": "admin"}

MongoDB operators can also be used:

users;{"created_at":{"$gt":"2026-01-01"}}

DoubleDino does not transform the filter before MongoDB executes it.

Filtering with production values​

You can query using a known production identifier.

For example:

users;{"_id":"65abc123"}

MongoDB receives the real _id and uses it to locate the document.

The returned document contains the transformed value:

{
  "_id": "84sfg730",
  "email": "[email protected]"
}

This allows you to investigate a specific production document without receiving its original sensitive values.

Nested documents​

DoubleDino transforms nested MongoDB values recursively, including objects and arrays.

For example:

{
  "customer": {
    "name": "Alice",
    "orders": [
      {
        "id": 123
      }
    ]
  }
}

can become:

{
  "customer": {
    "name": "Dkyr",
    "orders": [
      {
        "id": 847
      }
    ]
  }
}

The surrounding document structure remains intact.

Preserved expressions​

If enabled by your administrator, you can provide additional expressions that should remain unchanged using the x-preserve-expressions header.

curl -G "http://localhost:8080/query" \
  --data-urlencode 'q=users;{"is_active": true}' \
  -H "x-api-key: your-api-key" \
  -H "x-preserve-expressions: tracking metadata"

Dynamic expressions are available only when the administrator has enabled:

DD_ALLOW_DYNAMIC_EXPRESSIONS=true

Only use this when you need additional expressions to remain visible. Developers cannot change expressions configured by the administrator.

Read-only​

DoubleDino Proxy does not modify the MongoDB source.

The filter is executed by MongoDB, and only the returned documents are transformed before they reach the client.