Clearly document relationship between execute-sql and facets

Refs GHSA-5fff-xcm9-q6vh

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
This commit is contained in:
Simon Willison 2026-09-03 14:36:46 -07:00
commit 6473a7ecb0
3 changed files with 8 additions and 0 deletions

View file

@ -14,6 +14,8 @@ Here's `an example <https://congress-legislators.datasettes.com/legislators/legi
Facets can be specified in two ways: using query string parameters, or in ``metadata.json`` configuration for the table.
Facet queries are generated by Datasette and summarize rows the actor already has permission to view. They do not require the :ref:`actions_execute_sql` permission. Use the :ref:`setting_allow_facet` setting to control whether users can request facets using query string parameters.
Facets in query strings
-----------------------