You can allow users to write direct SQL queries or use SQL as API if the database server does all of the following:

1. Access control.

Table and column-level access control. Row-level restrictions by expressions.

Out-of-band table filters that the user cannot override in the query.

2. Query complexity restrictions.

Allow queries only using the index. Restrict the maximum number of records to scan. Limit the max query runtime or maximum memory consumption.

Out-of-band limiting on the result size.

3. Rate limiting.

Limit the number of rows or bytes scanned over a period of time for a user, for an IP address or IP subnet.

4. Interfaces and formats.

CORS headers. HTTP compression. TLS. Proxy protocols.

JSON with metadata, Protobuf, etc.

TLDR. It works with ClickHouse; it is doubtful with other DBMS.