Yeah, this seems great if you want to completely eliminate the middle tier and have a client application talk directly w/ the database. I'm curious why there's an entire query API via query string parameters. Why not just expose a single POST /query endpoint where you can send some SQL?
Squeezing the middle tier as flat as possible is my actual strategy and goal in many distributed environments. That's totally feasible with modern tools.
But sending SQL from the client is dangerous, and in this forum you'll get some interesting looks suggesting that.