Comment by saxenaabhi

Why wouldn't you use stored procedures for it? For internal teams why is it better to have a API?

I can see usecases in which API could make sense, but it doesn't matter in most cases.

SQL already has authorization/authentication built in. For rate limiting you can use something like planetscale's traffic control.