I want to expose an API where clients can search for objects. I use mongoose to describe the objects and interact with them. I want the search API to be as generic as possible. The user should only be able to read from the collection.

How do I implement an (secure) API where a client can pass a query in JSON?

Can I just pass a user query into the find() method? If not, what do I ahve to consider?

Many thanks in advance!