                     filter = @_query_descend(filter, row, v)
         return filter
 
-    _query_to_filter: (query) =>
+    _query_to_filter: (query, primary_key) =>
         filter = undefined
         for k, v of query
+            if primary_key? and k == primary_key
+                continue
             if v != null
                 if typeof(v) != 'object'
                     v = {'==':v}

                        sub = false
                        break
                if sub
                    selector[k] = @_query_to_field_selector(v)
        return selector

    _query_get: (table, query, account_id) =>
        x = {}
        switch table
            when 'server_settings', 'central_log', 'client_error_log'
                x.require_admin = true
            when 'accounts'
                x.get_all = [account_id]
            when 'stats'
                if query.timestamp != null
                    # TODO
                    x.error = "TODO -- timestamp range query"
            when 'blobs'
                if query.uuid
                    x.get_all = [query.uuid]
                else
                    x.error = "must specify uuid"
            when 'file_use', 'projects', 'file_access_log'
                if query.project_id? and query.project_id != null
                    single = false
                    if typeof(query.project_id) == 'object'
                        for k, v of query.project_id
                            if k == '=='
                                query.project_id = v
                                single = true
                                break
                    if single
                        x.get_all = x.require_project_ids_read_access = [query.project_id]
                    else
                        x.get_all = 'all_projects'
                else
                    x.get_all = 'all_projects'
            else
                x.error = "unknown table '#{table}'"
        return x

    _require_is_admin: (account_id, cb) =>

            options    : required
            cb         : required   # cb(err, result)
        results = undefined
        query = misc.copy(opts.query)
        {require_admin, get_all, require_project_read_access, err} = @_query_get(opts.table, query, opts.account_id)
        if err
            opts.cb(err)
            return
        primary_key = TABLES[opts.table]?.options?.primaryKey
        async.series([
            (cb) =>
                async.parallel([
