Rich query REST plugin with bundled access control