I got dumped with fixing some bugs in a project written by a contractor who had literally done this but with extra steps.

Backend was sql server and c#/asp.

There was an api endpoint that took json, used xslt to transform to xml. Then called the stored procedure specified in request passing the xml as a parameter.

The stored procedure then queried the xml for parameters, executed the query, and returned results as xml.

Another xslt transformed that to json and returned to the client.

It was impressive how little c# there was.

Despite holding all the business logic, the sql was not in source control.