My thought on modifying the query from the request would be, indeed, to use the query string. Depending on your requirements I’d use it to limit aspects of the query such as limits, columns to return, filters to apply, ordering and, possibly, depth of retrieval.

In my mind query strings are exactly the place for that kind of output modification.