If you apply a definition query to a referenced feature layer and publish it, the definition query is also applied on the web. So far, so good.
Now the question: Where can I find information about the existence of a definition query and which query it contains?
We cannot find this information in the JSON, the argisserver folder, the arcgisportal folder, the Server/Admin area, the Rest interface, or the Server/Manager area.
There is a MAPX file in the ArcGIS Server Directory that displays the query when opened in ArcGIS Pro. However, if I replace this and change the query, there is no change in the features displayed by the service. So it must be stored somewhere else.
At first glance, it seems that the query can only be changed by overwriting the service, which seems to be a fairly secure way to restrict a layer in the provision of features.
