--- title: Supabase API Integration on Truto slug: supabase category: Application Development canonical: "https://truto.one/integrations/detail/supabase/" --- # Supabase API Integration on Truto **Category:** Application Development **Status:** Generally available ## Unified APIs ### Unified User Directory API - **Organizations** — Organizations are the top level entity in the source application. Users are associated with an organization. - **Roles** — The Role object represents a role of a User. - **Users** — The User object represents a User. ## MCP-ready AI tools Truto exposes 169 tools for Supabase that AI agents can call directly. - **list_all_supabase_organization** — List all Supabase organizations that you currently belong to. Returns: id, slug, name. - **get_single_supabase_organization_by_id** — Get information about a specific Supabase organization by id (organization slug). Returns: id, name, plan, opt_in_tags, allowed_release_channels, slug. Required: id. - **list_all_supabase_organization_members** — List members of a Supabase organization. Returns: user_id, user_name, email, role_name, mfa_enabled, avatar_url. Required: organization_id. - **list_all_supabase_me** — Get the authenticated Supabase user's profile from the Management API. Returns: gotrue_id, primary_email, username. - **supabase_action_status_bulk_update** — Update the status of an action run. Returns: message. Required: ref, run_id. - **supabase_api_keys_legacies_bulk_update** — Enable or disable JWT-based legacy (anon, service_role) API keys for a Supabase project. Returns the keys array containing each legacy API key's id, algorithm, status, public_jwk, created_at, and updated_at. Required: ref, enabled. Deprecated — may return 404 in the future. - **list_all_supabase_api_keys_legacies** — Check whether JWT-based legacy (anon, service_role) API keys are enabled for a Supabase project. Returns the keys array containing each legacy API key's id, algorithm, status, public_jwk, created_at, and updated_at. Required: ref. Deprecated — may return 404 in the future. - **list_all_supabase_authorize_project_claims** — Initiate the Supabase OAuth authorization flow to claim ownership of a specified project. Returns an empty 204 response on success. Required: project_ref, client_id, response_type, redirect_uri. - **list_all_supabase_branche_diffs** — Get the schema diff for a Supabase database branch. Returns the diff output as a plain text string containing SQL statements representing schema differences between the branch and its parent. Required: branch_id_or_ref. This is a Beta endpoint. - **create_a_supabase_branche_merge** — Merge a Supabase database branch identified by branch_id_or_ref into its parent branch. Returns: workflow_run_id, message. Required: branch_id_or_ref. - **create_a_supabase_branche_push** — Pushes a database branch. Returns: workflow_run_id, message. Required: branch_id_or_ref. - **supabase_branches_bulk_delete** — Delete a Supabase database branch by branch_id_or_ref. By default, deletes immediately; set force to false to schedule deletion with a 1-hour grace period when soft deletion is enabled. Returns: message. Required: branch_id_or_ref. - **supabase_branches_bulk_update** — Update the configuration of a Supabase database branch by branch_id_or_ref. Returns: id, name, project_ref, parent_project_ref, is_default, git_branch, pr_number, latest_check_run_id, persistent, status, created_at, updated_at, review_requested_at, with_data, notify_url, deletion_scheduled_at, preview_project_status. Required: branch_id_or_ref, requestedConfig. - **list_all_supabase_branches** — Get the configuration of a Supabase database branch by branch_id_or_ref. Returns: ref, postgres_version, postgres_engine, release_channel, status, db_host, db_port, db_user, db_pass, jwt_secret, id, name, project_ref, parent_project_ref, is_default, git_branch, pr_number, latest_check_run_id, persistent, created_at, updated_at, review_requested_at, with_data, notify_url, deletion_scheduled_at,… - **supabase_branches_reset** — Reset a Supabase database branch by branch_id_or_ref, optionally targeting a specific branch name or rollback point. Returns: workflow_run_id, message. Required: branch_id_or_ref. - **supabase_branches_restore** — Restore a scheduled deletion of a Supabase database branch by branch_id_or_ref, cancelling the scheduled deletion and restoring the branch to active state. Returns: message. Required: branch_id_or_ref. - **create_a_supabase_custom_hostname_activate** — Activate a custom hostname for a Supabase project (beta endpoint). Returns: status, custom_hostname, data, custom_domain. Required: ref. - **create_a_supabase_custom_hostname_initialize** — Initialize a custom hostname configuration for a Supabase project. Returns: status, custom_hostname, data. Required: ref, custom_hostname. Beta endpoint. - **create_a_supabase_custom_hostname_reverify** — Reverify the DNS configuration for a Supabase project's custom hostname, returning the updated configuration status and verification data. Returns: status, custom_hostname, data, custom_domain. Required: ref. - **create_a_supabase_network_bans_retrieve** — Retrieve a Supabase project's network bans by project ref. Returns: banned_ipv4_addresses. Required: ref. This is a beta endpoint. - **list_all_supabase_oauth_authorizes** — Initiate a Supabase OAuth authorization flow for a user. Returns an empty 204 response on success — the authorization code or token is delivered to the redirect URI as part of the OAuth redirect. Required: client_id, response_type, redirect_uri. Beta endpoint. - **create_a_supabase_oauth_revoke** — Revoke a Supabase OAuth app authorization and its corresponding tokens (beta). Returns an empty 204 response on success. Required: email, token. - **create_a_supabase_oauth_token** — Exchange an authorization code, refresh token, or JWT bearer assertion for a Supabase user's access and refresh token. Returns: access_token, refresh_token, expires_in, token_type. The jwt-bearer grant type (IDJAG) is in beta and available on Team and Enterprise plans only. - **create_a_supabase_organization** — Create an organization. Returns: id, slug, name. Required: name. - **list_all_supabase_profiles** — Get the current user's Supabase Management API profile. Returns: gotrue_id, primary_email, username. - **get_single_supabase_project_action_by_id** — Get the status of a Supabase action run by id. Returns: id, branch_id, run_steps, git_config, workdir, check_run_id, created_at, updated_at, run_id, status. Required: ref, id. - **list_all_supabase_project_actions** — List all Supabase action runs for a project. Returns: id, branch_id, run_steps, git_config, workdir, check_run_id, created_at, updated_at. Required: ref. - **supabase_project_actions_list_logs** — Get the logs of a Supabase action run as plain text. Returns the log output as a plain-text string. Required: ref, run_id. - **create_a_supabase_project_api_key** — Creates a new API key for the project. Returns: api_key, id, type, prefix, name, description, hash, secret_jwt_template. Required: ref, type, name. - **delete_a_supabase_project_api_key_by_id** — Delete a Supabase project API key. Returns the deleted API key object including id, api_key, type, prefix, name, description, hash, secret_jwt_template, inserted_at, and updated_at. Required: ref, id. The id must be a UUID-formatted string and ref must be exactly 20 lowercase letters. - **get_single_supabase_project_api_key_by_id** — Get a specific Supabase project API key by its id. Returns: api_key, id, type, prefix, name, description, hash, secret_jwt_template, inserted_at, updated_at. Pass reveal=true to include the full api_key value. Required: ref, id. - **list_all_supabase_project_api_keys** — List all API keys for a Supabase project. Returns: api_key, id, type, prefix, name, description, hash, secret_jwt_template, inserted_at, updated_at. Required: ref. Set reveal to a truthy value to include full key values in the response. - **update_a_supabase_project_api_key_by_id** — Update a Supabase project API key's name, description, or secret JWT template by id. Returns: api_key, id, type, prefix, name, description, hash, secret_jwt_template, inserted_at, updated_at. Required: ref, id. - **supabase_project_branches_bulk_delete** — Disable preview branching for a Supabase project. Returns an empty 200 response on success. Required: ref. - **create_a_supabase_project_branch** — Create a database branch from a Supabase project. Returns the created branch object including id, name, project_ref, parent_project_ref, is_default, git_branch, persistent, status, created_at, updated_at, review_requested_at, with_data, notify_url, deletion_scheduled_at, and preview_project_status. Required: ref, branch_name. - **list_all_supabase_project_branches** — List all database branches of a Supabase project. Returns each branch with id, name, project_ref, parent_project_ref, is_default, git_branch, persistent, status, created_at, updated_at, review_requested_at, with_data, notify_url, deletion_scheduled_at, and preview_project_status. Required: ref. - **list_all_supabase_project_branches_projects** — Get a Supabase database branch by project ref and branch name. Returns: id, name, project_ref, parent_project_ref, is_default, git_branch, pr_number, latest_check_run_id, persistent, status, created_at, updated_at, review_requested_at, with_data, notify_url, deletion_scheduled_at, preview_project_status. Required: ref, name. - **supabase_project_custom_hostnames_bulk_delete** — Delete a Supabase project's custom hostname configuration. Returns an empty 200 response on success. Required: ref. - **list_all_supabase_project_custom_hostnames** — Get a Supabase project's custom hostname configuration. Returns: status, custom_hostname, data, custom_domain. Required: ref. - **supabase_project_jit_acceses_bulk_update** — Update a Supabase project's temporary (JIT) access configuration by setting the desired state. Returns: state, appliedSuccessfully, unavailableReason. Required: ref, state. - **list_all_supabase_project_jit_acceses** — Get a Supabase project's temporary (JIT) access configuration. Returns: state, appliedSuccessfully, unavailableReason. Required: ref. - **supabase_project_network_bans_bulk_delete** — Remove network bans from a Supabase project by specifying the banned IPv4 addresses to unban. Returns an empty 200 response on success. Required: ref, banned_ipv4_addresses. - **supabase_projects_bulk_delete** — Deletes the given project. Returns: id, ref, name. Required: ref. - **supabase_projects_bulk_update** — Update a Supabase project by its ref. Returns the updated project object including ref, name, cloud_provider, region, is_branch, status, and inserted_at. Required: ref, name. The ref must be exactly 20 lowercase letters. - **create_a_supabase_project** — Create a new Supabase project in a specified organization. Returns: id, ref, organization_id, organization_slug, name, region, created_at, status. Required: organization_slug, name, db_pass. The organization_id, plan, region, and kps_enabled fields are deprecated. - **supabase_projects_get_restore** — List available restore versions for a Supabase project. Returns the available restore versions for the project. Required: ref (the project reference string, exactly 20 lowercase letters). - **list_all_supabase_projects** — List all Supabase projects you've previously created. Returns each project's id, ref, name, region, status, organization_id, and database configuration details. - **supabase_projects_pause** — Pause a Supabase project by its project ref. Returns an empty response on success. Required: ref. - **supabase_projects_restore** — Restore a paused Supabase project by its project ref. Returns an empty response on success. Required: ref. - **list_all_supabase_projects_available_regions** — List available Supabase regions that can be used when creating a new project, optionally filtered by continent and desired instance size. Returns the RegionsInfo object containing available regions for project creation. Required: organization_slug. This endpoint is in beta. - **list_all_supabase_projects_v_1** — Get a specific Supabase project by its project ref. Returns: id, ref, organization_id, organization_slug, name, region, created_at, status, database, cloud_provider, is_branch, inserted_at, databases. Required: ref. - **create_a_supabase_retrieve_enriched** — Retrieve a Supabase project's enriched network bans with additional information about which databases they affect. Returns: banned_ipv4_addresses. Required: ref. This endpoint is in Beta. - **get_single_supabase_snippet_by_id** — Get a specific SQL snippet in Supabase by id. Returns: id, inserted_at, updated_at, type, visibility, name, description, project, owner, updated_by, favorite, content. Required: id. - **list_all_supabase_snippets** — List SQL snippets for the logged in user in Supabase. Returns each snippet's id, name, inserted_at. Filter by project_ref and sort by name or inserted_at. - **list_all_supabase_advisors_performances** — Gets project performance advisors. Returns: lints. Required: ref. - **list_all_supabase_advisors_securities** — List security advisors for a Supabase project. Returns a lints array where each item includes name, title, level, facing, categories, description, detail, remediation, metadata, and cache_key. Required: ref. This is an experimental, deprecated endpoint subject to change or removal. - **create_a_supabase_auth_signing_key** — Create a new JWT signing key for a Supabase project in standby status. Returns: id, algorithm, status, public_jwk, created_at, updated_at. Required: ref, algorithm. - **delete_a_supabase_auth_signing_key_by_id** — Remove a signing key from a Supabase project. Only possible if the key has been in revoked status for a while. Returns: id, algorithm, status, public_jwk, created_at, updated_at. Required: ref, id. - **get_single_supabase_auth_signing_key_by_id** — Get information about a specific signing key in a Supabase project. Returns: id, algorithm, status, public_jwk, created_at, updated_at. Required: ref, id. - **list_all_supabase_auth_signing_keys** — List all signing keys for a Supabase project. Returns: keys. Required: ref. - **update_a_supabase_auth_signing_key_by_id** — Update a signing key's status in a Supabase project. Returns: id, algorithm, status, public_jwk, created_at, updated_at. Required: ref, id, status. - **supabase_auth_third_party_auths_bulk_delete** — Remove a Supabase third-party auth integration by tpa_id. Returns the deleted integration object including id, type, oidc_issuer_url, jwks_url, inserted_at, updated_at. Required: ref, tpa_id. - **create_a_supabase_auth_third_party_auth** — Create a new Supabase third-party auth integration for a project. Returns the created integration object including id, type, oidc_issuer_url, jwks_url, custom_jwks, resolved_jwks, inserted_at, updated_at, resolved_at. Required: ref. - **get_single_supabase_auth_third_party_auth_by_id** — Get a single Supabase third-party auth integration by id. Returns the integration object including id, type, oidc_issuer_url, jwks_url, custom_jwks, resolved_jwks, inserted_at, updated_at, resolved_at. Required: ref, id. - **list_all_supabase_auth_third_party_auths** — List all Supabase third-party auth integrations for a project. Returns: id, type, oidc_issuer_url, jwks_url, custom_jwks, resolved_jwks, inserted_at, updated_at, resolved_at. Required: ref. - **supabase_billing_addons_bulk_delete** — Remove a billing addon or revert compute instance sizing for a Supabase project by disabling the selected addon variant, including rolling the compute instance back to its previous size. Returns an empty 200 response on success. Required: ref, addon_variant. - **supabase_billing_addons_bulk_update** — Apply or update billing addons for a Supabase project, such as scaling the compute instance up or down. Returns an empty 200 response on success. Required: ref, addon_variant, addon_type. - **list_all_supabase_billing_addons** — List billing addons and compute instance selections for a Supabase project. Returns: selected_addons, available_addons. Required: ref. - **supabase_config_auths_bulk_update** — Update a Supabase project's auth (GoTrue) configuration by submitting a requestedConfig object with the fields to change. Returns the updated full auth config including site_url, disable_signup, external OAuth provider settings, SMTP/mailer settings, SMS provider settings, MFA options, hooks, rate limits, SAML, and security settings. Required: ref. - **list_all_supabase_config_auths** — Get a Supabase project's auth (GoTrue) configuration. Returns the full auth config including site_url, disable_signup, external OAuth provider settings (GitHub, Google, Apple, etc.), SMTP/mailer settings, SMS provider settings, MFA options, hooks, rate limits, SAML, and security settings. Required: ref. - **supabase_endpoints_logs_all** — Query Supabase project logs by executing a SQL query on the project's logs (deprecated). Returns: result, error. Required: ref. If iso_timestamp_start and iso_timestamp_end are both omitted, only the last 1 minute of logs is queried; the timestamp range must not exceed 24 hours. Unless the sql parameter is provided, only edge_logs are queried. - **list_all_supabase_endpoints_logs** — Query Supabase project logs by executing a ClickHouse SQL query on the project's unified logs stream. Returns: result, error. Required: ref. If iso_timestamp_start and iso_timestamp_end are both omitted, only the last 1 minute of logs is queried; the timestamp range must not exceed 24 hours. Filter by the source column to specify log sources such as edge_logs, postgres_logs, etc. - **create_a_supabase_network_restrictions_apply** — Apply network restrictions to a Supabase project, specifying allowed IPv4 and IPv6 CIDR blocks for database access. Returns: entitlement, config, old_config, status, updated_at, applied_at. Required: ref. Beta endpoint. - **supabase_project_claim_tokens_bulk_delete** — Revoke a Supabase project claim token, invalidating it for future OAuth project-claim authorization flows. Returns an empty 204 response on success. Required: ref. - **create_a_supabase_project_claim_token** — Create a claim token for a Supabase project, enabling ownership transfer through the project-claim OAuth flow. Returns the project claim token response. Required: ref. - **list_all_supabase_project_claim_tokens** — Get the claim token for a Supabase project. Returns the project claim token response. Required: ref. - **list_all_supabase_project_healths** — Get a Supabase project's service health status for one or more specified services. Returns an array of health records with name, healthy, status, info, and error for each requested service. Required: ref, services. - **supabase_project_network_restrictions_bulk_update** — Bulk update a Supabase project's network restrictions by adding or removing IPv4 and IPv6 CIDRs. Returns: entitlement, config, old_config, updated_at, applied_at, status. Required: ref. Alpha endpoint. - **list_all_supabase_project_network_restrictions** — Get a Supabase project's network restrictions configuration. Returns: entitlement, config, old_config, status, updated_at, applied_at. Required: ref. This is a Beta endpoint. - **supabase_project_pgsodiums_bulk_update** — Update a Supabase project's pgsodium encryption configuration. Returns: root_key. Required: ref, root_key. Updating the root_key can cause all data encrypted with the older key to become inaccessible. This is a Beta endpoint. - **list_all_supabase_project_pgsodiums** — Get a Supabase project's pgsodium encryption configuration (beta endpoint). Returns the project's root_key, the master encryption key used by pgsodium for column-level encryption. Required: ref. - **supabase_project_postgrests_bulk_update** — Update a Supabase project's PostgREST configuration including database schema, max rows, pool settings, and search path. Returns: db_schema, max_rows, db_extra_search_path, db_pool, db_pool_acquisition_timeout. Required: ref. - **list_all_supabase_project_postgrests** — Get the PostgREST configuration for a Supabase project. Returns: db_schema, max_rows, db_extra_search_path, db_pool, db_pool_acquisition_timeout, jwt_secret. Required: ref (20-character lowercase project reference). - **list_all_supabase_project_readonlies** — Get a Supabase project's readonly mode status. Returns: enabled, override_enabled, override_active_until. Required: ref. - **create_a_supabase_project_restart** — Restart a Supabase project by its project reference. Returns an empty 200 response on success. Required: ref. - **supabase_project_secrets_bulk_delete** — Bulk delete secrets from a Supabase project by supplying the names of the secrets to remove. Returns an empty response on success. Required: ref and a request body containing the names of the secrets to delete. - **create_a_supabase_project_secret** — Bulk create multiple secrets and add them to the specified Supabase project. Returns an empty 201 response on success. Required: ref, and an array of secret objects each with name and value. - **list_all_supabase_project_secrets** — List all secrets previously added to a Supabase project. Returns an array of secret objects including name, value, and updated_at. Required: ref. - **supabase_project_ssl_enforcements_bulk_update** — Update the SSL enforcement configuration for a Supabase project. Returns: currentConfig, appliedSuccessfully. Required: ref, requestedConfig. - **list_all_supabase_project_ssl_enforcements** — Get a Supabase project's SSL enforcement configuration. Returns: currentConfig (with the database SSL enforcement flag), appliedSuccessfully. Required: ref. This endpoint is in beta. - **create_a_supabase_project_upgrade** — [Beta] Upgrades the project's Postgres version. Returns: tracking_id. Required: ref, target_version. - **supabase_project_vanity_subdomains_bulk_delete** — Delete a Supabase project's vanity subdomain configuration. Returns an empty 200 response on success. Required: ref. - **list_all_supabase_project_vanity_subdomains** — Get the current vanity subdomain configuration for a Supabase project. Returns: status, custom_domain. Required: ref. - **create_a_supabase_read_replicas_remove** — Remove a read replica from a Supabase project. Returns an empty 204 response on success. Required: ref. This is a Beta endpoint. - **create_a_supabase_read_replicas_setup** — Set up a read replica for a Supabase project. Returns an empty 204 response on success. Required: ref (project ref) and a JSON request body containing read_replica_region. Beta feature available only on Pro, Team, or Enterprise plans. - **create_a_supabase_readonly_temporary_disable** — Temporarily disable a Supabase project's readonly mode for the next 15 minutes. Returns an empty 201 response on success. Required: ref. - **create_a_supabase_restore_cancel** — Cancel an in-progress Supabase project restoration. Returns an empty 200 response on success. Required: ref. - **create_a_supabase_signing_keys_legacy** — Set up a Supabase project's existing JWT secret as an in_use JWT signing key. Returns the signing key object including id, algorithm, status, public_jwk, created_at, and updated_at. Required: ref. This endpoint is deprecated and may be removed in the future; check for HTTP 404. - **list_all_supabase_signing_keys_legacies** — Get the signing key information for the JWT secret imported as a signing key for a Supabase project. Returns the signing key object including id, algorithm, status, public_jwk, created_at, and updated_at. Required: ref. This endpoint is deprecated and may be removed in the future; check for HTTP 404. - **list_all_supabase_types_typescripts** — Generate TypeScript types for a Supabase project database schema for use with supabase-js. Returns: types. Required: ref. The included_schemas query parameter defaults to the public schema and accepts a comma-separated list (e.g. public,auth). - **list_all_supabase_upgrade_status** — Get the latest status of a Supabase project's Postgres upgrade. Returns: a databaseUpgradeStatus object containing initiated_at, latest_status_at, target_version, error, progress, and status. Required: ref. - **create_a_supabase_vanity_subdomain_activate** — Activate a vanity subdomain for a Supabase project. Returns: custom_domain. Required: ref, vanity_subdomain. Beta feature available on Pro, Team, or Enterprise plans only. - **create_a_supabase_vanity_subdomain_check_availability** — Check whether a vanity subdomain is available for a Supabase project. Returns: available. Required: ref, vanity_subdomain. Available on Pro, Team, and Enterprise plans only. - **supabase_cli_login_roles_bulk_delete** — Delete existing CLI login roles for a Supabase project. Returns: message. Required: ref. - **create_a_supabase_cli_login_role** — Create a CLI login role for a Supabase project with a temporary password. Returns: role, password, ttl_seconds. Required: ref, role, rhost. - **create_a_supabase_config_disk** — Modify the database disk configuration for a Supabase project. Returns an empty 201 response on success. Required: ref, requestedConfig. - **list_all_supabase_config_disks** — Get database disk attributes for a Supabase project. Returns: attributes, last_modified_at. Required: ref. - **supabase_config_realtimes_bulk_update** — Update the realtime configuration for a Supabase project, including connection limits, event rate limits, and feature toggles. Returns an empty 204 response on success. Required: ref. - **list_all_supabase_config_realtimes** — Get a Supabase project's realtime configuration including private_only, connection_pool, max_concurrent_users, max_events_per_second, max_bytes_per_second, max_channels_per_client, max_joins_per_second, max_presence_events_per_second, max_payload_size_in_kb, suspend, and presence_enabled. Required: ref. - **supabase_config_storages_bulk_update** — Update a Supabase project's storage configuration with new file size limit, features, or external settings. Returns an empty 200 response on success. Required: ref. - **list_all_supabase_config_storages** — Get a Supabase project's storage configuration. Returns: features, capabilities, external. Required: ref. - **list_all_supabase_database_contexts** — List database metadata for a Supabase project. Returns: databases. Required: ref. This endpoint is experimental and deprecated. - **supabase_database_jits_bulk_delete** — Delete JIT access mappings for a specific user in a Supabase project database, revoking all JIT database access. Returns an empty 200 response on success. Required: ref, user_id. - **supabase_database_jits_bulk_update** — Update JIT access user-id to role mappings for a Supabase project database, modifying the roles that can be assumed and for how long. Returns: user_id, user_roles. Required: ref, user_id, roles. - **create_a_supabase_database_jit** — Authorize JIT database access for a user in a Supabase project, authorizing the request to assume a role in the project database. Returns: user_id, user_role. Required: ref, role, rhost. - **list_all_supabase_database_jits** — List JIT access user-id to role mappings for a Supabase project database, showing the roles a user can assume. Returns: user_id, user_roles. Required: ref. - **supabase_database_migrations_bulk_delete** — Rollback database migrations in a Supabase project and remove them from the migration history table. Returns an empty 200 response on success. Required: ref, gte. - **supabase_database_migrations_bulk_update** — Upsert a database migration entry in a Supabase project without applying it to the database. Returns an empty 200 response on success. Required: ref, query. - **create_a_supabase_database_migration** — Apply a database migration to a Supabase project by executing the provided SQL query. Returns an empty 200 response on success. Required: ref, query. - **list_all_supabase_database_migrations** — List applied database migration versions for a Supabase project. Returns: version, name. Required: ref. - **update_a_supabase_database_migration_by_id** — Patch an existing entry in a Supabase project's migration history by updating its name and rollback SQL. Returns an empty 200 response on success. Required: ref, version. - **list_all_supabase_database_migrations_database** — Fetch an existing entry from Supabase migration history by project ref and migration version. Returns: version, name, statements, rollback, created_by, idempotency_key. Required: ref, version. - **list_all_supabase_database_openapis** — Get the PostgREST OpenAPI specification for a Supabase project, which describes the auto-generated REST API for the database. Returns an OpenAPI spec document including the openapi version, info metadata, and paths describing the available database endpoints. Required: ref. This is the replacement for querying /rest/v1/ directly with the anon key. - **supabase_database_passwords_bulk_update** — Update the database password for a Supabase project. Returns an empty 200 response on success. Required: ref, password. - **list_all_supabase_database_pgbouncers** — Get a Supabase project's PgBouncer connection pooler configuration. Returns: default_pool_size, ignore_startup_parameters, max_client_conn, pool_mode, connection_string, server_idle_timeout, server_lifetime, query_wait_timeout, reserve_pool_size. Required: ref. - **supabase_database_poolers_bulk_update** — Updates project's supavisor config. Returns: default_pool_size, pool_mode. Required: ref. - **list_all_supabase_database_poolers** — List Supabase database pooler (Supavisor) configurations for a project. Returns: identifier, database_type, is_using_scram_auth, db_user, db_host, db_port, db_name, connection_string, connectionString, default_pool_size, max_client_conn, pool_mode. Required: ref. - **supabase_database_postgres_bulk_update** — Update a Supabase project's Postgres database configuration. Returns the updated config including max_connections, shared_buffers, work_mem, statement_timeout, checkpoint_timeout, and other Postgres runtime parameters. Required: ref. - **list_all_supabase_database_postgres** — Get a Supabase project's Postgres database configuration. Returns: effective_cache_size, logical_decoding_work_mem, cron.log_statement, log_autovacuum_min_duration, log_checkpoints, log_connections, log_disconnections, log_duration, log_lock_waits, log_recovery_conflict_waits, log_replication_commands, log_startup_progress_interval, log_temp_files, maintenance_work_mem, track_activity_query_size,… - **create_a_supabase_database_query** — Run a SQL query against a Supabase project's database. Beta endpoint. Returns query results whose shape depends on the SQL statement executed and is not formally defined in the API spec. Required: ref (the 20-character lowercase project reference). A JSON request body is also required. - **list_all_supabase_disk_autoscales** — Get the disk autoscale configuration for a Supabase project. Returns: growth_percent, min_increment_gb, max_size_gb. Required: ref. - **list_all_supabase_disk_utils** — Get disk utilization metrics for a Supabase project. Returns: timestamp, metrics. Required: ref. - **list_all_supabase_endpoints_functions_combined_stats** — Get a Supabase project's function combined statistics for a specific edge function, bucketed by time interval. Returns: result, error. Required: ref, interval, function_id. - **list_all_supabase_endpoints_metrics** — Scrape a Supabase project's metrics in Prometheus text exposition format. Returns the metrics as a Prometheus/OpenMetrics text string containing project resource and usage data. Required: ref. - **list_all_supabase_endpoints_usage_api_counts** — Get a Supabase project's usage API counts by project ref, optionally filtered by time interval. Returns: result, error. Required: ref. - **list_all_supabase_endpoints_usage_api_requests_counts** — Get a Supabase project's API request usage counts. Returns: result, error. Required: ref (20-character lowercase project reference). - **list_all_supabase_function_bodies** — Retrieve the source body of a Supabase Edge Function by its slug and project ref. Returns the function body as a streamable binary file containing the edge function's source code. Required: ref, function_slug. - **create_a_supabase_functions_deploy** — Deploy an Edge Function to a Supabase project, creating it if it does not already exist. Returns: id, slug, name, status, version, created_at, updated_at, verify_jwt, import_map, entrypoint_path, import_map_path, ezbr_sha256. Required: ref, metadata. - **create_a_supabase_invite_accept** — Accept an invitation for just-in-time (JIT) database access in a Supabase project. Returns: user_id, user_roles. Required: ref, email, token. - **supabase_jit_invites_bulk_delete** — Delete a JIT database access invite for an external user in a Supabase project, revoking and removing the invitation. Returns an empty 200 response on success. Required: ref, invite_id. - **create_a_supabase_jit_invite** — Invite an external user to a Supabase project database for JIT access, setting the initial roles they can assume and for how long. Returns: email, invite_id, user_roles. Required: ref, email, roles. - **list_all_supabase_jit_lists** — List all user-id to role mappings for JIT (just-in-time) database access in a Supabase project. Returns: items. Required: ref. - **supabase_project_functions_bulk_delete** — Delete a Supabase Edge Function by its slug from the specified project. Returns an empty 200 response on success. Required: ref, function_slug. - **supabase_project_functions_bulk_update** — Bulk update Supabase Edge Functions for a project, creating new or replacing existing idempotently. Returns: functions. Required: ref. The version must be manually bumped. - **create_a_supabase_project_function** — Create a Supabase Edge Function in the specified project. Deprecated—use the deploy endpoint instead. Returns: id, slug, name, status, version, created_at, updated_at, verify_jwt, import_map, entrypoint_path, import_map_path, ezbr_sha256. Required: ref. - **list_all_supabase_project_functions** — List all Supabase Edge Functions added to a project. Returns each function's id, slug, name, status, version, created_at, updated_at, verify_jwt, import_map, entrypoint_path, import_map_path, ezbr_sha256. Required: ref. - **update_a_supabase_project_function_by_id** — Update a Supabase Edge Function by id. Returns: id, slug, name, status, version, created_at, updated_at, verify_jwt, import_map, entrypoint_path, import_map_path, ezbr_sha256. Required: ref, id. - **list_all_supabase_project_functions_projects** — Retrieve a Supabase Edge Function by its slug within a project. Returns the function object including id, slug, name, status, version, verify_jwt, created_at, and updated_at. Required: ref, function_slug. - **create_a_supabase_query_read_only** — Run a read-only SQL query in a Supabase project as the supabase_read_only_user role. All entity references must be schema qualified. Returns an empty 201 response on success. Required: ref. A JSON request body is required. - **create_a_supabase_realtime_shutdown** — Shutdown all realtime connections for a Supabase project. Returns an empty 204 response on success. Required: ref (the project ref, a 20-character lowercase string). - **list_all_supabase_sso_providers** — List all SSO providers for a Supabase project. Returns: items. Required: ref. - **supabase_sso_providers_bulk_delete** — Delete a Supabase SSO provider by its UUID. Returns: id, saml, domains, created_at, updated_at. Required: ref, provider_id. - **supabase_sso_providers_bulk_update** — Update a Supabase SSO provider by its UUID. Returns: id, saml, domains, created_at, updated_at. Required: ref, provider_id. - **create_a_supabase_sso_provider** — Create a new SSO provider in a Supabase project. Returns: id, saml, domains, created_at, updated_at. Required: ref, type. SAML 2.0 must be enabled for the project. - **get_single_supabase_sso_provider_by_id** — Get a single SSO provider by its UUID in a Supabase project. Returns: id, saml, domains, created_at, updated_at. Required: ref, id. - **list_all_supabase_storage_buckets** — List all storage buckets in a Supabase project. Returns: id, name, owner, created_at, updated_at, public. Required: ref. - **create_a_supabase_webhooks_enable** — Enable Database Webhooks on a Supabase project. Returns an empty 201 response on success. Required: ref (the project reference, a 20-character lowercase string). This is a Beta endpoint. - **create_a_supabase_backups_restore_pitr** — Restore a PITR (point-in-time recovery) backup for a Supabase project database. Returns an empty 201 response on success. Required: ref, recovery_time_target_unix. - **create_a_supabase_backups_restore_point** — Create a database restore point for a Supabase project. Returns: name, status, completed_on. Required: ref. - **list_all_supabase_backups_restore_points** — List database restore points for a Supabase project. Returns: name, status, completed_on. Required: ref. - **create_a_supabase_backups_restore** — Restore a physical backup for a Supabase database. Returns an empty 201 response on success. Required: ref. - **supabase_backups_schedules_bulk_update** — Update the daily backup schedule time for a Supabase project. Sets the time at which the daily backup runs; the change takes effect on the next backup window that includes the new time, and can only be updated 3 times per 24 hours. Returns: schedule_for, updated_at. Required: ref, schedule_for. - **list_all_supabase_backups_schedules** — Get the backup schedule for a Supabase project, including the configured daily backup time and when it was last updated. Returns: schedule_for, updated_at. Required: ref. Only available on the Enterprise plan. - **create_a_supabase_backups_undo** — Initiate an undo to a given restore point for a Supabase project's database backup. Returns an empty 201 response on success. Required: ref. - **list_all_supabase_database_backups** — List all database backups for a Supabase project. Returns the backup configuration including region, walg_enabled, pitr_enabled, a backups array (each with id, is_physical_backup, status, inserted_at), and physical_backup_data. Required: ref. - **list_all_supabase_organization_entitlements** — List entitlements available to a Supabase organization based on their plan and any overrides. Returns: entitlements.key, feature.type, hasAccess, type, and config). Required: slug. - **create_a_supabase_organization_project_claim** — Claim a project for a Supabase organization using a project claim token. Returns an empty 204 response on success. Required: slug, token. - **list_all_supabase_organization_project_claims** — Get project details for a Supabase organization using a project claim token. Returns: project, preview, expires_at, created_at, created_by. Required: slug, token. - **list_all_supabase_organization_projects** — List Supabase projects for a given organization. Returns: projects, pagination. Required: slug. Max 100 per page. ## How it works 1. **Link your customer's Supabase account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach Supabase.** The Proxy API is a 1-to-1 mapping of the Supabase API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Sync user directories into Supabase for seamless RBAC** — An IAM or HR platform can push organizations, roles, and users directly into a customer's Supabase project, ensuring Row Level Security policies recognize the correct tenant and role assignments without manual data entry. - **Automate Supabase project provisioning for end users** — A no-code app builder or AI agent platform can use Supabase's Management API via OAuth to spin up new database instances, run schema migrations, and inject API keys — all on behalf of the end user without touching their Supabase dashboard. - **Pipe product analytics data into customer-owned Supabase databases** — A B2B analytics SaaS can bulk-sync event telemetry into a customer's Supabase tables via the PostgREST Data API, letting the customer join that data with their own tables using native SQL for custom dashboards. - **Enable AI-powered search by writing vector embeddings to Supabase** — An AI tooling company can write and index pgvector embeddings directly into a customer's Supabase project, giving end users a fully owned RAG datastore without standing up separate vector infrastructure. - **Subscribe to real-time database changes to trigger cross-product workflows** — A workflow automation or notification SaaS can listen for row-level mutations in a customer's Supabase tables via Realtime WebSockets, triggering alerts, syncs, or downstream actions the moment data changes. ## What you can build - **Automated user and role provisioning into Supabase** — Push newly created users, role assignments, and organization structures from your product directly into a customer's Supabase public.profiles and user_roles tables so their RLS policies work instantly. - **Organization-aware directory sync via Unified User Directory API** — Map your product's organization, role, and user models to Truto's Unified User Directory API to read and write directory data across Supabase and other connected platforms in a single schema. - **One-click Supabase project setup for new customers** — Use Supabase's OAuth-based Management API to provision a new Postgres database, apply your required schema migrations, and store the resulting connection credentials — all from within your onboarding flow. - **Bi-directional data sync between your SaaS and Supabase tables** — Perform full CRUD operations on any customer-exposed Supabase table via PostgREST, keeping your product's data model and the customer's database continuously in sync. - **Real-time event listener for Supabase row changes** — Subscribe to INSERT, UPDATE, or DELETE events on customer tables through Supabase Realtime to trigger notifications, analytics pipelines, or workflow automations in your product. ## FAQs ### How does authentication work when connecting to a customer's Supabase account? Supabase supports OAuth 2.1 for its Management API, allowing your end users to authorize access to their Supabase Organization securely. For Data API (PostgREST) access, connections typically use the project's service_role or anon API key combined with the project URL. Truto handles storing and managing these credentials on your behalf. ### What Unified APIs does Truto support for Supabase? Truto maps Supabase to the Unified User Directory API, which covers Organizations, Roles, and Users. This lets you read and write directory data in a normalized schema across Supabase and other integrated platforms. ### Are there specific Truto tools available for Supabase today? Supabase tools are built on request. If your use case requires specific operations — such as Management API project provisioning, PostgREST CRUD, or Realtime subscriptions — Truto can build and ship the required tools tailored to your workflow. ### Does Supabase impose rate limits on its APIs? Supabase applies rate limits that vary by plan tier and API surface. The Management API has stricter per-minute limits, while the PostgREST Data API throughput is largely governed by the underlying Postgres connection pool and project plan. Truto handles pagination and request management to work within these constraints. ### Can I write to custom tables in a customer's Supabase project? Yes. Supabase's PostgREST API auto-generates endpoints for any table or view exposed in the public schema. As long as the customer has granted appropriate API key access, you can perform CRUD operations on custom tables, including those with custom columns and relationships. ### How does Truto handle Supabase's Row Level Security when writing data? RLS policies are enforced at the Postgres level. When using the anon key, all requests are subject to RLS. When using the service_role key, RLS is bypassed. Truto stores whichever key the end user provides during the connection setup, so the security posture is determined by the customer's own configuration. ## Related reading - [Connect Supabase to ChatGPT: Run SQL Queries and Manage Projects](https://truto.one/blog/connect-supabase-to-chatgpt-run-sql-queries-and-manage-projects/) — Learn how to connect Supabase to chatgpt using Truto. Step-by-step guide to tool calling, API quirks, and autonomous workflows. - [Connect Supabase to Claude: Deploy Functions and Control Branches](https://truto.one/blog/connect-supabase-to-claude-deploy-functions-and-control-branches/) — Learn how to connect Supabase to Claude using an MCP server. Automate database branching, Edge Function deployments, and SQL execution with AI agents. - [Connect Supabase to AI Agents: Automate Backups and Infrastructure](https://truto.one/blog/connect-supabase-to-ai-agents-automate-backups-and-infrastructure/) — Learn how to connect Supabase to AI agents using Truto's /tools endpoint. Build autonomous workflows for database branching, SQL queries, and backups.