Supabase Management API

The Supabase Management API is the control plane for Supabase projects and organizations. Workflows create, pause, and restore projects, run SQL and migrations, manage Edge Functions, secrets, and auth settings, and read security and performance advisors.

Verified 150 actions API key available

Supabase Management API website Platform Documentation Capability data verified 2026-08-25

A preview branch is marked ready for release by the team that built it

Diff Branch returns the exact schema change the merge would apply, as SQL

Get Security Advisors and Get Performance Advisors run against the branch project

Create Restore Point marks a named moment on the parent before anything runs

The diff, the advisor findings and the restore point name go to the release owner

The owner reads the SQL and approves the merge, and only then does Merge Branch run

What This Integration Enables

This is the Supabase control plane, not the data plane, and the distinction is the whole page. The Supabase connector reads and writes rows using a project key. This one administers projects using a personal access token, and that token can reach every project in every organization its owner belongs to. It creates and deletes projects, runs SQL, applies and rolls back migrations, deploys Edge Functions, manages API keys and secrets, configures auth including SAML single sign-on, provisions and merges preview branches, changes Storage, Realtime, PostgREST, Postgres and pooler settings, moves custom domains, edits network restrictions, reads logs and metrics, and returns Supabase's own security and performance advisors.

That breadth is the reason to be deliberate about which half an agent runs unattended. Supabase itself drew a useful line: Run Read Only SQL Query executes as a read-only role, so a write fails rather than succeeds, and Diff Branch shows exactly what a merge would apply before it applies anything. FlowRunner agents live on that side by default. They read the state of every project continuously, surface what is drifting, and stop at the operations that change production. Composability, audit trails and the rest of the platform exist to make that stop reliable, which is what the human-in-the-loop design is for.

Without FlowRunner

Console clicks under pressure Pausing, restoring or resizing a project happens by hand in a dashboard during an incident

Advisors read occasionally Security and performance lints get looked at when somebody remembers to look

Deploys without a marker A migration reaches production with no named point to return to if it goes wrong

With FlowRunner

Lifecycle driven by the flow Pause, restore, health checks and disk headroom are read and acted on from the workflow

Advisors read on a schedule Lint findings are pulled continuously and routed to the owner of the schema they concern

Deploys with a way back A restore point is taken and the schema difference is read before a merge is approved

Use Case Scenarios

A standing audit across every project, not just the one someone remembered

On a schedule the agent calls List Organizations and List Projects, then for each project runs Get Security Advisors, List Storage Buckets and List API Keys without revealing values. It is looking for the specific things that go wrong quietly: a bucket marked public, a table exposed through the data API without row level security, an Edge Function whose JWT verification is off, an organization owner without MFA. Findings are grouped by owning team and opened as issues in Linear or GitHub, with a digest in Slack. Nothing is remediated automatically. The audit's job is to make the drift visible.
Disk headroom watched before it becomes an outage

Supabase forces a project whose disk is nearly full into read-only mode, at which point every write fails. The agent polls Get Disk Utilization and Get Readonly Mode across the estate and alerts through PagerDuty well before the threshold. If a project has already flipped, the agent can call Disable Readonly Mode, which lifts the restriction for a short deliberate window so space can be freed, and it presents the options to the on-call engineer rather than choosing between growing the disk and deleting rows on its own. Modify Database Disk is not a call an agent should make alone, because disk size only goes up.
Preview environments that clean themselves up

Every preview branch is a separately billed Supabase project. The agent reconciles List Branches against the open pull requests in GitHub, and for branches whose pull request closed days ago it proposes deletion, listing what each one costs to keep. Where a branch migration failed, Get Action Run Logs is pulled into the pull request comment so the developer sees why rather than only that. Branches that are still open get left alone, including the persistent ones, which Supabase does not clean up on its own.

Human-in-Loop Highlight

Merge Branch is where a preview stops being a preview. It applies the branch's migrations and function deployments to the parent project, which means it runs SQL against the production database, and Supabase is direct about that being a production deploy. It is also the operation where a human gate costs almost nothing and buys almost everything, because the vendor already built the evidence: Diff Branch returns the exact schema difference as SQL, and Create Restore Point marks a named moment the database can be returned to.

So the agent does the whole approach and stops at the door. It runs Diff Branch, takes a restore point on the parent, runs the advisors against the branch, and posts the result: "Merging preview branch checkout-v2 applies three migrations to production. Here is the SQL. One of them drops a column that the security advisor says is still exposed through the data API. Restore point pre-checkout-v2 was created two minutes ago. Merge?" A named engineer approves. The same gate covers Delete Project, which destroys the database, its backups, its storage buckets and its Edge Functions with no undelete in this API, and Upgrade Project, which is one way and takes the database down while it runs. The agent is fast at everything up to those calls. It is deliberately not permitted to make them alone.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via preferred channel

Human decides

Agent resumes with decision

Agent Capabilities

150 actions

Account and Organizations

Get Profile Returns the Supabase user the personal access token belongs to. The cheapest connection check, and the way to confirm which account a flow is acting as.
List Organizations Returns every organization the token's user belongs to, with each one's slug. The slug rather than the id is what the rest of this API takes.
Get Organization Returns a single organization by slug, including its plan and opt-in settings.
Create Organization Creates a new organization owned by the token's user. A new organization starts on the free plan.
List Organization Members Returns an organization's members with their roles and MFA status. The MFA flag on each row is worth auditing, because an owner without it is the weakest link in the estate.
Get Organization Entitlements Returns what an organization's plan actually allows: feature availability and quota limits. Read before a flow tries to enable something the plan does not include.
List Organization Projects Returns every project in one organization, which is narrower than the full project list when a user belongs to several.
List Projects Returns every project the token's user can reach across all their organizations, with each project's ref, region and status.
Get Project Returns a single project with its region, status and database host. The status field is the one that matters, because an inactive project has been paused.

Project Lifecycle

List Available Regions Returns the regions a new project can be created in right now. Region availability changes, so this is read rather than assumed.
Create Project Provisions a new project. The database password is not recoverable from this API afterward, so a flow stores it at creation, and the project is not usable the instant the call returns.
Update Project Changes a project's display name. It is the only project field this route accepts.
Delete Project Permanently deletes a project along with its database, backups, storage buckets and Edge Functions. There is no undelete in this API and the project ref is not reusable, so this is held for a person.
Pause Project Pauses a project and stops its compute charges. A paused project's database is unreachable, so every connection and Edge Function call against it fails.
Restart Project Restarts a project's services. This is a real outage of seconds to a minute, and in-flight queries are lost.
List Restore Versions Returns the Postgres versions a paused project can be restored onto. Read before restoring, because a paused project is sometimes only restorable onto a newer version.
Restore Project Brings a paused project back online. It takes minutes rather than seconds, and it resumes compute charges.
Cancel Project Restore Cancels an in-progress project restoration.
Get Project Health Reports whether each named service of a project is healthy. The services list is required and the response only covers what was asked for.
Get Upgrade Eligibility Reports whether a project can be upgraded to a newer Postgres version and what would block it. The call that precedes any upgrade.
Upgrade Project Upgrades a project to a newer Postgres major version. It is one way, it takes the database down for the duration, and there is no downgrade.
Get Upgrade Status Returns the progress of a project's Postgres upgrade, which is what a flow polls after starting one.

SQL and Schema

Run SQL Query Executes arbitrary SQL with full privileges and returns the rows. There is no undo, so a destructive statement here does exactly what it says. Parameters are bound by position, which is how user data is interpolated safely.
Run Read Only SQL Query Executes SQL as a read-only role, so a write fails instead of succeeding. The default an agent reaches for, and the reason most reporting flows need no gate at all.
Get Database Context Returns structural metadata about a project's database: its schemas, tables and columns. The operation to feed an agent before it writes SQL against a database it has not seen.
Get PostgREST OpenAPI Spec Returns the OpenAPI document PostgREST generates for the project's exposed schema, describing every table and function reachable through the data API.
Generate TypeScript Types Returns TypeScript type definitions generated from the project's schema. Running this after a migration and committing the result keeps application types in step with the database.

Migrations

List Migrations Returns the migration versions recorded in the project's history table, which is what the Supabase CLI reads and writes.
Apply Migration Runs a migration against the database and records it in the migration history. It executes the SQL rather than testing it, and an idempotency key stops a retried flow applying it twice.
Upsert Migration Writes a migration into the history table without executing its SQL. How a change already applied by hand is back-filled.
Get Migration Returns one entry from the migration history by version, including the statements it recorded.
Patch Migration Edits an existing migration history entry in place. It rewrites the record rather than the database, so the schema is unaffected.
Rollback Migrations Rolls back every migration at or after a version and removes them from the history. It runs the stored rollback SQL, so a migration recorded without one cannot be undone this way.

Database Settings

Update Database Password Sets a new password for the project's Postgres user. Every direct connection using the old password breaks immediately, including pooler connection strings held by other services.
Get Readonly Mode Reports whether the database has been forced into read-only mode, which Supabase does automatically when the disk is nearly full.
Disable Readonly Mode Lifts read-only mode for a short deliberate window, which exists so space can be freed rather than as a way to keep writing.
Get SSL Enforcement Reports whether the project requires SSL on database connections.
Update SSL Enforcement Turns SSL enforcement on or off. Turning it on breaks every existing client that connects without SSL, and turning it off is a real reduction in security.

Backups and Restore Points

List Backups Returns a project's available backups and whether point in time recovery is enabled.
Restore Backup Restores the database from a physical backup. This replaces the current database, and everything written since the backup is lost.
Restore Point In Time Rewinds the database to a specific second. Everything written after that moment is lost, and the recovery target is a timestamp in seconds rather than milliseconds.
Create Restore Point Marks a named moment the database can later be returned to. The cheap insurance to take before any migration, upgrade or restore.
List Restore Points Returns the named restore points recorded for a project.
Undo To Restore Point Returns the database to a named restore point. Everything written since that point is lost.
Get Backup Schedule Returns the time of day a project's daily backup runs.
Update Backup Schedule Moves the daily backup to a different time, which is worth doing when the default collides with a nightly batch job.

Replicas and Webhooks

Setup Read Replica Provisions a read replica in another region. It bills as a second compute instance for as long as it exists.
Remove Read Replica Tears down a read replica and stops its compute charges. Any connection string pointed at it breaks immediately.
Enable Database Webhooks Turns on the Database Webhooks feature, which lets Postgres triggers call HTTP endpoints.

Edge Functions

List Edge Functions Returns a project's Edge Functions with their slug, status, version and JWT setting. The JWT field is the one to audit.
Get Edge Function Returns one Edge Function's metadata by slug, including its version, entrypoint and import map.
Get Edge Function Body Returns the deployed source of an Edge Function, which is what makes an audit possible: it answers what is actually running rather than what a repository says should be.
Create Edge Function Creates and deploys an Edge Function from inline source. JWT verification defaults to on, and turning it off makes the function a public endpoint anyone who learns the URL can invoke.
Update Edge Function Redeploys an Edge Function with new source or settings, bumping its version. Sending a function body replaces the whole source.
Delete Edge Function Removes an Edge Function. Its invoke URL starts failing immediately, including for Postgres triggers and outside webhooks that call it.
Bulk Update Edge Functions Replaces a project's whole Edge Function set in one call. Functions missing from the array are removed, so this is not the way to change one function.

API Keys

List API Keys Returns a project's API keys. Revealing the values returns them in plaintext, which writes them into the flow's execution record, so it stays off unless a key genuinely has to be handed to something.
Get API Key Returns one API key's metadata, and its value when reveal is on, with the same caution.
Create API Key Creates a new project API key. A secret key bypasses row level security and is a full-privilege credential; a publishable key is the one safe to ship to clients.
Update API Key Renames an API key or changes its description or JWT template. It does not rotate the key value.
Delete API Key Revokes a project API key. Anything still using it starts failing immediately, so a rotation creates the replacement and deploys it first.
Get Legacy API Keys Setting Reports whether the project's legacy keys are still enabled.
Update Legacy API Keys Setting Enables or disables the project's legacy keys. Disabling them breaks every client still using them, which is most older Supabase applications.

Secrets and Encryption

List Secrets Returns the project's Edge Function environment secrets. Values come back hashed, so this answers which secrets exist rather than what they are.
Create Secrets Sets one or more environment secrets for the project's Edge Functions. Existing names are overwritten, so it doubles as the update.
Delete Secrets Removes environment secrets by name. An Edge Function reading a deleted secret gets nothing on its next cold start.
Get Pgsodium Config Returns the project's pgsodium root encryption key configuration.
Update Pgsodium Config Sets the pgsodium root encryption key. Supabase's own warning is that changing it can make data encrypted with the older key permanently inaccessible, with no recovery.

Auth Configuration

Get Auth Config Returns a project's complete auth configuration: site and redirect URLs, signup rules, SMTP, session and rate limits, password policy and MFA.
Update Auth Config Changes a project's auth configuration, altering only the fields sent. Several of these are security decisions rather than settings, including whether signup is open, whether an address is confirmed automatically, and which redirect URIs are allowed.

Signing Keys

List Signing Keys Returns the project's JWT signing keys with their algorithm and status. The modern replacement for a single shared JWT secret.
Get Signing Key Returns one signing key's algorithm, status and public component.
Create Signing Key Creates a new signing key in standby status, which is the first step of a safe rotation because clients learn it from the published key set before it signs anything.
Update Signing Key Changes a signing key's status, which is how a rotation is performed. Order matters: promoting too early or revoking too early invalidates live sessions.
Delete Signing Key Removes a signing key entirely, which Supabase only allows once it has been revoked for a while.

Single Sign-On

List SSO Providers Returns the SAML providers configured on a project, with the email domains each one claims.
Get SSO Provider Returns one SAML provider's metadata, domains and attribute mapping.
Create SSO Provider Registers a SAML identity provider. Claiming a domain routes every user at that domain to the provider, so an existing password user there can no longer sign in with a password.
Update SSO Provider Changes a SAML provider's metadata, domains, attribute mapping or name format. Sending domains replaces the claimed list rather than extending it.
Delete SSO Provider Removes a SAML provider. Every user who signs in through it loses their only way in, because SSO users generally have no password.

Third Party Auth

List Third Party Auth Integrations Returns the external token issuers a project trusts, which let another identity system's tokens authenticate against this project.
Get Third Party Auth Integration Returns one third party token issuer's configuration.
Create Third Party Auth Integration Tells a project to accept tokens issued by an outside identity provider. Anyone controlling that issuer's signing keys can sign in as any subject, so only trusted issuers belong here.
Delete Third Party Auth Integration Stops a project trusting an outside token issuer. Every user signing in through it is locked out immediately.

Preview Branches

List Branches Returns a project's preview branches, each of which is a real and separately billed project shadowing a git branch.
Get Branch By Name Returns one preview branch by its name.
Get Branch Returns a preview branch's configuration by branch id or by the branch project's own ref, including its database credentials.
Create Branch Creates a preview branch, which provisions a whole new project. It bills as its own compute instance for as long as it exists, and copying production data into it puts real personal data in a throwaway environment.
Update Branch Changes a preview branch's name, git tracking, persistence or review state.
Delete Branch Deletes a preview branch and the project behind it, stopping its compute charges. The branch's database goes with it.
Push Branch Applies the branch's pending migrations and function deployments to the branch database. The branch equivalent of a deploy, and it does not touch the parent.
Merge Branch Applies a preview branch's migrations and functions to the parent project. This is a production deploy, and it is the operation this page's human gate is built on.
Reset Branch Wipes a preview branch's database and replays its migrations from scratch. Every row in the branch is destroyed, which is the point, and it is easy to run against the wrong branch id.
Restore Branch Cancels a branch's scheduled deletion and brings it back, but only while the deletion is still scheduled.
Diff Branch Returns the schema difference between a preview branch and its parent, as SQL. The only way to see exactly what a merge would apply, and the evidence this page's gate is built on.
Disable Branching Turns preview branching off for a project, destroying every preview branch and its database.

Branch Action Runs

List Action Runs Returns the branching action runs on a project, which are the migration and deployment jobs that fire when a branch is created, pushed or merged.
Get Action Run Returns the status of one branching action run.
Get Action Run Logs Returns the log output of a branching action run, which is where a failed branch migration actually explains itself.
Update Action Run Status Overrides the recorded status of a branching action run. It changes the record rather than the work.

Storage

List Storage Buckets Returns a project's Storage buckets with their public flag and limits. A public bucket is readable by anyone with the URL, with no token and no row level security, which makes this list worth auditing.
Get Storage Config Returns a project's Storage settings: the global upload size limit and which features are enabled.
Update Storage Config Changes a project's Storage settings. The file size limit is a ceiling for every bucket, so a per-bucket limit cannot exceed it.

Realtime

Get Realtime Config Returns a project's Realtime settings: connection pools, concurrency and throughput limits, and whether channels are private only.
Update Realtime Config Changes a project's Realtime limits. The private-only flag is a security control rather than a tuning knob, because with it off an anonymous client can subscribe to any channel it can name.
Shutdown Realtime Connections Drops every live Realtime connection on a project. A blunt recovery tool rather than a routine operation.

PostgREST

Get PostgREST Config Returns a project's PostgREST settings: which schemas are exposed through the data API, the row cap and the connection pool.
Update PostgREST Config Changes which schemas a project exposes through its data API. Adding a schema here makes every table in it reachable through the REST API, subject only to row level security.

Postgres and Pooling

Get Postgres Config Returns the project's tunable Postgres settings: memory, connection limits, logging and replication parameters.
Update Postgres Config Changes the project's Postgres server parameters. Some settings require a restart, and memory settings multiply by connection count.
Get Pooler Config Returns the project's Supavisor connection pooler settings and connection strings, which is what a serverless workload should connect through.
Update Pooler Config Changes the pooler's size and mode. Transaction mode breaks prepared statements, session variables, advisory locks and notifications, because a connection is handed to a different client between transactions.
Get PgBouncer Config Returns the project's legacy pooler configuration, which has been superseded by Supavisor on modern projects.

Disk

Get Disk Config Returns the project's disk type, size and provisioned throughput.
Modify Database Disk Changes the project's disk size, type or throughput. Disk size only goes up, so an over-provisioned volume is a permanent cost.
Get Disk Utilization Returns how much of the project's disk is used. Worth alerting on, because a full disk forces the database into read-only mode.
Get Disk Autoscale Config Returns whether the project's disk grows automatically and under what conditions.

Billing

List Billing Addons Returns the addons applied to a project and the variants available, including compute instance sizes.
Update Billing Addons Applies or changes a project's paid addons, including compute size. It changes what the organization is billed immediately and without a confirmation step, and a compute change restarts the database.
Remove Billing Addon Removes a paid addon. Removing point in time recovery destroys the recovery window, so a restore that might have been wanted tomorrow becomes impossible today.

Custom Domains

Get Custom Hostname Returns a project's custom hostname configuration and its DNS verification state, including where a stuck domain is failing.
Initialize Custom Hostname Starts the custom domain setup, which is the first of three steps rather than the whole thing.
Reverify Custom Hostname Asks Supabase to re-check the DNS for a pending custom hostname, which a flow retries while propagation completes.
Activate Custom Hostname Makes a verified custom hostname the project's live API host. Auth redirect URLs, allowed origins and any hard-coded host need to match, or sign-in breaks.
Delete Custom Hostname Removes a project's custom hostname configuration. Every client calling the custom domain breaks immediately.

Vanity Subdomains

Get Vanity Subdomain Returns a project's vanity subdomain configuration, which is a friendlier host than the generated one and simpler than a custom domain.
Check Vanity Subdomain Availability Reports whether a vanity subdomain is free, which is run first because claiming a taken name fails outright.
Activate Vanity Subdomain Claims a vanity subdomain for a project and starts serving on it.
Delete Vanity Subdomain Releases a project's vanity subdomain. Anything calling it breaks, and the name returns to the shared pool.

Network

Get Network Restrictions Returns which address ranges may reach the project's database directly. A wide open list means the database is reachable from anywhere.
Apply Network Restrictions Replaces the set of ranges allowed to reach the database. It is a replace and it is easy to lock a team out, and it covers the database port rather than the HTTPS services.
Patch Network Restrictions Adds or removes individual ranges without resending the whole list. The safer choice for adding one office address.
Get Network Bans Returns the addresses Supabase has automatically banned from the database, usually after repeated failed authentication. The first place to look when one client cannot connect.
Remove Network Bans Unbans addresses from the project's database. Unbanning without fixing the cause simply gets the address banned again.

Logs and Metrics

Query Logs Runs a query against a project's log stream, reaching Postgres logs, the API gateway and function logs the way the Logs Explorer does.
Get API Usage Counts Returns the project's API request counts bucketed by interval, which is the cheapest way to see a traffic spike or a client stuck in a retry loop.
Get API Requests Count Returns the project's total API request count without the per-bucket breakdown.
Get Function Statistics Returns invocation counts, errors and execution time for one Edge Function over an interval.
Get Project Metrics Returns the project's metrics scrape: connection counts, CPU, memory, disk and per-service statistics.

Advisors

Get Security Advisors Returns Supabase's security lints for a project, including tables exposed through the data API without row level security. The highest-value read in the connector.
Get Performance Advisors Returns Supabase's performance lints: unindexed foreign keys, unused indexes and policies that re-evaluate per row.

Snippets

List Snippets Returns the saved SQL snippets belonging to the token's user, optionally narrowed to one project.
Get Snippet Returns one saved SQL snippet including its full text. Reading a snippet does not run it.

Temporary Access

Get JIT Access Config Returns the project's temporary database access configuration, which is how a person gets a short-lived database role rather than a standing one.
Update JIT Access Config Changes the project's temporary database access settings. The vendor marks this route as beta.
List JIT Access Mappings Returns the user to database-role mappings authorized for temporary access. The audit list for who can obtain which role.
Authorize JIT Access Grants a user temporary access to a database role. It hands out real database privileges, so the role named here is what the person actually gets.
Revoke JIT Access Removes a user's temporary database access mapping.
Create CLI Login Role Creates a temporary database login role with a generated password for CLI use. The response carries a live database credential, so it lands in the flow's execution record.
Delete CLI Login Roles Removes the temporary CLI login roles from a project. Worth running at the end of any flow that created one.

Frequently Asked Questions

What can FlowRunner do with Supabase Management API?

FlowRunner agents can run Get Profile, List Organizations, and Get Organization in Supabase Management API, plus 147 more actions.

Does connecting Supabase Management API to FlowRunner require OAuth?

No. Supabase Management API connects to FlowRunner with an API key, no OAuth flow required.

Can Supabase Management API trigger a FlowRunner workflow automatically?

Supabase Management API doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.

Start building with Supabase Management API

Free plan, no card required. Connect in minutes.

Start Building Free Talk to us