Supabase table not exposed to the Data API

A new table is invisible to the API until a role is granted access. Here is the grant.

Before and after

Step	Before	After
Create a table in `public`	Reachable through the Data API at once	Exists, but not reachable through the Data API
Grant to `anon` / `authenticated` / `service_role`	Implicit, through default privileges	Required, as an explicit `grant` statement
`alter table ... enable row level security`	Same	Same
`create policy ...`	Same	Same

When it reaches your project

Date	What happens	Who it reaches
2026-04-28	Changelog published. A setting at project creation lets you turn automatic exposure off.	New projects that opt in
2026-05-30	The new behavior becomes the default for all new projects (gradual rollout over a few weeks).	New projects
2026-10-30	The new behavior is enforced on all existing projects.	Every project that uses the Data API

Dates are from the Supabase changelog post published 2026-04-28, read 2026-11-10. We have not seen an official post confirming that the 2026-10-30 step finished for every project, so check your own project with this query.

Expose a table on purpose

Grant the minimum each role needs. A table every visitor may read, and only your server may write:

-- public.your_table: public read
alter table public.your_table enable row level security;
revoke all on table public.your_table from anon, authenticated;
grant select on table public.your_table to anon;
grant select on table public.your_table to authenticated;
grant select, insert, update, delete on table public.your_table to service_role;
drop policy if exists your_table_read_all on public.your_table;
create policy your_table_read_all on public.your_table
  for select to anon, authenticated
  using ( true );

Use the tool below to write this for your own tables.

What is not affected

Apps that talk to Postgres over a direct connection (psql, an ORM, a server with a connection string).
Tables in storage, auth, realtime and custom schemas: they keep their grants and defaults.
Self-hosted Supabase: the changelog lists it as not affected.

Write the fix for your tables

One table is free. The whole schema with a rollback file is $9 one-time, free during launch.

Paste schema SQL or table names

Waiting for a paste.

Who can reach each table

Your tables show up here, one row each, with a choice of who can reach them.

Start clean: revoke older grants from anon and authenticated first, as the Supabase guide does.

The SQL appears here as soon as a table is found.

Parsed in your browser. Your SQL is never uploaded, and no site or database is scanned.

Questions

Where do I see which tables are exposed?

Supabase points to two places: the Data API exposure badge in the Table Editor, and the Security Advisor, which lists affected tables with remediation SQL.

Does GraphQL follow the same rule?

Yes. The change covers the Data API and the GraphQL API. Separately, the changelog says pg_graphql is not enabled by default from 2026-05-18.

Sources

Supabase changelog: Breaking Change: Tables not exposed to Data and GraphQL API automatically (published 2026-04-28), read 2026-11-10
Supabase docs: Securing your API, read 2026-11-10