Is there a way to disable Data API through Terraform/API

[lstr168]

Hi, I’m new to Supabase and I’m using it mainly as a managed Postgres database behind my own backend API, so I don’t need the Data API exposure.

In the dashboard, I can see the Enable Data API toggle, but I couldn’t find a way to control this setting via:

• the Supabase Terraform provider, or
• the Supabase Management REST API docs.

Is disabling Enable Data API currently supported through Terraform/API and I’m missing it, or is this not exposed yet?
If not exposed yet, is this planned for future support?

I’d like to fully automate this in my IaC for environment consistency and security hardening.

[Byk3y]

Hi @lstr168,

You are correct that the "Enable Data API" toggle (which controls the underlying PostgREST service) is currently a UI-only feature in the dashboard and is not yet explicitly exposed as a boolean property in the Management API or the Terraform provider.

However, you can achieve the same security hardening and environment consistency in your IaC using the following workarounds:

1. The "Empty Schema" Workaround (Terraform)
   The best way to "disable" the Data API via Terraform is to ensure PostgREST has no schemas to expose. By default, it exposes the public schema. You can override this in your supabase_settings resource:

hcl
resource "supabase_settings" "production" {
project_ref = var.project_ref

Setting db_schemas to an empty list or a private-only

schema effectively disables the REST API exposure.

api = jsonencode({
db_schemas = ["hidden_schema"]
# Or keep it empty if the provider/API allows: []
})
}
2. Manual Management API Call
If you want to check the current configuration programmatically, the endpoint is GET /v1/projects/{ref}/config/postgrest. While it doesn't currently support an is_enabled flag, it does allow you to manage:

db_schemas: What schemas are exposed.
max_rows: Setting this to 0 or 1 can further limit exposure.
3. Future Support
In the Supabase Security Retro (2025), the team explicitly mentioned that they are moving towards more granular "API access control" toggles. This suggests that parity between the Dashboard UI and the Management API/CLI/Terraform for this specific toggle is on the roadmap but not yet finalized.

Summary for your Security Hardening:
If your goal is security hardening, the most robust IaC approach right now is:

Restrict db_schemas to a schema that contains no tables (via Terraform).
Ensure RLS is enabled on all tables in your public schema anyway (defense in depth).
Disable pg_net or pg_http if you don't need outbound requests.
Hope this helps with your automation!