Management API database query endpoints return empty HTTP 404

[ezclips]

Hallo: I am using a hosted Supabase project on the Free plan and need to execute a read-only aggregate SQL diagnostic through the Management API.

The current Management API documentation/OpenAPI specification lists these endpoints:

POST /v1/projects/{ref}/database/query/read-only

and:

POST /v1/projects/{ref}/database/query
with "read_only": true in the request body.

I authenticated using a Supabase personal access token and tested both endpoints. Both returned HTTP 404 with an empty response body.

Attempt 1:

Endpoint:
POST /v1/projects/{ref}/database/query/read-only

Result:

• HTTP status: 404
• Empty response body
• No x-request-id
• No sb-request-id
• CF-RAY: a3aa4e841f830396-ZRH

Attempt 2:

Endpoint:
POST /v1/projects/{ref}/database/query
Body included:
{
"query": "",
"read_only": true
}

Result:

• UTC: 2026-09-13T21:56:35.5709825Z
• HTTP status: 404
• Empty response body
• No x-request-id
• No sb-request-id
• CF-RAY: a3aa67221a38c126-ZRH
• Elapsed time: 181 ms

The response URI matched the requested URI, so no redirect occurred. TLS and connectivity completed successfully.

The SQL was a SELECT-only aggregate diagnostic. It contained no INSERT, UPDATE, DELETE, DDL, or raw-record output.

Could someone confirm:

1. Are these Management API database-query endpoints available for Free-plan projects?
2. Is the read-only endpoint still in beta or restricted to certain accounts?
3. Does a personal access token require additional permissions for these endpoints?
4. Is there another supported method for running an aggregate, technically read-only production diagnostic?

I have omitted the access token and full project reference for security. I can provide further non-secret request details if needed.

Cheers

[k1ng-arthur]

Did you use https://supabase.com/dashboard/account/tokens to generate the access token and did you set a preset of read-only

[k1ng-arthur]

For what it is worth, i just ran this against my own project curl https://api.supabase.com/v1/projects//database/query/read-only -H "Authorization: Bearer " -H “Content-Type: application/json" -d '{ "query": "SELECT * FROM public.orgs LIMIT 10;" }' and had no issues getting results so i would check that the way you generated your token is correct and that the curl request has no formatting issues