# Ensure only intended schemas are exposed via the Data API

- Source: https://support.icompaas.com/support/solutions/articles/a_179010391031076-ensure-only-intended-schemas-are-exposed-via-the-data-api
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Data API's Exposed schemas list contains only the schemas that client applications are meant to access. Schemas holding internal or sensitive tables should not be exposed, and the Data API should be disabled entirely if the project never uses it.

**Rationale**

Every schema in the Exposed schemas list can be reached through the REST and GraphQL APIs using the public key. If internal schemas are exposed, their tables and functions become reachable from the internet and depend entirely on RLS for protection. Exposing only the schemas that are needed reduces the attack surface of the project.

**Impact**

-   Limits what can be reached through the Data API
    
-   Keeps internal tables private
    
-   Clients that use a removed schema will stop working
    

**Default Value**

By default, the public and graphql\_public schemas are exposed through the Data API.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   A list of schemas clients need to access
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the Data API settings (Project Settings > Data API, or Integrations > Data API > Settings).
    
4.  Review the Exposed schemas list.
    
5.  If a schema is exposed that clients do not need, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the Data API settings (Project Settings > Data API, or Integrations > Data API > Settings).
    
4.  Remove the schemas that should not be exposed from Exposed schemas.
    
5.  Select Save.
    
6.  If the project never uses the Data API, disable it in the same settings.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the Data API settings.
    
4.  Add the removed schema back to Exposed schemas.
    
5.  Select Save.
    

**Reference**

-   [https://supabase.com/docs/guides/api/hardening-data-api](https://supabase.com/docs/guides/api/hardening-data-api)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.