# Integrating SailPoint with Supabase

Supabase is a hosted Postgres platform. People belong to an organization and receive an organization role. Applications call a project with a long-lived API key. Edge Functions read project secrets and use those values to call other systems. The organization slug identifies the organization. The project ref identifies the project. This document covers how to configure a new direct connection between SailPoint and Supabase for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Supabase connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Roles

### Non-Human Identity Discovery

- Aggregate API Keys
- Aggregate Secrets (Edge Function secrets)

> [!NOTE]
>
> A project API key is a stored credential that an application or service presents when it calls the project. An Edge Function secret is a stored name and value that a function reads with no person present. API keys and secrets are aggregated as credential resources through Dataset Management. They stay out of user account aggregation. These resources do not define owner correlation.

> [!NOTE]
>
> Do not map `api_key`, `prefix`, or secret `value`. The API key and secret list endpoints do not support pagination. Do not grant **API Key Secrets** on the personal access token.

> [!NOTE]
>
> This connector is read-only. It supports test connection, account aggregation, entitlement aggregation, and dataset aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before you configure the Supabase connector, ensure the following requirements are met:

1. Sign in to Supabase.
2. Copy the organization slug from the dashboard URL. The slug is the value after `org/`. For example, in `https://supabase.com/dashboard/org/fxfbbnavmcftagaftqtx`, the organization slug is `fxfbbnavmcftagaftqtx`.
3. Open the project and copy the project ref. The project ref is the 20-character value after `project/`. For example, in `https://supabase.com/dashboard/project/abcdefghijklmnopqrst`, the project ref is `abcdefghijklmnopqrst`.
4. Create a personal access token from the account access tokens page. Supabase shows the token only once. Store it securely. Grant **Organization Members: Read**, **API Keys: Read**, and **Edge Function Secrets: Read**. Do not grant **API Key Secrets**.
5. Record the following values for connector configuration:

   - **Base URL**
   - **Organization Slug**
   - **Project Ref**
   - **Access Token**

For more information, refer to the [Supabase Management API](<https://supabase.com/docs/reference/api/introduction>) documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

Authenticate with a Bearer personal access token that can list organization members, organization roles, API keys (without key values), and Edge Function secrets. The API can return the secret value. The connector must not map that field. Do not grant **API Key Secrets** on the token.