Supabase API
MaterialsHub runs on Supabase, and its API is the platform's data layer: a REST interface over your tables (with row-level security enforced on every request), plus authentication, file storage, realtime, and the edge functions that implement the platform's server-side actions. If you want to read or write your own workspace's records programmatically, this is usually the shortest path.
Security model — read this first. Every request is executed as the caller and filtered by row-level security (RLS). The public anon key is not a master key — on its own it sees only what's public. Your session token is what grants access to your workspace's rows. Never embed a service-role key in a browser, app or anything a user can see.
The endpoints
| Surface | Base path | What it does |
|---|---|---|
| REST (PostgREST) | /rest/v1/<table> | Query and modify tables directly — filtering, ordering, pagination, embedded relations. RLS-enforced. |
| Edge Functions | /functions/v1/<name> | The platform's server-side actions (invoicing, email, agent chat, careers, and more). |
| Auth | /auth/v1 | Sign-up/sign-in, sessions and token refresh — how you obtain the JWT the other calls use. |
| Storage | /storage/v1 | Files — uploads, and public or signed URLs for private buckets. |
Authenticating
- Send the anon key on every request as the
apikeyheader — it identifies the project. It's a public, publishable key (it's already in the web app). - Sign in via Auth to get a session JWT, then send it as
Authorization: Bearer <jwt>. - RLS does the rest — you get exactly the rows your user/workspace is allowed to see. No extra filtering needed (and none you can bypass).
The official reference for the request syntax (filters, ordering, embedding, upserts) is Supabase's own documentation: supabase.com/docs/guides/api. Client libraries exist for JavaScript, Python, Dart and more.
Edge functions — the platform's actions
Most things the app does (rather than just reads) run through an edge function at /functions/v1/<name> — issuing an invoice, sending email, the agent chat, the careers board, and so on. They take a JSON body and are authenticated with the same session JWT (a few are deliberately public, like the Jobs API).
Per-function references for the main ones (agent chat, CRM, finance, email, flow engine, generation endpoints and more) live in the repository's docs/api/ folder — one Markdown reference per function, with request/response shapes.
Realtime
Tables the platform streams (job progress, inbox messages, agent runs) can be subscribed to over Supabase realtime, so an integration can react to changes instead of polling.
Rule of thumb: use the Supabase API for your own data and for reacting to changes; use the MIVAA API when you need the platform to do heavy work (process a catalogue, run a search, track prices/mentions/jobs).