---
number: 46320
slug: 46320-breaking-change-in-pg-graphql-1-6-0-graphql-introspection-disabled-by-default
published: 2026-05-25
discussion: https://github.com/orgs/supabase/discussions/46320
labels:
  - extensions
  - postgres
page: https://supabase.com/changelog/46320-breaking-change-in-pg-graphql-1-6-0-graphql-introspection-disabled-by-default
---

# Breaking change in pg_graphql 1.6.0 — GraphQL introspection disabled by default

Starting with pg_graphql **1.6.0** (shipping in new Supabase projects from **2026-06-15**), GraphQL introspection is **disabled by default**.

  ## Who is affected

  - **New projects** created on or after 2026-06-15 will run pg_graphql 1.6.0+ and have introspection disabled by default.
  - **Existing projects** are not affected unless and until you upgrade pg_graphql to 1.6.0+ (e.g. by upgrading your project's Postgres version). Older projects keep their current behaviour.

  ## What's changing

  Previously, `__schema` and `__type` queries worked without any configuration. From 1.6.0, they return an error unless you explicitly opt in:

  ```json
  { "errors": [{ "message": "Unknown field \"__schema\" on type Query" }] }
  ```

  If your project uses any of the following, you'll need to opt in before relying on introspection:

  - **Supabase Studio GraphQL explorer** (GraphiQL) — uses introspection to display your schema and provide autocomplete
  - **External GraphiQL or GraphQL Playground**
  - **Apollo DevTools**
  - **Relay compiler**
  - **Code generators** (e.g. `graphql-codegen`)
  - Any tool that calls `__schema` or `__type` directly

  **Regular data queries are not affected.** `accountCollection`, `insertIntoAccountCollection`, etc. continue to work normally regardless of this setting.

  ## How to opt in

  Run this SQL once per schema you want to expose introspection on:

  ```sql
  comment on schema public is e'@graphql({"introspection": true})';
  ```

  If you already have a comment on your schema (e.g. for `inflect_names`), combine the keys:

  ```sql
  comment on schema public is e'@graphql({"inflect_names": true, "introspection": true})';
  ```

  ## Why this change
  
  Introspection exposes your full API surface — all types, fields, and relationships — to anyone who can reach the endpoint. Disabling it by default reduces the risk of API enumeration and makes it easier to keep private schemas private.

  ## Further reading

  - [Configuration docs — Introspection](https://supabase.github.io/pg_graphql/configuration/#introspection)
  - [pg_graphql changelog](https://supabase.github.io/pg_graphql/changelog/)