Database API 42501 errors

[TheOtherBrian1]

This is a copy of a troubleshooting article on Supabase's docs site. It may be missing some details from the original. View the original article.

Postgres 42501 errors, often reported by clients as 401 or 403 errors, imply the request lacked adequate privileges. They can be viewed in the log explorer by running:

select
  cast(postgres_logs.timestamp as datetime) as timestamp,
  event_message,
  parsed.error_severity,
  parsed.user_name,
  parsed.query,
  parsed.detail,
  parsed.hint
from
  postgres_logs
  cross join unnest(metadata) as metadata
  cross join unnest(metadata.parsed) as parsed
where
  regexp_contains(parsed.error_severity, 'ERROR|FATAL|PANIC')
  and parsed.sql_state_code = '42501'
order by timestamp desc
limit 100;

They tend to be caused by one of the following factors.

Attempted to access a forbidden schema

API roles cannot access certain schemas, most notably auth and vault. This restriction extends to Foreign Data Wrappers relying on vault. While you can bypass it using a security definer function, these schemas are intentionally restricted for security reasons.

Attempted to access a custom schema

If you created a custom schema, you will have to give the Database API permission to query it. Follow our Using Custom Schemas guide for more directions.

Revoked object level access:

In rare cases, users may accidentally revoke object-level access in public from their API roles. To regrant full visibility, run the below code:

grant usage on schema public to anon, authenticated, service_role;
grant all on all tables in schema public to anon, authenticated, service_role;
grant all on all routines in schema public to anon, authenticated, service_role;
grant all ON all sequences in schema public to anon, authenticated, service_role;
alter default privileges for role postgres in schema public grant all on tables to anon, authenticated, service_role;
alter default privileges for role postgres in schema public grant all on routines to anon, authenticated, service_role;
alter default privileges for role postgres in schema public grant all on sequences to anon, authenticated, service_role;

Configured column-level restrictions

If you've set column-based access in the Dashboard or via SQL, queries will fail with a 42501 error when accessing restricted columns. This includes using select *, as it expands to include forbidden columns.

RLS:

If the anon or authenticated roles attempt to UPDATE or INSERT values without the necessary RLS permissions, Postgres will return a 42501 error.

[w0rmh0l3]

I am running a self-hosted instance. And running the query to show the errors does not return any data, however, it does throw the following error when viewing docker logs:

thread '<unnamed>' panicked at src/lib.rs:47:74:
called `Result::unwrap()` on an `Err` value: Error("invalid type: null, expected a string", line: 1, column: 2308)

06:14:46.270 [error] ** (ErlangError) Erlang error: :nif_panicked
    (logflare 1.20.1) Logflare.Sql.Parser.Native.to_string("[{\"Query\":{\"body\":{\"Select\":{\"cluster_by\":[],\"connect_by\":null,\"distinct\":null,\"distribute_by\":[],\"from\":[{\"joins\":[],\"relation\":{\"Table\":{\"alias\":null,\"args\":null,\"name\":[{\"quote_style\":null,\"value\":\"postgres_logs\"}],\"partitions\":[],\"version\":null,\"with_hints\":[]}}}],\"group_by\":{\"Expressions\":[[],[]]},\"having\":null,\"into\":null,\"lateral_views\":[],\"named_window\":[],\"prewhere\":null,\"projection\":[{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"timestamp\"},\"expr\":{\"Cast\":{\"data_type\":{\"Datetime\":null},\"expr\":{\"CompoundIdentifier\":[{\"quote_style\":null,\"value\":\"postgres_logs\"},{\"quote_style\":null,\"value\":\"timestamp\"}]},\"format\":null,\"kind\":\"Cast\"}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"event_message\"},\"expr\":{\"Identifier\":{\"quote_style\":null,\"value\":\"event_message\"}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"error_severity\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,error_severity}\"}}}}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"user_name\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,user_name}\"}}}}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"query\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,query}\"}}}}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"detail\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,detail}\"}}}}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"hint\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,hint}\"}}}}}}}],\"qualify\":null,\"selection\":{\"BinaryOp\":{\"left\":{\"BinaryOp\":{\"left\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashLongArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,error_severity}\"}}}}},\"op\":\"PGRegexMatch\",\"right\":{\"Value\":{\"SingleQuotedString\":null}}}},\"op\":\"And\",\"right\":{\"BinaryOp\":{\"left\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"Identifier\":{\"quote_style\":null,\"value\":\"metadata\"}},\"op\":\"HashLongArrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"{parsed,sql_state_code}\"}}}}},\"op\":\"Eq\",\"right\":{\"Value\":{\"SingleQuotedString\":\"42501\"}}}}}},\"sort_by\":[],\"top\":null,\"value_table_mode\":null,\"window_before_qualify\":false}},\"fetch\":null,\"for_clause\":null,\"format_clause\":null,\"limit\":{\"Value\":{\"Number\":[\"100\",false]}},\"limit_by\":[],\"locks\":[],\"offset\":null,\"order_by\":[{\"asc\":false,\"expr\":{\"Identifier\":{\"quote_style\":null,\"value\":\"timestamp\"}},\"nulls_first\":null}],\"settings\":null,\"with\":{\"cte_tables\":[{\"alias\":{\"columns\":[],\"name\":{\"quote_style\":null,\"value\":\"edge_logs\"}},\"from\":null,\"materialized\":null,\"query\":{\"body\":{\"Select\":{\"cluster_by\":[],\"connect_by\":null,\"distinct\":null,\"distribute_by\":[],\"from\":[{\"joins\":[],\"relation\":{\"Table\":{\"alias\":{\"columns\":[],\"name\":{\"quote_style\":null,\"value\":\"t\"}},\"args\":null,\"name\":[{\"quote_style\":\"\\\"\",\"value\":\".1_default.922fe612_3068_4307_98c1_6c1ded1d7d78\"}],\"partitions\":[],\"version\":null,\"with_hints\":[]}}}],\"group_by\":{\"Expressions\":[[],[]]},\"having\":null,\"into\":null,\"lateral_views\":[],\"named_window\":[],\"prewhere\":null,\"projection\":[{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"timestamp\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"CompoundIdentifier\":[{\"quote_style\":null,\"value\":\"t\"},{\"quote_style\":null,\"value\":\"body\"}]},\"op\":\"Arrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"timestamp\"}}}}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_style\":null,\"value\":\"id\"},\"expr\":{\"Nested\":{\"BinaryOp\":{\"left\":{\"CompoundIdentifier\":[{\"quote_style\":null,\"value\":\"t\"},{\"quote_style\":null,\"value\":\"body\"}]},\"op\":\"Arrow\",\"right\":{\"Value\":{\"SingleQuotedString\":\"id\"}}}}}}},{\"ExprWithAlias\":{\"alias\":{\"quote_sty" <> ...)
    (logflare 1.20.1) lib/logflare/sql/dialect_translation.ex:33: anonymous fn/2 in Logflare.Sql.DialectTranslation.translate_bq_to_pg/2
    (logflare 1.20.1) lib/logflare/endpoints.ex:250: Logflare.Endpoints.run_query/3
    (logflare 1.20.1) lib/logflare_web/controllers/endpoints_controller.ex:70: LogflareWeb.EndpointsController.query/2
    (logflare 1.20.1) lib/logflare_web/controllers/endpoints_controller.ex:1: LogflareWeb.EndpointsController.action/2
    (logflare 1.20.1) lib/logflare_web/controllers/endpoints_controller.ex:1: LogflareWeb.EndpointsController.phoenix_controller_pipeline/2
    (phoenix 1.7.21) lib/phoenix/router.ex:484: Phoenix.Router.__call__/5
    (logflare 1.20.1) lib/logflare_web/endpoint.ex:1: LogflareWeb.Endpoint.plug_builder_call/2

I also connected to the DB directly, but I can't seem to find postgres_logs table anywhere. I am not a DB expert, but I believe running the following should show me the table, but it doesn't?

SELECT * FROM information_schema.tables WHERE table_name like '%log%';

Following is my current config:

# Container Versions
STUDIO_VERSION=2025.08.25-sha-72a94af
KONG_VERSION=2.8.1
AUTH_GOTRUE_VERSION=v2.178.0
REST_VERSION=v13.0.5
REALTIME_VERSION=v2.43.1
STORAGE_VERSION=v1.26.4
IMGPROXY_VERSION=v3.29.1
META_VERSION=v0.91.5
EDGE_VERSION=v1.69.2
LOGFLARE_VERSION=1.20.1
DB_VERSION=15.8.1.132
VECTOR_VERSION=0.28.1-alpine
SUPAVISOR_VERSION=2.6.2