An existing database can become a GraphQL API
Hasura V2 can expose an existing database through GraphQL, with filtering, mutations, and subscriptions described in its README. That is useful when a frontend needs related records and live updates while your team already owns the database. The bargain is attractive: fewer routine endpoints to write. You still decide which tables belong in the API and which requests each user may make.
Our checkout occupied 342.3 MB and contained 13,393 files with roughly 574,059 source lines. That breadth includes several parts of the Hasura ecosystem. The sandbox measured the Go project in ./cli/, not the GraphQL server. Keep that scope in mind before reading a successful build as proof that the API service itself ran. The CLI manages an engine deployment, and the engine has its own runtime requirements.
What happened when we ran it
Our sandbox installed commit e77418e's CLI dependencies in 50 seconds, adding 248 packages, then completed the build in 79 seconds. We ran it on October 10, 2026, in a fresh Debian container using Go 1.24, 3 CPUs, and 8 GB of RAM. The container had no secrets or elevated privileges. These successes establish that the measured CLI path could install and compile in that environment.
The test command failed with exit code 1 after 62 seconds: 44 tests passed and 33 failed out of 77. The supplied tail marks pkg/migrate, seed, and util as failed packages. It names TestDriver_ApplySeedsToDatabase, TestDriver_ExportDatadump, and TestGetServerState among the failures, while telemetry and version packages report success. The tail does not include the underlying assertions or connection errors. The 33 failures deserve follow-up, but the log doesn't establish their cause. Missing services, missing system packages, and code defects would be guesses from this evidence. Our scan found 2 CI workflow files and no Dockerfile or tests directory. Those are scan signals, not a full inventory of this large repository. The defensible finding is that the CLI compiled and its measured suite did not pass in our sandbox.
Authentication supplies identity, and permissions decide access
Hasura's row-permission guide describes expressions that restrict database rows by operation and role. A session variable can tie the caller's identity to a record's owner. The practical work is to configure those rules and verify them as an ordinary user, rather than only through an administrator session. A generated schema makes data convenient to request, so an incorrect permission becomes convenient to exercise too.
Our 44 passing CLI tests do not validate your application's access rules. JWT mode expects your authentication service to issue tokens, which Hasura verifies and maps into session variables. For an organization-based app, check attempts to read another organization's records and update fields the caller shouldn't control. Hasura provides the permission machinery. Your team supplies the identity integration and evidence that its rules match the product's promises.
The sample deployment leaves the admin secret commented out
The repository's V2 Compose manifest enables the console and development mode, uses a sample database password, and comments out HASURA_GRAPHQL_ADMIN_SECRET. Those are concrete reasons to treat the file as a starting point that needs configuration. Set credentials, disable development mode for production, and decide how the administrative endpoint is reached before attaching a database containing real customer records.
The 79-second CLI build doesn't cover that service deployment. The CLI README takes an engine endpoint and admin secret in its usage example. Contributor guidance also lists Docker, Compose, Node, and Go, plus settings identifying the engine image and CLI binary used by integration checks. These documented requirements help plan a fuller evaluation, but they don't explain the failures in our supplied log.
V3 adds connector services and authored metadata
The V3 README says the engine sends queries to data connectors instead of executing database queries directly. Its Postgres route needs a connector alongside the engine and metadata authored for the database's models. DDN is the recommended authoring route there. Choose the generation deliberately: a V2 CLI example and V3 connector deployment are different operating arrangements, even though the root repository presents both.
The 248-package Go install we measured gives no installation or test result for that V3 arrangement. Likewise, V2's Actions and remote schemas let you attach custom business logic rather than supplying every domain rule automatically. If the hard part of your service is payment behavior or another external operation, you still own the code behind that integration. Hasura is most convincing when database access is a substantial part of the work you're trying to remove.
September's release fixes matter to long-lived servers
The last push was October 10, 2026, and GitHub showed 32,125 stars with 2,375 open issues and PRs. Recent activity included Console fixes and deployment-documentation corrections. Release v2.50.3 shipped on September 9 with fixes for memory retained after metadata updates and bounded websocket queue behavior. Those details show ongoing server maintenance. The combined issue count alone says little about how quickly a particular report will be resolved.
PostGraphile is worth considering for a PostgreSQL-centered GraphQL design. PostgREST fits a database-backed REST API, and Supabase suits teams also seeking authentication and storage. Choose Hasura when generated data access and its permission model fit your existing stack. Before committing, reproduce the 33 CLI failures with fuller logs and test your own role boundaries against the engine generation you intend to operate.