PostgreSQL

Scan PostgreSQL tables with detector-ready row sampling.

Category: Databases
Source type: POSTGRESQL
Produces: table
Links: PostgreSQLProduct Creating a read-only role (CREATE ROLE)Credentials SSL / TLS connection modesReference

PostgreSQL is the open-source relational database behind a large share of application backends — and, in practice, behind a large share of the personal data an organisation holds. Connect it and Classifyre inspects the real contents of your tables, not just their column names.

What you need to connect

A host and port, and a database user. Read access is enough — give it a role with CONNECT on the database and SELECT on the schemas you want scanned, and nothing can be modified even by accident.

Managed PostgreSQL (Amazon RDS and Aurora, Azure Database for PostgreSQL, Google Cloud SQL, Supabase, Neon) connects like any other host. Set the SSL mode your provider requires — most managed services expect require or stricter.

What Classifyre reads

Tables and views, across one database or every database the user can see. You can scope the scan tightly: pick a single database, allow or deny specific schemas, list exact tables, or cap how many tables a scan will take.

Shared behaviour · SQL databases

One asset per table or view, never one per row. The asset carries the table's structure — database, schema, table name, object type, its columns and their types, and a row-count estimate — and its content is a sample of real rows, formatted so a detector reads actual values rather than a schema dump.

How many rows, and which ones, is entirely up to the sampling strategy. Large tables are paged through by key rather than by OFFSET, so a scan that stops halfway can resume from where it left off instead of re-reading from the top.

Read-only throughout. The connector issues catalog queries and bounded SELECTs. Nothing is written back, and a read-only account is the right account to give it.

Relationships come out of the engine's own catalog: foreign keys are recorded as REFERENCE links — useful, but they move no data, so they never become a lineage hop, and a view and the tables it reads from are recorded as FLOW — real lineage, with column-level detail parsed out of the view's SQL where the SQL makes that possible. See Lineage.

Metadata on every asset

Asset kind · table

Field	Type	Always present	What it is
database	string	Yes	Database or catalog name
table_name	string	Yes	Table name
table_type	string	Yes	Object type (TABLE/VIEW)
schema	string	No	Schema name
columns	object[]	No	Columns as {name, type} objects
row_count	integer	No	Estimated number of rows

Lineage

PostgreSQL’s catalog knows what every view is built from, so each view and its base tables are recorded as real lineage — with column-level detail where the view’s SQL names its columns. Foreign keys are recorded too, as references rather than lineage: they suggest where data is related, but no data moves along them.

A view that reads from a schema outside the scan’s scope still produces an edge. It’s held against the table’s platform name and completes itself if that schema is ever scanned — see Lineage & Relationships.

Worth knowing

include_all_databases needs a maintenance database. To enumerate every database, Classifyre first connects to one it can list from — postgres by default. Change it if that database doesn’t exist in your cluster.
System schemas are skipped automatically, so pg_catalog and information_schema never produce assets.
Row-count estimates come from the planner’s statistics rather than a COUNT(*), so a huge table costs nothing to describe.

Configuration

Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.

Required

Without these, the source will not save.

Field	Type	Required	What it does	Default
required	object	Yes	—no extra properties	—
host	string	Yes	PostgreSQL host	localhost
port	integer	Yes	PostgreSQL portmin 1, max 65535	5432

Secrets

Stored encrypted and never shown again after you save them. See Configuration & Fields.

Field	Type	Required	What it does	Default
masked	object	Yes	—no extra properties	—
password	string	Yes	Database password	—
username	string	Yes	Database username	—

Optional

Everything you can tune. Sensible defaults apply when you leave them alone.

Field	Type	Required	What it does	Default
optional	object	No	—no extra properties	—
connection	object	No	Connection tuning and SSL behavior.no extra properties	—
connection.connect_timeout_seconds	integer	No	Connection timeout in secondsmin 1, max 120	10
connection.ssl_mode	enum	No	SSL mode for PostgreSQL connection Allowed: disable, allow, prefer, require, verify-ca, verify-full	prefer
scope	object	No	Database, schema, and table selection scope.no extra properties	—
scope.database	string	No	Single database to scan (optional when include_all_databases is true)	—
scope.exclude_schemas	array	No	Schema denylist (exact schema names)	["information_schema","pg_catalog","pg_toast"]
scope.exclude_schemas[]	string	No	—	—
scope.include_all_databases	boolean	No	Scan all non-template databases visible to this user	false
scope.include_schemas	array	No	Optional schema allowlist (exact schema names)	—
scope.include_schemas[]	string	No	—	—
scope.include_tables	array	No	Optional table allowlist. Accepted forms: schema.table or database.schema.table	—
scope.include_tables[]	string	No	—	—
scope.maintenance_database	string	No	Database used for database enumeration when include_all_databases is true	postgres
scope.table_limit	integer	No	Optional cap on number of table assets extractedmin 1	—