Provisa / Provisa and Hasura
Provisa took the Hasura v2 idea further.
Hasura DDN is centred on instant, per-role GraphQL APIs over your own databases, metadata-driven, with a connector-per-source model for federation. Provisa shares that core idea and extends it with more languages, more protocols, federation defined in the model and run on the engine you choose, and governance that holds identically on every entry point. Bring your Hasura v2 metadata, and the converter reads it and writes a Provisa config in one command.
One command
# Read a Hasura v2 metadata directory, write a Provisa config
python -m provisa.hasura_v2 ./hasura/metadata -o provisa.yaml
# Validate without writing, map schemas onto domains, override connections
python -m provisa.hasura_v2 ./hasura/metadata --dry-run
python -m provisa.hasura_v2 ./hasura/metadata --domain-map public=sales billing=financeSources, tables, row permissions, relationships, remote schemas, actions and event triggers all convert. Roles and rate limits come across as Provisa roles. Anything that doesn't map cleanly becomes a warning, so you get a list to work through and no silent gaps.
Where each fits
| You need to… | Hasura DDN | Provisa |
|---|---|---|
| Instant per-role GraphQL API over a relational database | ✓ Metadata-driven; per-role schemas; cursor pagination; aggregates; subscriptions; JSON:API | ✓ Same, from the same declarative config; import from Hasura v2 metadata in one command |
| One API for an app backend over sources that don't match | ✓ Connector per source; cross-connector joins assembled in the DDN engine from each connector's results | ✓ Cross-source joins run in the engine you choose (Trino, DuckDB, Postgres) with statistics and spill-to-disk for large joins |
| Ask graph or path questions over relationships | GraphQL over relational sources; no Cypher query path | ✓ Cypher first-class; relationships are registered and governed in the model, traversable from any protocol |
| SQL, pgwire or Arrow Flight alongside GraphQL | GraphQL and JSON:API; JDBC via an additional connector | ✓ pgwire, Bolt, Arrow Flight, gRPC, REST, WebSocket, Airport and MCP alongside GraphQL, all on the same model and policy |
| Give AI agents governed access | PromptQL (natural-language AI layer, cloud-hosted) | ✓ MCP server; the OAuth token maps to a role and inherits the same six access-control layers as a person |
| Analytics over many sources at scale | Aggregates per connector; cross-connector joins held in the engine's memory with a response-size limit | ✓ The engine you choose runs the join with statistics; DuckDB and Postgres joins can spill to disk |
| Change data sources or engines without rewriting queries | Connector and NDC metadata per source; supergraph rebuild on each change | ✓ Portable declarative config in git; engine swappable; compiled SQL is yours to read and export |
| Run entirely off-network or air-gapped | Private DDN Self-Hosted (enterprise license, Kubernetes cluster required) | ✓ pip install "provisa[embedded]": one wheel, desktop installer or Helm; no enterprise license gating the self-hosted path |
Use them together
If you already run Hasura DDN for your application's GraphQL API, Provisa can provide the governed semantic layer underneath it, or alongside it for the queries that go beyond what the connector model covers. Your Hasura permissions and connectors stay in place.
They complement each other most directly when Hasura handles the immediate app API with its DDN supergraph and Provisa handles the SQL analytics layer, the graph traversals and the MCP connection that agents use. Both draw from the same underlying databases.
What you keep coming from Hasura v2
A per-role API over your database, generated from metadata, with permissions enforced at query time. Per-role schemas, field-level visibility, cursor pagination, aggregates and Apollo Automatic Persisted Queries all carry across. You have no new modeling universe to learn, and you don't pay for the move with a rewrite.
If you only need Hasura DDN
Your application speaks GraphQL. Your data lives in relational databases you own. You want a metadata-driven connector-per-source model with lambda functions for custom logic, and PromptQL handles the AI access your team needs. Hasura DDN covers that well on its own.
If you only need Provisa
Your consumers are not only GraphQL clients. You need Cypher, SQL, or pgwire on the same governed model. Cross-source analytics runs at a scale where join statistics and spill-to-disk matter. You need to run entirely off-network without an enterprise license gating the self-hosted path. Or you're migrating from Hasura v2 and want a single conversion rather than a DDN supergraph rebuild.