Tableau

Sifflet connects to your Tableau site to show which dashboards, sheets, and data sources depend on the tables you monitor in your data warehouse. When an incident affects an upstream table, you see right away which Tableau dashboards are impacted and how often they are viewed, and from any dashboard you can trace its data back to the warehouse tables that feed it. With the Sifflet Insights browser extension, Tableau users see this data quality status directly in Tableau.

See Tableau Collected Data for the full list of assets and metadata Sifflet imports.

Permissions Required

Sifflet authenticates to Tableau with a personal access token (PAT). The token has the permissions of the Tableau user who creates it. Sifflet only reads metadata, through the Tableau Metadata API (GraphQL) and the usage statistics of your dashboards, and never modifies your Tableau content.

The Site Administrator Explorer role grants read and write access to the site: Tableau has no read-only role that exposes the full metadata. Sifflet needs it because the Metadata API hides the names and lineage of content the user can't access, and returns null instead, which leads to incomplete lineage in Sifflet. Sifflet only sends read queries.

API load: at each refresh, Sifflet runs Metadata API queries and reads the usage statistics of your dashboards. Sifflet refreshes BI sources weekly by default to limit this load.

Requirements

Required Roles for Setup

• In Tableau: a user with the Site Administrator Explorer site role (or Server Administrator), to create the personal access token Sifflet uses. On Tableau Server, a server administrator with access to the TSM command line, to enable the Metadata API.
• In Sifflet: the Admin role to create the credential, and the Admin or Editor role to create the source.

Supported Versions and Editions

Sifflet supports:

• Tableau Cloud
• Tableau Server 2019.3 or later (the first version that includes the Metadata API)

Both variants use the same permissions and the same connection steps. The only difference is that Tableau Server requires you to enable the Metadata API.

Each Sifflet source connects to one Tableau site. To catalog several sites, create one source per site.

Network Access

• Tableau Cloud: Tableau Cloud is a SaaS service: Sifflet connects to it over the internet.
• Tableau Server: Sifflet connects to your Tableau Server over HTTPS from the internet, so its endpoint must be reachable from the public internet.
• IP allowlisting: if you restrict inbound traffic to your Tableau Server (firewall rules) or use IP filtering on Tableau Cloud, allow the IP addresses of your Sifflet instance, listed in Settings > Integration Preferences.

Other Prerequisites

• On Tableau Server, the Metadata API must be enabled (see Step 1). It is always enabled on Tableau Cloud.
• To see lineage from Tableau to your data warehouse, add the warehouse tables to Sifflet first through their own source. See Lineage.

Connect Sifflet to Tableau

Step 1: Create a Personal Access Token in Tableau

Tableau Server Only: Enable the Metadata API

The Metadata API is installed with Tableau Server but disabled by default. To enable it, run the following command on the Tableau Server node, as described in Tableau's documentation:

tsm maintenance metadata-services enable

This command restarts Tableau Server, and Tableau Server then indexes your content, which can take a while on large sites.

Create the Personal Access Token

1. Sign in to Tableau with a user that has the Site Administrator Explorer site role (or Server Administrator). Ask your Tableau administrator to create a dedicated user for Sifflet if needed.

2. Click your profile picture and select My Account Settings.

3. In the Settings tab, find the Personal Access Tokens section.

   

4. Enter a token name (for example sifflet) and click Create new token.

5. Copy the Token Name and the Token Secret.

   

⚠️ Tableau shows the token secret only once. Store it somewhere safe.

The token expires after a period set by your Tableau administrator (one year by default, see Tableau's documentation), and Tableau also revokes tokens that aren't used for 15 consecutive days. Before it expires, create a new token and update the Sifflet credential in Integrations > Credentials.

You now have the token name and token secret needed for step 2.

Step 2: Add the Tableau Source in Sifflet

1. Create the credential: in Integrations > Credentials, click New credential, enter a name, and paste the following JSON, replacing the placeholders with the token name and token secret:

   JSON

   {"user": "<TOKEN_NAME>", "password": "<TOKEN_SECRET>"}

   

   ⚠️ Use the JSON format above, with both the user and password keys. Pasting the token secret alone doesn't work.

2. Create the source: in Integrations > Sources, click New source, select Tableau, and fill in the following fields:

   Field	Description	Example
   Source name	A name for the source in Sifflet	Tableau
   Site	The site ID (content URL) of your Tableau site, as shown in the Tableau URL after /site/. Leave empty if you use the Default site of Tableau Server.	sitename123
   Host	The URL of your Tableau Cloud pod or Tableau Server, with https:// and without a trailing slash or path	https://dub01.online.tableau.com
   Credential	The credential you created above	tableau-pat

   To find the site and host, sign in to Tableau and look at the URL:

   • If the URL looks like https://dub01.online.tableau.com/#/site/sitename123/home, the host is https://dub01.online.tableau.com and the site is sitename123.
   • If the URL looks like https://tableau.example.com/#/home (no /site/ part), you use the Default site: the host is https://tableau.example.com and the site is empty.

3. Scope: Sifflet catalogs all the content of the site that the token's user can access. There is no project selection. See Integrations Management for the refresh frequency and the other generic source settings.

4. Test and save: click Test to check that Sifflet can sign in to Tableau and read the database connections through the Metadata API. If the test fails or returns warnings, click Display report to see the details. Then click Save & Run. Sifflet starts a first refresh: follow its status and logs in the source details (click the source name in Integrations > Sources). Tableau assets appear in the Data Catalog when the refresh completes.

Troubleshooting

See Tableau Troubleshooting for sign-in errors, permission issues, and null names in the lineage.