Tableau

Tableau is a leading data visualization and business intelligence platform for building interactive dashboards, reports, and data analyses. The Glean Tableau connector indexes workbook and data source metadata into Glean for permission-aware search and AI assistance, so teams can discover relevant analytics assets without leaving Glean.

Supported features

The connector enables central ingestion and permission-aware search across your Tableau site, including workbooks and data sources. Each user authenticates individually so Glean enforces the same content visibility as Tableau itself.

• Workbook indexing: Crawls Tableau workbook metadata including name, description, project, owner, sheet count, and timestamps.
• Data source indexing: Crawls published Tableau data source metadata including name, database name, type, owner, and connected workbook count.
• Per-user permission enforcement: Each Glean user authenticates individually with their own Tableau Personal Access Token. Glean evaluates per-user visibility at query time so users only see content they can access in Tableau.
• Incremental crawls: Supports incremental crawls using updatedAt timestamp filtering, fetching only content modified since the last crawl cycle. Runs approximately every 45 minutes by default.
• Full crawls: Periodic full crawls re-enumerate all workbooks and data sources. Runs approximately every 24 hours by default.
• Webhook-driven updates: Automatically registers webhooks in Tableau for workbook and data source create, update, and delete events, enabling near-real-time sync.
• Identity crawling: Crawls Tableau users and site roles. Unlicensed users are crawled but marked as inactive. Admin users are grouped into a synthetic admin group with access to all content.
• Multiple instances: Supports connecting multiple Tableau sites to a single Glean deployment.
• Tableau Online and Server: The connector works with both Tableau Online and Tableau Server using the same REST API and authentication flow.
• API usage: Glean uses the Tableau Server REST API (default version 3.16) to ingest all data.

Supported objects

The connector indexes metadata for core Tableau content types — workbooks and data sources — along with user identity and site role information. Actual dashboard visuals, data, and workbook content are not crawled.

• Workbooks: Workbook name, description, content URL, project, owner (name and email), sheet count, size, createdAt, and updatedAt.
• Data sources: Data source name, database name, content URL, type, published status, connected workbook count, project, owner (name and email), size, createdAt, and updatedAt.
• Users: Email, full name, site role, auth setting, external auth user ID, last login, and active/inactive status.
• Groups: A synthetic "AdminGroup" containing users with site roles: ServerAdministrator, SiteAdministratorCreator, or SiteAdministratorExplorer.

API endpoints

Glean uses the Tableau Server REST API (default version 3.16). This API is used to authenticate, crawl content and identity data, and register webhooks for near-real-time updates. The same API is used for both Tableau Online and Tableau Server.

Endpoint	Description
POST /api/{version}/auth/signin	Authenticate using Personal Access Token credentials
GET /api/{version}/sites/{siteId}/users	List all users on the site
GET /api/{version}/sites/{siteId}/users/{userId}	Get a specific user's details
GET /api/{version}/sites/{siteId}/workbooks	List all workbooks
GET /api/{version}/sites/{siteId}/datasources	List all data sources
GET /api/{version}/sites/{siteId}/datasources/{datasourceId}	Get a specific data source's details (used to fetch webpageUrl)
GET /api/{version}/sites/{siteId}/webhooks	List all registered webhooks
POST /api/{version}/sites/{siteId}/webhooks	Create a new webhook

The default API version is 3.16. This is configurable but other versions are not guaranteed to be compatible.

Webhook events

Glean automatically registers webhooks in Tableau to capture workbook and data source create, update, and delete events in near-real-time.

Webhook events are:

Event	Description
WorkbookCreated	A new workbook is published
WorkbookUpdated	An existing workbook is modified
WorkbookDeleted	A workbook is deleted
DatasourceCreated	A new data source is published
DatasourceUpdated	An existing data source is modified
DatasourceDeleted	A data source is deleted

Limitations

The connector indexes metadata only — workbook content, dashboard visuals, thumbnails, and data are not rendered in Glean. Only workbooks and data sources are supported; views and other Tableau content types such as flows, metrics, and data stories are not crawled.

• Glean only indexes metadata for workbooks and data sources (name, description, owner, project, timestamps). Actual workbook content, dashboard visuals, and data aren't crawled or rendered in Glean.
• The connector does not crawl views, flows, metrics, data stories, or other Tableau content types — only workbooks and data sources.
• Thumbnails and preview images are not indexed.
• The fields=_all_ query parameter causes 500 errors on the /datasources and /workbooks endpoints, so specific field lists are used instead. This means some non-default fields may not be captured.
• Users with the Unlicensed site role are crawled for ownership attribution but cannot log in to Tableau or authenticate in Glean.
• The API version defaults to 3.16. Other versions have not been QA-tested and may not be compatible.
• There are no greenlist (inclusion) or redlist (exclusion) filters. All workbooks and data sources accessible to the admin token are indexed.
• Per-user token refresh runs approximately every 10 minutes. If a user's PAT expires or is revoked, their Tableau results will stop appearing until they re-authenticate.

Requirements

Review the following permission, credential, and technical requirements before setting up the Tableau connector.

Permission requirements

• The authorizing user must have one of the following Tableau site roles: Server Administrator, Site Administrator Creator, or Site Administrator Explorer. These roles grant access to all content on the site.
• The admin account must have permission to create personal access tokens under My Account Settings > Personal Access Tokens.
• Each end user who wants to see Tableau results in Glean must create their own personal access token. Users without a valid token will not see Tableau content in search results.

Credential requirements

Gather the following values before starting the setup.

• Domain — your Tableau instance domain (for example, abc.tableau.com). Found in your browser address bar when logged in to Tableau.
• Site content URL — the site identifier from your Tableau URL, in the format https://<domain>/#/site/<site_content_URL>/home. Leave empty if you are on the default site.
• Personal access token name — created in Tableau under My Account Settings > Personal Access Tokens.
• Personal access token secret — displayed once at creation time. Save it securely.
• Webhook base URL — pre-populated in the Glean Admin Console. Verify that it is correct.

The following credentials are generated and managed automatically by Glean. You do not need to provide these.

• Site credentials token — session token obtained by signing in with the personal access token. Refreshed every 30 minutes.
• Site ID — stored on first successful authentication.
• Per-user credentials tokens — obtained for each authenticated user via their personal access token. Refreshed on a configurable schedule.

Technical requirements

• Glean must be able to reach your Tableau instance domain over HTTPS at the REST API base URL (https://<domain>/api/<version>/).
• The webhook base URL must be reachable by Tableau so it can deliver event notifications for workbook and data source changes.
• The Tableau REST API version is configurable via apiVersion in the instance configuration.
• Glean paginates API responses at 100 items per page.

Setup and configuration instructions

Determine the domain and site content URL in Tableau

1. Determine the domain and site content URL of your Tableau instance:
   1. Log in to your Tableau instance and navigate to the homepage.
   2. Copy the full URL in your browser address bar. It should have the following format:
      https://<domain>/#/site/<site_content_URL>/home
   3. Enter the site domain (for example, abc.tableau.com) and site content URL (for example, 1234567890) values into their respective input boxes on the setup page in the Glean console.
   • If you are on the default site (for example, the URL looks like https://<domain>/#/site/#/home), leave site_content_URL empty.
   4. The input box for the webhook base URL on the setup page in the Glean console will be populated. Verify that it looks correct.
2. Generate a Personal Access Token (PAT):
   1. In Tableau, navigate to your profile icon in the top right and then dropdown to My Account Settings.
   2. Navigate to the Personal Access Tokens section of the Settings tab.

3. Give a Token name and click on Create Token. Save the token. It is displayed only once in the Tableau UI.
4. Enter the token name and the token secret into their respective input boxes on the setup page in the deployment console.
5. Click Save in Glean.

note

To connect additional Tableau sites, contact the Glean engineer helping with your deployment.

Authenticate users to access Tableau search results in Glean

1. Log in to Glean and click on your profile in the upper right. Navigate to Your Settings in the profile dropdown menu.
2. Under Your account on the left, navigate to Apps.
3. There should be a tab for Tableau. Click on this tab.
4. Follow the onscreen instructions to provide your Personal Access Token information. Then save those credentials to Glean.
5. You can remove your credentials at any time to disable access.
6. If there are multiple Tableau instances, you must provide credentials for them individually in the same settings page.

Content configuration

The Tableau connector does not currently support greenlist (inclusion) or redlist (exclusion) rules. All workbooks and data sources accessible via the admin Personal Access Token are indexed.

Content visibility is controlled by:

• Per-user authentication: Each user must provide their own PAT. Only content visible to that user in Tableau appears in their Glean search results.
• Admin group: Users with ServerAdministrator, SiteAdministratorCreator, or SiteAdministratorExplorer roles automatically have access to all indexed content.
• Content ownership: Content owners always retain access to their own workbooks and data sources.

note

There are no per-workbook, per-data source, or per-project inclusion/exclusion filters available for the Tableau connector.

Troubleshooting

Re-check the setup page in the Glean console. The domain and webhook base URL must be filled in, and the site content URL field must be present (you can leave it empty if you are on the default site, but the field itself cannot be removed). The webhook base URL auto-populates — verify it wasn't cleared.

This usually means the personal access token (PAT) name or secret is incorrect or expired, or the domain is wrong. The token secret is shown only once in Tableau, so if you are unsure it was copied correctly, generate a new PAT and re-enter the name and secret. Confirm the domain matches your Tableau instance (for example, abc.tableau.com).

The authorizing account does not have a sufficient site role. The PAT must belong to an account with the Server Administrator, Site Administrator Creator, or Site Administrator Explorer site role so Glean can enumerate users and content across the site.

The user's personal access token has likely expired or been revoked. When a per-user token fails to sign in, Glean removes it and stops retrying. The user must re-add a valid PAT under Your Settings > Apps > Tableau. Tableau also expires PATs that go unused for a period, so users who query Tableau infrequently may need to refresh their token.

Glean requests a specific set of fields from the /workbooks and /datasources endpoints rather than all fields, because requesting all fields triggers a 500 error from the Tableau REST API. As a result, some non-default fields are not captured. Thumbnails, preview images, dashboard visuals, and underlying data are never indexed.

FAQs

Each user must connect their own Tableau personal access token before Tableau content appears in their search results. Open Your Settings > Apps > Tableau in Glean and follow the prompts to add your PAT.

No. The connector is read-only and indexes metadata only. It reads workbook and data source metadata along with user and permission information, and registers webhooks for change notifications. It never creates, modifies, or deletes content in Tableau.

Metadata for workbooks and data sources (such as name, description, owner, project, and timestamps), plus user identity and site role information. Dashboard visuals, workbook content, thumbnails, and underlying data are not indexed. Views, flows, metrics, data stories, and other content types are not crawled.

Both Tableau Cloud (Online) and Tableau Server (on-premises). The connector uses the same REST API and authentication flow for both.

Yes. To connect additional Tableau sites, contact the Glean engineer helping with your deployment. Each user who wants results from multiple instances provides credentials for each one on the same settings page.

There are no greenlist (inclusion) or redlist (exclusion) filters — everything accessible to the admin token is indexed. You can, however, limit which users receive Tableau search results; ask your Glean representative how this is configured for your instance.

Workbook and data source create, update, and delete events are picked up in near-real-time through webhooks. Everything else refreshes on scheduled crawls — incremental crawls run approximately every 45 minutes and full crawls approximately every 24 hours by default.