> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pavoai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tableau Integration

> One-time setup to let Pavo securely read your published Tableau data sources.

## 1. Overview

This document walks you through the one-time setup required on your Tableau site so Pavo AI can securely ingest data from your published Tableau data sources.

Pavoai connects to your Tableau site via Tableau's REST API and VizQL Data Service (VDS) to read metadata and row-level data from published data sources you authorize.

There are two supported authentication methods. **Choose one** based on your environment:

|                             | **Personal Access Token (PAT)**         | **Connected App + JWT *(recommended for production)*** |
| --------------------------- | --------------------------------------- | ------------------------------------------------------ |
| Best for                    | Trials, POCs, single-team use           | Production, multi-tenant, enterprise                   |
| Tied to a human user        | Yes — breaks if the user is deactivated | No — tied to the application                           |
| SSO-compatible              | Yes                                     | Yes                                                    |
| Supports user impersonation | No                                      | Yes (honors row-level security per user)               |
| Scoped permissions          | No (inherits full user permissions)     | Yes (per-action scopes)                                |
| Setup effort                | \~5 minutes                             | \~10 minutes                                           |

**Connected App** is the PAVO recommended Approach.

## 2. Prerequisites

Regardless of method, confirm the following before starting:

* You have **Site Administrator** role on the Tableau site you want Pavoai to connect to.
* You know your site's **pod URL** (e.g. [https://10ax.online.tableau.com](https://10ax.online.tableau.com)) and **site content URL** (the value after /site/ in your site URL — for the default site on Tableau Server, this is empty).
* You have identified the data source(s) you want Pavoai to access. These must be **published data sources** (data sources embedded inside workbooks are not supported).
* Your Tableau site is on a version that supports VizQL Data Service:
  * **Tableau Cloud:** supported (generally available).
  * **Tableau Server:** version **2025.1 or later** required.

## 3. Create a service user and grant data source access

These steps apply to **both** authentication methods. Complete this section before proceeding to Option A or Option B.

### 3.1 Create a dedicated service user

Pavoai should authenticate as a dedicated service account rather than an individual employee. This prevents access breaking if the employee leaves or changes roles.

1. **Users** (left navigation) → **Add Users** → **Add Users by Email**.
2. Create a user with an email like [tableau-pavoai@yourcompany.com](mailto:tableau-pavoai@yourcompany.com) (use a shared mailbox or group alias).
3. Assign the site role **Explorer (can publish)** or higher.
4. Grant this user access (direct or via group) to the projects and data sources Pavoai should be able to read.
5. Sign in as this user once to activate the account.

### 3.2 Grant API Access to the data sources

This step is commonly missed and will cause 403 errors if skipped.

For **each published data source** Pavoai should access:

1. Navigate to the data source in Tableau.
2. Click **Actions** → **Permissions**.
3. Add the service user (or the group containing it).
4. Ensure the **API Access** capability is set to **Allowed**.
5. Click **Save**.

## 4. Option A \[Recommended] — Connected App with Direct Trust (JWT)

### 4.1 Create the Connected App

1. Sign in as a Site Administrator.
2. **Settings** (left navigation) → **Connected Apps** tab.
3. Click the **New Connected App** dropdown → **Direct Trust**.
4. In the dialog:
   * **Connected app name:** Pavoai
   * **Access level / Applies to:** select either *All projects* or the specific projects Pavoai should access (recommended: limit to a dedicated project).
   * **Domain allowlist:** leave as **All domains** (this setting applies only to embedded content, not REST/VDS API calls).
5. Click **Create**.

### 4.2 Generate the secret

1. Click into the newly created Pavoai connected app.
2. Click **Generate New Secret**.
3. You will see:
   * **Secret ID** — a UUID (always visible).
   * **Secret Value** — click the eye icon to reveal. **Copy this value immediately to a password manager.** The value is displayed once and cannot be retrieved afterward.
4. Also copy the **Client ID** shown further down the page.

### 4.3 Enable the Connected App

Connected Apps are created in a disabled state.

1. On the Connected App detail page, click the **⋯** (three-dots menu) next to the app name.
2. Select **Enable**.
3. Confirm the Status field now reads **Enabled**.

### 4.4 Identify the user(s) Pavoai will impersonate

Unlike a PAT, a Connected App does not log in *as the app* — each JWT specifies which Tableau user to act as (the sub claim). Pavoai will impersonate this user, and will inherit all of that user's permissions including row-level security.

Recommended: use the dedicated service user created in **Section 3.1**. Ensure that user has been granted **API Access** on the relevant data sources per **Section 3.2**.

If your use case requires Pavoai to act as multiple users (e.g. for per-user RLS enforcement), please coordinate with the Pavoai team — we will guide you on the user-mapping configuration.

### 4.5 Values to send to Pavoai

Send the following values via the secure channel described in **Section 6**:

| Key                 | Example                                                                 | Notes                                                   |
| ------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------- |
| server\_url         | [https://10ax.online.tableau.com](https://10ax.online.tableau.com)      | Pod URL only — no trailing path                         |
| site\_content\_url  | acme-corp                                                               | Value after /site/ in your site URL                     |
| auth\_method        | connected\_app                                                          |                                                         |
| client\_id          | 4debb167-6c2b-4cbe-b816-f5b55275d36a                                    | From step 4.2                                           |
| secret\_id          | 1d6da00d-9a3c-4eb2-b742-1712463f7f05                                    | From step 4.2                                           |
| secret\_value       | *(redacted)*                                                            | From step 4.2 — handle as a password                    |
| impersonation\_user | [tableau-pavoai@yourcompany.com](mailto:tableau-pavoai@yourcompany.com) | Username/email of the user Pavoai will act as (see 4.4) |

Skip To section 6

## 5. Option B \[NOT Recommended] — Personal Access Token (PAT)

### 5.1 Enable PAT creation on the site

On Tableau Cloud sites activated after June 2023, PAT creation is disabled by default. Enable it first:

1. Sign in to your Tableau site as a Site Administrator.
2. In the left navigation, click **Settings**.
3. On the **General** tab, scroll to the **Personal Access Tokens** section.
4. Check **Enable personal access tokens**.
5. Under **Applies to**, select either *All users* or a specific group (a dedicated group for service accounts is recommended).
6. Under **Set expiration period**, select **180 days** (or your organization's standard).
7. Click **Save** at the bottom of the page.

### 5.2 Create the PAT

Signed in as the **service user created in Section 3.1** (not the admin user):

1. Click the profile icon (top right) → **My Account Settings**.
2. Scroll to the **Personal Access Tokens** section.
3. Enter a token name (e.g. pavoai-prod).
4. Click **Create Token**.
5. **Copy the Token Secret immediately.** It is displayed only once. If lost, you must create a new token.
6. Click **Done**.

### 5.3 Values to send to Pavoai

Send the following six values via the secure channel described in **Section 6**:

| Key                  | Example                                                                 | Notes                                                                     |
| -------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| server\_url          | [https://10ax.online.tableau.com](https://10ax.online.tableau.com)      | Pod URL only — no trailing path                                           |
| site\_content\_url   | acme-corp                                                               | Value after /site/ in your site URL; empty string for default Server site |
| auth\_method         | pat                                                                     |                                                                           |
| pat\_name            | pavoai-prod                                                             | The name you entered in step 5.2                                          |
| pat\_secret          | *(redacted)*                                                            | The one-time secret from step 5.2                                         |
| service\_user\_email | [tableau-pavoai@yourcompany.com](mailto:tableau-pavoai@yourcompany.com) | For our records and audit trail                                           |

## 6. How to send credentials to Pavoai

**Do not send the Token Secret or Connected App Secret Value by email or unencrypted chat.**

Use one of the following:

* **1Password / LastPass / Bitwarden shared vault** (preferred). Pavoai can provide an item to share into.
* Directly onboard the connector yourself if you have access to pavo's instance.

The non-secret values (server URL, site content URL, client ID, secret ID, user email) can be sent in plain channels.

## 7. Verification

Once Pavoai has received your credentials, we will run a connectivity test that:

1. Authenticates against your Tableau site.
2. Lists the projects and data sources visible to the configured user.
3. Fetches metadata (field names and types) from one data source you nominate.
4. Reads a small sample (≤100 rows) from that data source.

We will share the results with you for sign-off before enabling any production ingestion.

<Note>
  **Pavo is read only by design.** Pavoai requests only read scopes (tableau:content:read, tableau:viz\_data\_source:read) in every JWT. No write, delete, or admin scopes are ever requested. You can verify this in your Tableau audit log, and you can further enforce it by assigning the service user (Section 3.1) a **Viewer** or **Explorer** site role — neither of which permits modification of published data sources.
</Note>