Tableau Lineage Scanner
Scanned and supported objects
|
While we strive for comprehensive lineage capture, certain dataflows and transformations might be incomplete or unavailable due to technical constraints. We continuously work to expand coverage and accuracy. |
Supported versions
The scanner supports Tableau Cloud and Tableau Server. It requires the Tableau Metadata API. On Tableau Server, metadata services must be enabled.
By default, the scanner uses version 3.22 of the Tableau REST API.
Scanned resources
The extracted metadata includes the following objects:
-
Site: Name, ID.
-
Project: Name, ID.
-
Workbooks: Name, ID, URI.
-
Data source: Name, ID, container name, description. Includes embedded and published data sources. A published data source used by several workbooks is extracted once.
-
Fields: Name, ID, qualified name, description. Includes fields directly defined within the sheet and those belonging to another entity.
-
Calculated fields: Formula, list of fields that it is derived from.
-
Column fields: Fully qualified name, list of database columns the field is mapped to.
-
-
-
Sheets: Name, ID, path. Includes fields referenced on the sheet.
-
Dashboard: Name, ID. Includes fields referenced on the dashboard and lineage between the dashboard and sheets referenced from it. For each column field in a workbook, information about the database, tables, and columns they are mapped to is also retrieved.
-
Databases: Name, ID, connection type.
-
Tables: Name, ID, connection type.
-
Columns: Name, ID.
-
-
-
Custom SQL queries: Database columns used in the query. Lineage goes directly from these columns to the Tableau fields; the query itself isn’t kept as an asset.
-
Supported connectivity
-
Connector type: REST API and Metadata API (GraphQL).
-
Authentication method: Personal access token (PAT) or a connected app with direct trust (JSON Web Token).
Metadata API requests that fail with a transient or gateway error are retried automatically.
Tableau permissions
In Tableau, the following permissions must be configured for the user you are authenticating with:
-
You need:
-
Permission to call the Tableau Metadata API. See the official Tableau documentation.
-
At least the Viewer site role. With the Viewer role, the scan might be incomplete, so we recommend Explorer or Administrator.
-
-
You can only retrieve assets (such as projects, workbooks, data sources) if you have View capabilities or higher assigned on them. For details, see the official Tableau documentation: View capabilities.
-
You have a valid Personal Access Token or you have set up a Connected App.
Scanner configuration
All fields marked with an asterisk (*) are mandatory.
| Property | Description |
|---|---|
|
Identifies the source type to be scanned.
Must be set to |
|
A human-readable description of the scan. |
|
List of Ataccama ONE connection names for future automatic pairing. |
|
URL of your Tableau Server or Tableau Cloud pod. For example:
|
|
Content URL of the site you want to scan.
For example, if your URL is |
|
Name of the personal access token. Required for PAT authentication. For instructions about how to create tokens, see the official Tableau documentation: Personal Access Tokens. |
|
Secret of the personal access token. Required for PAT authentication. |
|
Secret value of the connected app.
When set, the scanner signs in with a JSON Web Token instead of a personal access token.
|
|
Secret ID of the connected app. |
|
Client ID of the connected app. |
|
Tableau user the scanner signs in as when using the connected app. |
|
Version of the API to perform REST and GraphQL calls.
Default value: |
|
Path where the sign-in REST request is performed.
Default value: |
|
Path of the Metadata API (GraphQL) endpoint.
Default value: |
|
List of project names to scan. If omitted, all projects are scanned. |
|
List of workbook names to scan. If omitted, all workbooks are scanned. When both |
|
Maximum number of entity IDs sent in a single Metadata API request.
Default value: |
|
Version of ONE that the lineage asset names are created for. Set it to the version of your ONE so that lineage assets can be matched to catalog items. See Asset naming and catalog matching. Supported values: |
|
Optional TLS configuration for connecting to a Tableau Server that uses certificates not trusted by default.
Contains |
{
"scannerConfigs": [
{
"sourceType": "TABLEAU",
"description": "Scan Tableau platform",
"oneConnections": [
"Tableau connection",
"Other Tableau connection"
],
"inputDataCatalogFilePath": null,
"serverUri": "https://prod-useast-b.online.tableau.com",
"site": "asite",
"tokenName": "@@ref:ata:[TABLEAU_TOKEN_NAME]",
"accessToken": "@@ref:ata:[TABLEAU_ACCESS_TOKEN]",
"projects": ["Sales"],
"targetOneVersion": "17.2.0"
}
]
}Asset naming and catalog matching
Lineage assets are matched to Tableau catalog items in ONE by name, and targetOneVersion controls how the scanner names them:
-
With
17.1.0or17.2.0, data source, sheet, and dashboard assets get their plain Tableau names, the same as the catalog items. The object type, including whether a data source is published or embedded, is kept in the asset’s external object type and tells apart assets that share a name. -
With any other supported version, the object type is part of the asset name, for example,
SHEET Sales overvieworOrders.PDS. These names don’t match the catalog items, so the assets can’t be matched to them.
Use the same targetOneVersion for every scan of a scan plan.
Changing it renames the assets in the next scan.
Runtime configuration
You can pass runtime properties to the scanner in the runtimeConfig section of the scan plan.
The section is placed at the top level of the scan plan, next to scannerConfigs, and is not part of the scanner configuration itself.
| Property | Description |
|---|---|
|
List of runtime properties, each defined as a |
|
Initial memory (heap size) of the scanner, for example |
|
Maximum memory (heap size) of the scanner, for example |
Was this page useful?