Salesforce Docs Portal

How Permissions Work


Tableau Cloud and Tableau Server provide a space for accessing and managing published content. Beginning with version 2019.3, using the Tableau Metadata API, you have the ability to track and manage metadata and lineage of external assets used by the content published to your Tableau Cloud site or Tableau Server.

In addition, when your Tableau Cloud site or Tableau Server has Data Management, you have access to features like data quality warnings, which are enabled by Tableau Catalog [↗].

In this section

Tableau Catalog indexes content, assets, and metadata

Metadata API contains indexed content, assets, and metadata from the content that has been published to your Tableau Cloud site or Tableau Server. You can query the Metadata API for all content and assets that it indexes.

The Metadata API exposes metadata for the following:

  • Tableau content: workbooks, data sources, virtual connections, virtual connection tables, flows, projects, users, and sites.

  • External assets: databases and tables associated with Tableau content

    Metadata API classifies the metadata of any data that comes from outside the Tableau environment as external assets. The data that comes from outside the Tableau environment can be stored in many different formats, such as a database server or local .json files.

    The Metadata API only tracks metadata about assets; it doesn’t track the data in them.

Metadata includes the following:

  • Lineage information or the relationship between items. For example, the Sales table is used by Superstore data source and Superstore Sample workbook.

  • Schema information. Some examples include:
    • Table names, column names, and column types. For example, Table A contains Columns A, B, and C, which are types INT, VARCHAR, and VARCHAR.
    • Database name and server location. For example, Database_1 is a SQL Server database at http://example.net.
    • Data source name, and the names and types of the fields the data source contains. For example, Superstore data source has fields AA, BB, and CC. Field CC is a calculated field that refers back to both field AA and field BB.
  • User curated, added, or managed information. For example, asset descriptions, certifications, user contacts, data quality warnings, and more.

Permissions on assets and their metadata

Permissions control who is allowed to see and manage the data that is accessible from the Metadata API, for example who can see and manage external assets or who can see relationships shown through lineage queries.

Access metadata about content and assets

The permissions used to access metadata through the Metadata API work similarly to permissions for accessing content through Tableau Cloud or Tableau Server, with some additional considerations for external assets.

The Metadata API uses the same View capability that Tableau Server uses to control the information you can see, with one fundamental difference. In general, when you don’t have View capabilities to access information, Tableau Server omits (also called filters) that information from your results. However, when you don’t have View capabilities to access information, the Metadata API by default hides (also called obfuscates) that information from your results.

If you would rather omit any detail about the related assets that you do not have View capability to access, you can specify the “filter” mode in a query. If you specify the filter permissions mode, only the results whose attributes of external assets you have permissions to see are returned.

For an example, see Filter mode section of the Example Queries topic.

For more information, see one of the following topics:

Permissions on Tableau content

As mentioned above, the Metadata API uses view and manage capabilities that are already used by existing Tableau content to control the information you can see and manage on Tableau content.

For more general information on View capabilities, see one of the following topics:

Permissions on external assets using derived permissions

You are automatically granted View capability to external assets when the derived permissions site setting has been turned on for a site. This site setting is enabled by default if Tableau Cloud or Tableau Server has Data Management. Without Data Management, the site setting must be enabled manually for Tableau Server by the Tableau Server admin.

In addition, if your site has Data Management, it’s possible to explicitly grant permissions for external assets.

For more information and details around permissions, see one of the following topics:

Note: If you are the owner of a flow, derived permissions enable Overwrite and Set Permissions capabilities as well. You can edit and manage permissions for the database and table metadata used by the flow output. For these flow scenarios, the capabilities apply only after there has been at least one successful flow run under you as the current owner of the flow.