Tableau.<operation>) you call directly from DSUL. Authentication is a Tableau Personal Access Token (PAT) you paste into the app configuration; the connector exchanges it server-side for a short-lived X-Tableau-Auth session token, so credentials are never exposed to the agent.
Content & Permissions
Browse, publish, download and govern projects, workbooks, views, datasources and Prep flows. Manage tags, permissions and revisions site-wide.
Pulse & Subscriptions
Manage Tableau Pulse metrics and definitions, retrieve BAN insights, and orchestrate email and Pulse subscriptions for end-users.
Metadata & VizQL Queries
Run arbitrary Metadata API GraphQL queries, search assets, walk workbook/datasource lineage and query published datasources via VizQL Data Service.
Who is this for?
This connector is used by three different roles. Jump to the section that matches yours — each one is self-contained.Agent builder
You build agents in Agent Factory and want them to use Tableau. → Agent builder tab.
Platform admin
You run the platform and want to know what one-time setup Tableau needs. → Platform admin setup accordion below.
Workspace builder
You write Builder automations (DSUL) that call
Tableau.<operation> directly. → Workspace builder tab.Prerequisites
- A Tableau Cloud site or a Tableau Server installation reachable from Prisme.ai.
- A Personal Access Token (PAT) created on the target site under My Account Settings → Personal Access Tokens. You need its name and its secret (the secret is shown only once, at creation).
- The PAT belongs to a Tableau user — that user must exist on the site and own the rights you want to expose (the connector acts as that user).
- The site
contentUrlif you are not on the Default site (the segment after/site/in the browser URL). - Optionally, the REST API version to target (defaults to
3.21; pin only if your Tableau Server release requires it).
Platform admin (Governance) — one-time platform setup
Platform admin (Governance) — one-time platform setup
No platform-level credential is required. Tableau uses the per-workspace credential model: each workspace pastes its own Personal Access Token in the app configuration, and the connector resolves it server-side. There is no shared platform key, no central OAuth client, and no per-user OAuth flow to register.
Declare the capability in AI Governance (optional)
To let agent builders pick Tableau from the capability catalog instead of pasting an MCP endpoint URL by hand, declare it once as a named capability.Point it at the MCP endpoint
Set the capability’s MCP server URL to a Tableau app instance’s MCP Endpoint, and set its Scope to:The
agent_id in the scope lets the connector identify the calling agent.- Agent builder (Agent Factory)
- Workspace builder (DSUL)
Agent builder
Goal: let an agent you build in Agent Factory query and act on Tableau through MCP tools.Before an agent can call the connector, a Workspace builder must have installed and configured the Tableau app in a workspace (see the Workspace builder tab) so a PAT and an MCP Endpoint exist. The Platform admin setup accordion above is optional (it only publishes a reusable capability).
agent_id that Agent Factory injects through the capability Scope.Install and configure Tableau in a workspace
Follow the Workspace builder tab: install Tableau in a workspace and paste your Personal Access Token (
patName, patSecret) plus serverUrl (and siteContentUrl if not the Default site). On install, an MCP Endpoint is generated automatically.Add the MCP capability to your agent
In your agent in Agent Factory, add a capability pointing at that workspace’s MCP Endpoint URL, and set its Scope to:If a Platform admin has published a Tableau capability in the catalog (see the accordion above), pick it instead — the endpoint and Scope are already wired.
Brief the agent in its system prompt
Wiring the capability is not enough — the agent must know the tools exist and when to use them. Copy-pasteable starter:Legacy AI Knowledge agents (no native MCP picker): add the connector under Advanced > Tools > MCP and paste the MCP Endpoint URL of the Tableau app instance.
Available Tools
The Tableau MCP follows a dispatcher pattern: each tool exposes multiple operations selected by anaction argument. The argument list per action is documented in the tool’s own description.Sites & Users
| Tool | Description |
|---|---|
sites | Manage Tableau sites (Server-only ops; on Tableau Cloud most actions return 403). Actions: list, create, get, update, delete, getRecentlyViewed. |
users | Manage users on a site. Actions: list, get, addToSite, update, removeFromSite, getGroups. |
groups | Manage user groups. Actions: list, create, update, delete, addUser, removeUser, getUsers. |
Content (Projects, Workbooks, Views)
| Tool | Description |
|---|---|
projects | Manage Tableau content projects (folders). Actions: list, create, update, delete. |
workbooks | Manage workbooks: CRUD, downloads (twb/twbx, PDF, PowerPoint, preview), revisions, connections, permissions, tags. Binary downloads are not inline — call get and share webpageUrl. |
views | Manage views: image/PDF/CSV/Excel exports, lookup by id or path, server-side data filters, permissions and tags. |
Datasources & Flows
| Tool | Description |
|---|---|
datasources | Manage published datasources: CRUD, downloads, revisions, connections, permissions, tags, immediate extract refresh (updateNow). |
flows | Manage Tableau Prep flows: CRUD, run, run history, downloads, connections, permissions. |
Scheduling, Jobs & Refresh Tasks
| Tool | Description |
|---|---|
schedules | Server schedules + add workbook/datasource/flow tasks to them. |
jobs | Inspect background jobs: list, get status, cancel. |
extractRefreshTasks | Manage extract refresh tasks (one-shot or scheduled): list, get, run, delete. |
Subscriptions, Webhooks & Favorites
| Tool | Description |
|---|---|
subscriptions | Email subscriptions to views/workbooks. Actions: list, get, create, update, delete. |
webhooks | Tableau webhooks (event notifications). Actions: list, get, create, update, delete, test. |
favorites | Per-user favorites. Actions: list, add, delete. |
Tableau Pulse
| Tool | Description |
|---|---|
metrics | Pulse metrics (instances). Actions: list, get, create, delete. |
metricDefinitions | Pulse metric definitions (templates). Actions: list, get, create, update, delete. |
pulseSubscriptions | Pulse subscriptions to metrics. Actions: list, create, delete. |
insights | Get a Pulse Basic Analytics Narrative (BAN) insight for a metric. Action: get. |
Metadata & VizQL Data Service
| Tool | Description |
|---|---|
metadata | Tableau Metadata API (GraphQL). Actions: query, search, workbookLineage, datasourceLineage. |
vizqlData | Query a published datasource via VizQL Data Service — the preferred tool for analytical questions. Actions: readMetadata, queryDatasource. |
Output Formats
Every tool accepts anoutputFormat argument that controls the MCP response shape:verbose(default) — human-readable text for LLM consumption.structured— machine-readable JSON instructuredContent.both— both text and structured content.
Binary outputs (workbook/view image, PDF, PowerPoint, crosstab Excel, file downloads) cannot be returned inline. The connector instead returns metadata — call
get and share the webpageUrl, or use views/getData and vizqlData for the underlying data.Tool Details
workbooks
| Parameter | Required | Description |
|---|---|---|
action | Yes | One of list, get, queryViews, getConnections, getRevisions, queryPermissions, publish, update, updateNow, updateConnection, delete, addPermissions, deletePermission, addTags, deleteTag, plus the binary download* actions. |
workbookId | Conditional | Required for any per-workbook action. |
request_payload | Conditional | Required for publish. The workbook XML metadata. |
permissions | Conditional | Required for addPermissions. Tableau capabilities granted to grantees. |
tags | Conditional | Required for addTags. Tag set object. |
views
| Parameter | Required | Description |
|---|---|---|
action | Yes | One of list, get, getByPath, getData, getSummaryData, queryPermissions, addPermissions, deletePermission, addTags, deleteTag, plus the binary getImage / getPdf / getCrosstabExcel. |
viewId | Conditional | Required for any action targeting a view by id. |
viewUrl | Conditional | Required for getByPath (Workbook/sheets/Sheet). |
viewFilters | No | Server-side filters for getData / getSummaryData: {"Field": "value"} sent as vf_<field>=<value>. |
datasources
| Parameter | Required | Description |
|---|---|---|
action | Yes | One of list, get, getConnections, getRevisions, queryPermissions, publish, update, updateNow (triggers an extract refresh), updateConnection, delete, addPermissions, deletePermission, addTags, deleteTag, plus binary download*. |
datasourceId | Conditional | Required for any per-datasource action. |
connectionId | Conditional | Required for updateConnection. |
datasource | Conditional | Required for update. Datasource settings object. |
metadata
| Parameter | Required | Description |
|---|---|---|
action | Yes | One of query, search, workbookLineage, datasourceLineage. |
query | Conditional | GraphQL document. Required for query. |
variables | No | Variables map for the GraphQL query. |
name | Conditional | Exact-name match used by search (the Metadata API has no fuzzy search). |
workbookLuid | Conditional | Required for workbookLineage. |
datasourceLuid | Conditional | Required for datasourceLineage. |
vizqlData
| Parameter | Required | Description |
|---|---|---|
action | Yes | readMetadata or queryDatasource. Always readMetadata first to discover exact field captions. |
datasource | Yes | Object with datasourceLuid (from workbooks/getConnections or datasources/list). |
query | Conditional | Required for queryDatasource. Must contain a fields array; supports filters (SET, QUANTITATIVE_*, MATCH, TOP) and aggregation function (SUM, AVG, COUNTD, …). |
options | No | returnFormat (OBJECTS / ARRAYS), debug. |
pulseSubscriptions
| Parameter | Required | Description |
|---|---|---|
action | Yes | list, create or delete. |
subscription | Conditional | Required for create. Must include metric_id and user_id. |
subscriptionId | Conditional | Required for delete. |
metric_id / user_id | No | Filters for list. |
Error Handling
| HTTP code | Meaning | Typical cause |
|---|---|---|
| 400 | Bad Request | Missing or malformed action, invalid filter, missing required parameter for the chosen action. |
| 401 | Unauthorized | The PAT was rejected or the session token expired/was revoked. Check patName / patSecret; a concurrent sign-in with the same PAT revokes the session. |
| 403 | Forbidden | The PAT’s user lacks the right, or the action is Tableau Server-only and you are on Tableau Cloud (e.g. site CRUD). |
| 404 | Not Found | The targeted resource does not exist on this site, or siteContentUrl is wrong. |
| 409 | Conflict | Trying to publish over an existing asset without overwrite: true, or a name collision. |
| 429 | Too Many Requests | Tableau API rate limit hit. Retry with exponential backoff. |
| 500 | Internal Server Error | Transient Tableau Server error. Retry; if it persists, check the Tableau status page. |
Common Issues
“Tableau auth not configured” — The app instance has no PAT. Create a Personal Access Token on your Tableau site (My Account Settings → Personal Access Tokens) and pastepatName, patSecret and serverUrl in the app configuration.
“Tableau signin failed (401)” — The provided PAT was rejected by Tableau, or the cached session was revoked. A Tableau PAT allows only one active session, so a parallel sign-in (a script, another tool) invalidates it. Re-copy the secret, or retry — the connector forces a fresh sign-in on a 401.
“Site not found” / wrong site — Check siteContentUrl. On Tableau Cloud it is the segment after /site/ in the browser URL; on Tableau Server’s Default site, leave it empty.
Tableau Server-only operation on Tableau Cloud — Several site- and schedule-management actions (sites.create, sites.update, schedules.create, …) are only available on Tableau Server and return 403 on Tableau Cloud. Check the Tableau REST API reference for the current allow-list.
VizQL queryDatasource returns 403 "API access permission" — A Tableau administrator must grant API Access on the published datasource before the VizQL Data Service can query it.
External Resources
Tableau REST API Reference
Official documentation for the Tableau REST API 3.x, Metadata API, VizQL Data Service and Pulse.
Tool Agents
Learn how Agent Factory agents consume MCP tools and capabilities in Prisme.ai.