How DSALTA integrates with Tableau — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Tableau using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Tableau site.
DSALTA authenticates with a Tableau Personal Access Token (PAT) and reads the users on your Tableau site — their username, full name, email, and site role. It uses this roster to run access-governance checks that compare Tableau access against your People page, matched by email.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the user roster of the connected Tableau site — username, full name, email and site role (Creator, Explorer, Viewer, Site Administrator, Unlicensed), which appears on your Access page. Tableau’s user list exposes no MFA state, and no account status either: DSALTA marks a user Inactive only when the site role is Unlicensed, and the Access page’s Status column shows every synced account as Active regardless — read the Role column for Unlicensed instead. The Created column is filled from each user’s last sign-in, because the site user list carries no creation date.It calls these Tableau endpoints:
/sessions/current
/sites/{siteId}/users
Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Tableau environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Tableau card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Tableau. This usually happens when the Personal Access Token expires, is revoked, or goes idle (Tableau PATs expire after a period of inactivity). Create a fresh token and reconnect.
Data is not syncing
Confirm the Personal Access Token is still valid and that the HostName, API Version, and Content URL are correct for your site. Then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.
Before you begin
A Tableau site administrator (Site Administrator Creator or Site Administrator Explorer; on Tableau Server a server admin) must create the token, using their own account. Tableau’s Get Users on Site call — the one DSALTA uses to build the roster — can only be made by a server or site administrator, and Tableau does not allow admins to create personal access tokens on another user’s behalf. A Creator or Explorer token will connect successfully and then sync no users.
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Tableau, and click Connect to open the connect panel.
2
Enable Personal Access Tokens
A Tableau site/server admin must enable PATs (Tableau Cloud: Settings, General; Tableau Server: via tsm). Skip if already enabled.
On Tableau Cloud sites created in June 2023 (version 2023.2) or later, personal access tokens are off by default — on a newer site you will have to do this before anyone can create a token.
The same screen controls who can create tokens and how long they last. Leave it open to all users, or select Only users in a specified group and pick a group — whoever creates DSALTA’s token must be in it. For expiry, choose the 180 day option or enter a custom value between 1 and 365 days.
3
Create a Personal Access Token
In Tableau, open your profile, My Account Settings, Personal Access Tokens. Enter a token name, click Create Token, and copy the secret (shown only once).Two expiry rules apply to the token. It dies if it is unused for 15 consecutive days — normally harmless because DSALTA syncs daily, but a connection left broken for two weeks needs a brand-new token — and it also expires at the absolute limit set on the Settings screen (180 days by default, or a custom 1-365 days). A user may hold up to 104 tokens, so creating a dedicated one for DSALTA costs you nothing.
4
Find your HostName and API Version
HostName is the host in your Tableau URL with no protocol, e.g. dub01.online.tableau.com. Use a current REST API version, e.g. 3.26.If you are not sure which version to use, Tableau’s REST API versions page maps every Tableau Cloud and Server release to the REST API version it supports.
Read the two token fields carefully: Personal Access Token is the token’s name — the label you typed in Tableau — and Personal Access Token Secret is the long generated value. Swapping them is the most common cause of a rejected Tableau connection. The secret is shown only once, when the token is created.
5
Find your Content URL and connect
On Tableau Cloud, the Content URL is the value after /site/ in your URL (e.g. acme); leave it blank for a default Tableau Server site. Continue, then paste the token name, token secret, HostName, API Version, and Content URL.On Tableau Cloud the Content URL is required — it is the site segment of the URL you are looking at, e.g. acme in https://dub01.online.tableau.com/#/site/acme/home. If your Tableau Server uses only the Default site, leave it blank. The field sits below the token fields in the credential window, so scroll down.
6
Finish in DSALTA
Everything is entered in the secure credential window: HostName, API Version, the token name, the token secret and the Content URL. When you submit it, DSALTA signs in to Tableau to verify the token and completes the connection — there is nothing further to enter in the panel.
Once connected, Tableau appears on the Connected tab and the checks below begin reporting after the first sync.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)
