> For the complete documentation index, see [llms.txt](https://v2.dataos.info/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://v2.dataos.info/references/v1/interfaces/bi-tools/tableau-cloud.md).

# Tableau Cloud

If you're just getting started, see the [Tableau Cloud connection guide](https://v2.dataos.info/consume/activate/bi-tools/tableau-cloud).

### Publish semantic models to Tableau Cloud

Semantic models must be published to Tableau Cloud before they can be consumed in workbooks. You can publish a semantic model using the **Publish API**.

#### Connect via API (cURL)

Use this approach to publish a semantic model programmatically or integrate publishing into CI/CD pipelines.

**Prerequisites**

* `curl` installed on your machine
* Your DataOS API token
* Tableau Cloud Personal Access Token (PAT) **or** a Tableau Cloud username and password
* A deployed Data Product containing semantic models

Tableau Cloud accepts either a Personal Access Token or a username/password pair in the publish request body; use whichever your Tableau Cloud site allows.

**Using a Personal Access Token**

```bash
curl --location \
'https://<DATAOS_FQDN>/vulcan/tenants/<TENANT>/data-products/<TENANT>-<DATA_PRODUCT>/api/v1/metadata/exports/tableau/publish' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <your-dataos-api-token>' \
--data '{
  "server_address": "https://<tableau-cloud-server>",
  "site_id": "<site-name>",
  "token_name": "<pat-name>",
  "personal_access_token": "<pat-secret>"
}'
```

**Using Username & Password**

```bash
curl --location \
'https://<DATAOS_FQDN>/vulcan/tenants/<TENANT>/data-products/<TENANT>-<DATA_PRODUCT>/api/v1/metadata/exports/tableau/publish' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <your-dataos-api-token>' \
--data '{
  "server_address": "https://<tableau-cloud-server>",
  "site_id": "<site-name>",
  "username": "<tableau-username>",
  "password": "<tableau-password>"
}'
```

#### Replace the placeholders

| Placeholder               | Example                                 | Description                                          |
| ------------------------- | --------------------------------------- | ---------------------------------------------------- |
| `<DATAOS_FQDN>`           | `heliosdev-060426.dataos.cloud`         | Your DataOS fully qualified domain name              |
| `<TENANT>`                | `engineering`                           | Your tenant name                                     |
| `<DATA_PRODUCT>`          | `data-visualization`                    | The data product name                                |
| `<your-dataos-api-token>` | `YmlfdGVzdGluZy5j...`                   | Your DataOS API token                                |
| `<tableau-cloud-server>`  | `prod-apnortheast-a.online.tableau.com` | Tableau Cloud server                                 |
| `<site-name>`             | `moderndata`                            | Tableau Cloud site name                              |
| `<pat-name>`              | `sync-cloud`                            | Tableau Personal Access Token name (PAT auth only)   |
| `<pat-secret>`            | `******`                                | Tableau Personal Access Token secret (PAT auth only) |
| `<tableau-username>`      | `jane.doe@example.com`                  | Tableau Cloud username (username/password auth only) |
| `<tableau-password>`      | `******`                                | Tableau Cloud password (username/password auth only) |

Example (PAT):

```bash
curl --location \
'https://heliosdev-060426.dataos.cloud/vulcan/tenants/engineering/data-products/engineering-data-visualization/api/v1/metadata/exports/tableau/publish' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <your-dataos-api-token>' \
--data '{
  "server_address":"https://prod-apnortheast-a.online.tableau.com",
  "site_id":"moderndata",
  "token_name":"sync-cloud",
  "personal_access_token":"<pat-secret>"
}'
```

{% hint style="info" %}
**Note:** The `Authorization` header uses `Bearer`, not `apitoken`. Use your DataOS API token.
{% endhint %}

### Supported data types

<table><thead><tr><th width="126.3016357421875">Category</th><th width="396.072509765625">Data types</th><th>Status</th></tr></thead><tbody><tr><td><strong>Dimension</strong></td><td><code>time</code>, <code>string</code>, <code>number</code>, <code>boolean</code></td><td>✅ Supported</td></tr><tr><td><strong>Measure</strong></td><td><code>max</code>, <code>min</code>, <code>number</code>, <code>sum</code>, <code>count</code>, <code>boolean</code>, <code>string</code>, <code>time</code>, <code>avg</code>, <code>count_distinct</code></td><td>✅ Supported</td></tr></tbody></table>

{% hint style="info" %}
**Note:** Measures with boolean, string, and time types may appear under dimensions in Tableau. To use a time field correctly as either a measure or dimension, select **Exact Date** from the field menu.
{% endhint %}

### Important considerations

#### Live connection

Published Tableau Cloud data sources always use a **live connection**. Changes in the underlying data source are reflected immediately without requiring manual refreshes.

#### Schema changes require republishing

If dimensions, measures, relationships, or any other semantic model definitions change, the semantic model must be **republished** using the Publish API. Existing Tableau workbooks may require refreshing or remapping fields after the updated data source is published.

#### Tableau Bridge

DataOS MySQL proxy is hosted on a private network, Tableau Bridge is required for Tableau Cloud to establish connectivity.

### Best practices

#### Reuse published data sources

Publish a semantic model once and reuse the published Tableau data source across multiple workbooks. This ensures every workbook uses the same governed metrics and dimensions.

#### Keep business logic in DataOS

Define joins, relationships, dimensions, and measures in the semantic model instead of recreating them inside Tableau. This guarantees consistent business definitions across every workbook.

#### Use user credentials for governed environments

When configuring the published data source, Tableau Cloud allows two authentication options:

* **Embed Password**
* **Prompt User**

If **Embed Password** is selected, Tableau stores the DataOS credentials entered by the publisher. Every user accesses the semantic model using the same DataOS identity.

If **Embed Password** is **not** selected, every user is prompted for:

* DataOS Username
* DataOS API Token

Each request is authenticated using the user's own DataOS identity, allowing DataOS to enforce:

* filter level policy
* Column-level policy

{% hint style="info" %}
**Recommendation:** If your organization uses DataOS governance policies, such as user groups or row-level security, do **not** embed credentials. Prompting users to authenticate individually ensures DataOS applies the appropriate authorization policies for every query.
{% endhint %}

#### Republish after schema changes

Whenever the semantic model changes, republish the Tableau data source before updating dependent workbooks.

### How the connection works

When a published Tableau Cloud data source is queried:

1. Tableau Cloud authenticates the request.
2. If Tableau Bridge is configured, the request is securely routed through Bridge.
3. Tableau connects to the DataOS MySQL Proxy over port **3306**.
4. The MySQL Proxy forwards the request to the DataOS API layer.
5. The Transpiler converts semantic model queries into native SQL.
6. SQL executes against the underlying data source.
7. Results are returned to Tableau Cloud for rendering.

### Limitations

<table><thead><tr><th width="206.777587890625">Limitation</th><th>Detail</th></tr></thead><tbody><tr><td><strong>Publish from Tableau Desktop</strong></td><td>Publishing DataOS semantic models directly from Tableau Desktop is currently not supported.</td></tr><tr><td><strong>Live connection</strong></td><td>Tableau Cloud supports live connections only. Tableau Extracts (<code>.hyper</code>) are not supported for model-first data products.</td></tr><tr><td><strong>Schema changes</strong></td><td>Schema changes do not propagate automatically. Republish the semantic model after any change.</td></tr><tr><td><strong>Private deployments</strong></td><td>Tableau Bridge is required whenever the DataOS MySQL proxy is hosted on a private network.</td></tr></tbody></table>

***

### Governance

#### Authentication and authorization

DataOS remains the source of truth for authentication and authorization. Every query issued from Tableau Cloud is evaluated by DataOS before data is returned. When **Prompt User** authentication is used, DataOS evaluates requests using the authenticated user's identity and automatically applies:

* filter level policy
* Column-level policy

When **Embed Password** is enabled, all queries execute using the embedded DataOS credentials. Choose the authentication model based on your organization's governance requirements.

### Troubleshooting

#### Tableau Cloud cannot connect

* Verify Tableau Bridge is online.
* Verify the Bridge machine is assigned to the correct Bridge Pool.
* Verify the MySQL proxy domain is configured in the **Private Network Allowlist**.

#### Authentication fails

* Verify the DataOS username.
* Verify the DataOS API token.
* Verify the Tableau Personal Access Token used during publishing.

#### Published data source not found

* Verify the Publish API completed successfully.
* Confirm the response contains:

```json
{
  "status": "published"
}
```

#### Users see unexpected data

Verify whether the data source uses:

* Embedded Credentials
* Prompt User authentication

Using embedded credentials causes every query to execute using the same DataOS identity.

#### Schema changes are not reflected

Republish the semantic model. Refresh the Tableau workbook after the new data source has been published.

### FAQs

**Can I publish directly from Tableau Desktop?**

No. Currently, semantic models must be published using the DataOS Tableau Publish API.

**Why is Tableau Bridge required?**

Tableau Bridge securely connects Tableau Cloud to private DataOS MySQL endpoints that are not publicly accessible.

**Should I use Embedded Credentials?**

Use Embedded Credentials only when every user should access the semantic model using the same DataOS identity. If your organization relies on DataOS governance policies, use **Prompt User** authentication instead.

**Does DataOS governance still apply in Tableau Cloud?**

Yes. Every query is evaluated by DataOS before data is returned. When users authenticate individually, DataOS automatically enforces user permissions, row-level , and column-level policy.

**What happens when the semantic model changes?**

Republish the semantic model using the Publish API. Existing workbooks may require refreshing or remapping fields if the schema has changed.

**What connection mode is used?**

Live connection. Every interaction is executed against the DataOS semantic layer in real time.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://v2.dataos.info/references/v1/interfaces/bi-tools/tableau-cloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.