Tableau.<operation>) you call directly from DSUL. Authentication is a Tableau Personal Access Token (PAT) you paste into the app configuration; the connector exchanges it server-side for a short-lived X-Tableau-Auth session token, so credentials are never exposed to the agent.
Content & Permissions
Browse, publish, download and govern projects, workbooks, views, datasources and Prep flows. Manage tags, permissions and revisions site-wide.
Pulse & Subscriptions
Manage Tableau Pulse metrics and definitions, retrieve BAN insights, and orchestrate email and Pulse subscriptions for end-users.
Metadata & VizQL Queries
Run arbitrary Metadata API GraphQL queries, search assets, walk workbook/datasource lineage and query published datasources via VizQL Data Service.
Who is this for?
This connector is used by three different roles. Jump to the section that matches yours — each one is self-contained.Agent builder
You build agents in Agent Factory and want them to use Tableau. → Agent builder tab.
Platform admin
You run the platform and want to know what one-time setup Tableau needs. → Platform admin setup accordion below.
Workspace builder
You write Builder automations (DSUL) that call
Tableau.<operation> directly. → Workspace builder tab.Prerequisites
- A Tableau Cloud site or a Tableau Server installation reachable from Prisme.ai.
- A Personal Access Token (PAT) created on the target site under My Account Settings → Personal Access Tokens. You need its name and its secret (the secret is shown only once, at creation).
- The PAT belongs to a Tableau user — that user must exist on the site and own the rights you want to expose (the connector acts as that user).
- The site
contentUrlif you are not on the Default site (the segment after/site/in the browser URL). - Optionally, the REST API version to target (defaults to
3.21; pin only if your Tableau Server release requires it).
Platform admin (Governance) — one-time platform setup
Platform admin (Governance) — one-time platform setup
No platform-level credential is required. Tableau uses the per-workspace credential model: each workspace pastes its own Personal Access Token in the app configuration, and the connector resolves it server-side. There is no shared platform key, no central OAuth client, and no per-user OAuth flow to register.
Declare the capability in AI Governance (optional)
To let agent builders pick Tableau from the capability catalog instead of pasting an MCP endpoint URL by hand, declare it once as a named capability.1
Open AI Governance > Capabilities
Create (or edit) a Tableau capability.
2
Point it at the MCP endpoint
Set the capability’s MCP server URL to a Tableau app instance’s MCP Endpoint, and set its Scope to:The
agent_id in the scope lets the connector identify the calling agent.3
Make it available to agent builders
Once created, the capability appears in the capability picker for agent builders in your organization. Access to the catalog follows your organization’s existing roles; there is no per-capability role grant for this connector.
- Agent builder (Agent Factory)
- Workspace builder (DSUL)
Agent builder
Goal: let an agent you build in Agent Factory query and act on Tableau through MCP tools.Before an agent can call the connector, a Workspace builder must have installed and configured the Tableau app in a workspace (see the Workspace builder tab) so a PAT and an MCP Endpoint exist. The Platform admin setup accordion above is optional (it only publishes a reusable capability).
agent_id that Agent Factory injects through the capability Scope.1
Install and configure Tableau in a workspace
Follow the Workspace builder tab: install Tableau in a workspace and paste your Personal Access Token (
patName, patSecret) plus serverUrl (and siteContentUrl if not the Default site). On install, an MCP Endpoint is generated automatically.2
Add the MCP capability to your agent
In your agent in Agent Factory, add a capability pointing at that workspace’s MCP Endpoint URL, and set its Scope to:If a Platform admin has published a Tableau capability in the catalog (see the accordion above), pick it instead — the endpoint and Scope are already wired.
3
Use it
Ask the agent a Tableau question. It calls the relevant tool (
workbooks, views, vizqlData, …) and grounds its answer on the result.Brief the agent in its system prompt
Wiring the capability is not enough — the agent must know the tools exist and when to use them. Copy-pasteable starter:Legacy AI Knowledge agents (no native MCP picker): add the connector under Advanced > Tools > MCP and paste the MCP Endpoint URL of the Tableau app instance.
Available Tools
The Tableau MCP follows a dispatcher pattern: each tool exposes multiple operations selected by anaction argument. The argument list per action is documented in the tool’s own description.Sites & Users
Content (Projects, Workbooks, Views)
Datasources & Flows
Scheduling, Jobs & Refresh Tasks
Subscriptions, Webhooks & Favorites
Tableau Pulse
Metadata & VizQL Data Service
Output Formats
Every tool accepts anoutputFormat argument that controls the MCP response shape:verbose(default) — human-readable text for LLM consumption.structured— machine-readable JSON instructuredContent.both— both text and structured content.
Binary outputs (workbook/view image, PDF, PowerPoint, crosstab Excel, file downloads) cannot be returned inline. The connector instead returns metadata — call
get and share the webpageUrl, or use views/getData and vizqlData for the underlying data.Tool Details
workbooks
views
datasources
metadata
vizqlData
pulseSubscriptions
Error Handling
Common Issues
“Tableau auth not configured” — The app instance has no PAT. Create a Personal Access Token on your Tableau site (My Account Settings → Personal Access Tokens) and pastepatName, patSecret and serverUrl in the app configuration.
“Tableau signin failed (401)” — The provided PAT was rejected by Tableau, or the cached session was revoked. A Tableau PAT allows only one active session, so a parallel sign-in (a script, another tool) invalidates it. Re-copy the secret, or retry — the connector forces a fresh sign-in on a 401.
“Site not found” / wrong site — Check siteContentUrl. On Tableau Cloud it is the segment after /site/ in the browser URL; on Tableau Server’s Default site, leave it empty.
Tableau Server-only operation on Tableau Cloud — Several site- and schedule-management actions (sites.create, sites.update, schedules.create, …) are only available on Tableau Server and return 403 on Tableau Cloud. Check the Tableau REST API reference for the current allow-list.
VizQL queryDatasource returns 403 "API access permission" — A Tableau administrator must grant API Access on the published datasource before the VizQL Data Service can query it.
External Resources
Tableau REST API Reference
Official documentation for the Tableau REST API 3.x, Metadata API, VizQL Data Service and Pulse.
Tool Agents
Learn how Agent Factory agents consume MCP tools and capabilities in Prisme.ai.