Connect a Data Source

Add a PostgreSQL, MySQL, Oracle or Parquet on S3 connection, choose its tables and browse the catalog

A connection holds the host, database and credentials for one database or S3 bucket. After you save it, you choose which tables become sources that analytic models can read. Only workspace Admins can add, edit or delete connections.

Before you start

• Use a read-only account. Create a database role that can only SELECT the tables you plan to register. Every query runs as this role and sees everything it can read. For PostgreSQL, the role setup in Query a database from code works as is.
• Allow the host. The analytics service connects only to hosts on the deployment’s allowlist. A deployment administrator manages it under Admin -> Data Source Hosts.
• Make it reachable. The database must be reachable from the DataGen analytics service over the network (public endpoint, VPN, peering, or the same private network for on-prem deployments).

Add a connection

1. Open Connections

   Go to Data -> Connections and click Connect source.

2. Choose the source type

   Pick PostgreSQL, MySQL / MariaDB, Oracle Database or Parquet / S3 under Source type. (Workspace files is covered in Build analytic models.)

3. Name it

   Enter a Connection name. Database connections also get a SQL alias, the middle part of every source’s SQL name (data.<alias>.<schema>.<table>). It defaults to the name, uses lowercase letters, digits and underscores, must be unique in the workspace, and cannot change later.

4. Fill in the fields

   Use the fields for your provider (see the tabs below) and choose a TLS mode.

5. Save

   Click Save connection. DataGen connects with the credentials before saving: a wrong host, port or password fails here with the database’s error message.

Fields by provider

PostgreSQL

Field	Notes
Host, Port	Port defaults to 5432.
Database	The database to connect to.
Username, Password	The read-only role. Stored encrypted.
Schemas (comma-separated)	Schemas whose tables you can register. Defaults to public.
TLS	Verify certificate and hostname (default), Require TLS, TLS when available (private network), No TLS (private development only).

MySQL / MariaDB

Field	Notes
Host, Port	Port defaults to 3306.
Database	The database to connect to.
Username, Password	The read-only account. Stored encrypted.
Databases (comma-separated; blank for the database above)	MySQL calls schemas databases. Leave blank to use only the database above.
TLS	Verify certificate and hostname (default), Require TLS, No TLS (private development only).

Oracle Database

Field	Notes
Host, Port	Port defaults to 1521.
Service name or SID	Enter exactly one of the two.
Username, Password	The read-only user. Stored encrypted.
Schemas (comma-separated; blank for the user’s own schema)	Owners whose tables you can register.
TLS	Verify certificate and hostname (default), Oracle native encryption (no certificate; any version), No TLS (private development only).

Parquet / S3

Field	Notes
S3 endpoint	The S3-compatible endpoint URL.
Bucket	The bucket that holds the Parquet files.
Object prefix	Optional folder inside the bucket.
Region	Defaults to us-east-1.
Access key ID, Secret access key	A key that can read the bucket. Stored encrypted.

Parquet / S3 connections have no SQL alias; their sources use data.<id> SQL names.

Until you pick a TLS mode yourself, the form suggests one from the host you type. Keep Verify certificate and hostname for anything reachable over the internet.

Choose tables

A new connection has no sources yet. Click Manage tables on the connection card to open the table picker.

1. Find the tables

   DataGen lists the tables the account can see in the configured schemas. Filter by name with Search tables… and by Schema. Each row shows the SQL name the table will get.

2. Select

   Tick tables one by one, or Select all matching. You can save up to 100 tables at a time.

3. Save

   Click Save table selection. Selected tables appear as sources under Datasets -> Sources and under the connection’s name.

Removing a table from the selection removes the source, not any database permission. A source that a published model reads cannot be removed.

PostgreSQL, MySQL and Oracle connections can be used by Native SQL models without registering any tables. See Build analytic models.

Browse the catalog

Datasets is the workspace catalog. The left side groups it by All datasets, Sources, Analytic models and by connection; the search box matches names and descriptions.

Open a source to see:

• Data: a preview of up to 500 rows, 50 per page, read live from the database.
• Schema: the columns and their types, a Data source description, and a description per column. Descriptions are saved in DataGen and shown to the Data Builder and to agents.

The actions menu next to a dataset name has Copy SQL reference.

Keep a connection up to date

Task	How
Detect column changes	Refresh schemas on the connection card checks each registered table and reports added, removed and retyped columns.
Add or remove tables	Manage tables again. Existing sources keep their SQL names.
Change host or credentials	Edit connection (pencil icon). Leave credential fields blank to keep the saved credentials. The source type and SQL alias cannot change.
Delete	Delete connection (trash icon) removes the connection and every source imported from it. It is refused while a Native SQL model runs on the connection.

How connection credentials are stored

Connection credentials (usernames, passwords, access keys) are encrypted and stored with the connection in DataGen. They are not entries in a Connection Vault, they are never returned to the browser, and they are never placed in an agent’s sandbox:

• The analytics service uses them to read sources when it previews, publishes or refreshes a model.
• Agents read published snapshots only, so they need no database credential at all.
• The Data Builder agent queries PostgreSQL sources through DataGen’s SQL proxy (on deployments that run one), which holds the credentials; other sources are queried by the analytics service on the agent’s behalf.

The Vault chosen in Data -> Settings is a different thing: it supplies credentials to the Data Builder agent’s own tools, not to connections.

Next

Build analytic models

Turn sources into a published, documented model.

Data overview

Revisit the lifecycle, SQL names, roles and limits.