> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parable.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Tableau

> Sync workbooks, views, users, and jobs from Tableau Server or Tableau Cloud

Sync workbooks, views, users, and jobs from Tableau Server or Tableau Cloud.

<Tabs>
  <Tab title="Overview">
    ### Personal Access Token (recommended)

    Connect Parable to Tableau Server or Tableau Cloud with a Personal Access Token. Parable exchanges the PAT at `/auth/signin` for an `X-Tableau-Auth` session and discovers the site LUID automatically.

    #### Content

    Workbooks, views, data sources, projects, flows

    #### Usage and users

    Users, groups, jobs, subscriptions

    ### Connected Apps (Direct Trust JWT)

    Connect Parable to Tableau using a Connected App with Direct Trust. Parable mints a short-lived HS256 JWT and exchanges it at `/auth/signin` for an `X-Tableau-Auth` session. This is **not** browser OAuth (no authorize redirect).

    ### Username and password (Tableau Server)

    Connect Parable to **Tableau Server** with username and password. Parable exchanges credentials at `/auth/signin` for an `X-Tableau-Auth` session.

    > **Warning:** Not available on Tableau Cloud when MFA is enabled. Prefer Personal Access Token or Connected Apps.

    ## Data streams

    This Provider Plugin defines 18 data streams.

    | Stream                   | Description                                                                              | Sync        |
    | ------------------------ | ---------------------------------------------------------------------------------------- | ----------- |
    | `users`                  | Tableau site users                                                                       | full        |
    | `groups`                 | Tableau site groups                                                                      | full        |
    | `group_users`            | Users that belong to a Tableau group                                                     | full        |
    | `projects`               | Tableau projects                                                                         | incremental |
    | `workbooks`              | Published Tableau workbooks                                                              | incremental |
    | `views`                  | Tableau views/dashboards on a site                                                       | incremental |
    | `custom_views`           | Saved custom views                                                                       | incremental |
    | `datasources`            | Published data sources                                                                   | incremental |
    | `datasource_connections` | Connection configs for a published data source                                           | full        |
    | `jobs`                   | Background jobs on the site                                                              | incremental |
    | `extract_refresh_tasks`  | Scheduled extract refresh tasks                                                          | full        |
    | `flows`                  | Tableau Prep flows                                                                       | incremental |
    | `flow_tasks`             | Scheduled flow run tasks                                                                 | full        |
    | `flow_runs`              | Historical Tableau Prep flow runs                                                        | incremental |
    | `subscriptions`          | Content subscriptions                                                                    | full        |
    | `schedules`              | Server schedules (Tableau Server only; not available on Tableau Cloud)                   | full        |
    | `workbook_views`         | Views nested under a workbook (opt-in; site views is default)                            | full        |
    | `activity_events`        | Tableau Cloud Manager / activity log events (opt-in; requires TCM host and admin access) | incremental |
  </Tab>

  <Tab title="Setup Guide">
    ### Personal Access Token (recommended)

    #### What You'll Need

    | Credential       | What it is                                                               |
    | ---------------- | ------------------------------------------------------------------------ |
    | **Token Name**   | PAT identifier from My Account Settings                                  |
    | **Token Secret** | PAT secret value (shown once at creation)                                |
    | **Site Name**    | Tableau site content URL slug (from your site URL; blank for Default)    |
    | **Base URL**     | Tableau Server/Cloud URL (e.g. `https://yourcompany.online.tableau.com`) |

    > **Info:** These steps require **Site Administrator**, or a colleague who can create a PAT for you.

    * Personal Access Tokens enabled on your site
    * Site Administrator role (for full tap coverage)

    #### Step 1: Access Account Settings

    1. Sign in to Tableau Server/Cloud
    2. Click your avatar → **My Account Settings**
    3. Open **Personal Access Tokens**

    #### Step 2: Create Personal Access Token

    1. Enter a token name: `Parable Integration`
    2. Click **Create new token**
    3. Copy both **Token name** and **Token secret**

    > **Warning:** Copy the token secret now. Tableau shows it only once.

    #### Step 3: Note your server details

    | Detail    | Example                                                                       |
    | --------- | ----------------------------------------------------------------------------- |
    | Base URL  | `https://yourcompany.online.tableau.com` or `https://tableau.yourcompany.com` |
    | Site Name | content URL slug from the site URL (empty for Default site)                   |

    #### Step 4: Enter values in Parable

    1. Choose **Personal Access Token**
    2. Enter Base URL, Site Name, Token Name, Token Secret
    3. Click **Save & test connection**

    Successful Save & test stores the site LUID from sign-in for subsequent syncs.

    ```bash Sign In (Get Auth Token) theme={null}
    curl -X POST "https://YOUR_SERVER/api/3.29/auth/signin" \
      -H "Content-Type: application/json" \
      -H "Accept: application/json" \
      -d '{
        "credentials": {
          "personalAccessTokenName": "YOUR_TOKEN_NAME",
          "personalAccessTokenSecret": "YOUR_TOKEN_SECRET",
          "site": {
            "contentUrl": "YOUR_SITE_CONTENT_URL"
          }
        }
      }'
    ```

    The response includes `credentials.token` and `credentials.site.id` (site LUID). Use the LUID in later calls:

    ```bash Test API (with session token) theme={null}
    curl -H "X-Tableau-Auth: YOUR_AUTH_TOKEN" \
      -H "Accept: application/json" \
      "https://YOUR_SERVER/api/3.29/sites/YOUR_SITE_LUID/users?pageSize=1"
    ```

    > **Success:** `200 OK` with user data means credentials work.

    ### Connected Apps (Direct Trust JWT)

    #### What You'll Need

    | Credential                  | What it is                                                               |
    | --------------------------- | ------------------------------------------------------------------------ |
    | **Connected App Client ID** | Client ID from Tableau Connected Apps (Direct Trust)                     |
    | **Secret ID**               | Secret key ID (`kid`) from the Connected App                             |
    | **Secret Value**            | Shared secret used to sign the JWT                                       |
    | **Impersonate User**        | Tableau user email used as the JWT `sub` claim                           |
    | **Site Name**               | Site content URL slug (blank for the Default site)                       |
    | **Base URL**                | Tableau Server/Cloud URL (e.g. `https://yourcompany.online.tableau.com`) |

    > **Info:** Requires a Tableau **site administrator** (or Cloud admin) to create the Connected App.

    * Connected Apps enabled on the site
    * A Tableau user email that Parable should act as (`sub`)
    * REST API scopes enabled on the Connected App for the methods you need

    #### Step 1: Create a Connected App (Direct Trust)

    1. Sign in to Tableau Server/Cloud as an admin
    2. Open **Settings** → **Connected Apps**
    3. Create a **Direct Trust** Connected App
    4. Enable the app
    5. Generate a secret and copy:
       * Client ID
       * Secret ID
       * Secret value

    #### Step 2: Note site and server details

    | Detail           | Example                                                   |
    | ---------------- | --------------------------------------------------------- |
    | Base URL         | `https://yourcompany.online.tableau.com`                  |
    | Site Name        | content URL slug from the site URL (or blank for Default) |
    | Impersonate User | `admin@yourcompany.com`                                   |

    #### Step 3: Enter values in Parable

    1. Choose **Connected Apps (Direct Trust JWT)**
    2. Enter Client ID, Secret ID, Secret value, Impersonate User, Site Name, Base URL
    3. Optionally set scopes (space-separated). Defaults cover content/users/projects read scopes
    4. Click **Save & test connection**

    Successful Save & test means Parable signed in and listed users with the session token. Parable stores the site LUID from sign-in automatically.

    ### Username and password (Tableau Server)

    #### What You'll Need

    | Credential    | What it is                                         |
    | ------------- | -------------------------------------------------- |
    | **Username**  | Tableau Server username                            |
    | **Password**  | Tableau Server password                            |
    | **Site Name** | Site content URL slug (blank for the Default site) |
    | **Base URL**  | Tableau Server URL                                 |

    * Tableau Server (not Cloud + MFA)
    * A user with Site Administrator (or sufficient role for the taps you enable)

    #### Step 1: Confirm password sign-in works on your server

    1. Sign in to Tableau Server with the username/password you will use
    2. Confirm MFA is not required for that account

    #### Step 2: Note server details

    | Detail    | Example                                 |
    | --------- | --------------------------------------- |
    | Base URL  | `https://tableau.yourcompany.com`       |
    | Site Name | content URL slug (or blank for Default) |

    #### Step 3: Enter values in Parable

    1. Choose **Username and password (Tableau Server)**
    2. Enter Username, Password, Site Name, Base URL
    3. Click **Save & test connection**
  </Tab>

  <Tab title="Permissions">
    <AccordionGroup>
      <Accordion id="provider-permission-tap-tableau-activity-events-9b3eaff1b4cd" title="Activity Events" icon="shield-check" iconType="sharp-duotone-solid">
        Developer identifier: `activity_events`

        Activity Events contain Tableau Cloud Manager / activity log events (opt-in; requires TCM host and admin access).

        * **Enables:** trace opted-in Tableau Cloud Manager events to the recorded actor, site, and event time.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/activity/events` using the declared incremental request boundary. This opt-in endpoint requires a Tableau Cloud Manager host and administrator access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-activity-events-actoruserid-acc58a559804" title="Actor User ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `activity_events.actorUserId`

            Actor User ID carries the source identifier named Actor User ID for each activity event row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match activity event records to provider records that carry the same actor user ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `actorUserId` as a record-level identifier on `ActivityEvents`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-activity-events-actorusername-9b7e03802f25" title="Actor User Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `activity_events.actorUserName`

            Actor User Name carries the source person or account value named Actor User Name for each activity event row. It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the activity event record to the provider-reported actor represented by actor user name.
            * **Interpretation:** The provider supplies `actorUserName` as identity or attribution context on each activity event record. Names and contact values can change and are not stable identifiers unless the provider documents them as such.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-activity-events-eventtime-8f7357c988b8" title="Event Time" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `activity_events.eventTime`

            Event Time carries the source date or timestamp named Event Time for each activity event row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place activity event records on a timeline by event time and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `eventTime` per activity event record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-activity-events-eventtype-b3c3c4265160" title="Event Type" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `activity_events.eventType`

            Event Type carries the source state or classification named Event Type for each activity event row. It preserves the provider's current classification of this record.

            * **Enables:** separate activity event records by the exact provider-reported event type value when describing their recorded state.
            * **Interpretation:** The provider supplies `eventType` per activity event record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-activity-events-id-a1f6da84317d" title="ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `activity_events.id`

            ID is the declared record key for each activity event row. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same activity event source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per activity event record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-activity-events-siteluid-3839080809cf" title="Site LUID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `activity_events.siteLuid`

            Site LUID carries the source identifier named Site LUID for each activity event row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match activity event records to provider records that carry the same site LUID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `siteLuid` as a record-level identifier on `ActivityEvents`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-custom-views-a3d0a91bdd6b" title="Custom Views" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `custom_views`

        Custom Views contain saved custom views.

        * **Enables:** catalog saved custom views with owner and source-view references.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/customviews` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-custom-views-createdat-8e9c012be919" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.createdAt`

            Created At carries the source date or timestamp named Created At for each custom view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place custom view records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per custom view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-id-70fc6498848c" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same custom view source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per custom view record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-lastaccessedat-53f06d531a99" title="Last Accessed At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.lastAccessedAt`

            Last Accessed At carries the source date or timestamp named Last Accessed At for each custom view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place custom view records on a timeline by last accessed at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `lastAccessedAt` per custom view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-name-90b20f8b625d" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.name`

            Name carries the source-authored value named Name for each custom view row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each custom view record.
            * **Interpretation:** The provider supplies `name` at custom view granularity in the format stated by its description; omitted or redacted content remains unknown. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-owner-id-c866f32843ec" title="Owner ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.owner_id`

            Owner ID carries the source identifier named Owner ID for each custom view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match custom view records to provider records that carry the same owner ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `owner_id` as a record-level identifier on `CustomViews`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-owner-name-65b9da1abea5" title="Owner Name" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.owner_name`

            Owner Name carries the source person or account value named Owner Name for each custom view row. It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the custom view record to the provider-reported actor represented by owner name.
            * **Interpretation:** The provider supplies `owner_name` as identity or attribution context on each custom view record. Names and contact values can change and are not stable identifiers unless the provider documents them as such. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-shared-84f6b2409647" title="Shared" icon="diagram-project" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.shared`

            Shared carries the source true-or-false flag named Shared for each custom view row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select custom view records for which the provider reports shared as true or false.
            * **Interpretation:** The provider supplies `shared` as a boolean per custom view record; false and missing are distinct when the field is optional. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-updatedat-a439489290d6" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each custom view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place custom view records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per custom view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-view-id-9d1d8efea323" title="View ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.view_id`

            View ID carries the source identifier named View ID for each custom view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match custom view records to provider records that carry the same view ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `view_id` as a record-level identifier on `CustomViews`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-view-name-d2c18f0a01d5" title="View Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.view_name`

            View Name carries the source-authored value named View Name for each custom view row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact view name value attached to each custom view record.
            * **Interpretation:** The provider supplies `view_name` at custom view granularity in the format stated by its description; omitted or redacted content remains unknown. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-custom-views-workbook-id-ae3fda0880be" title="Workbook ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `custom_views.workbook_id`

            Workbook ID carries the source identifier named Workbook ID for each custom view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match custom view records to provider records that carry the same workbook ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `workbook_id` as a record-level identifier on `CustomViews`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-datasource-connections-5d2fca31bf73" title="Datasource Connections" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `datasource_connections`

        Datasource Connections contain connection configs for a published data source.

        * **Enables:** inspect connection configuration returned for a published data source.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/datasources/{datasource_id}/connections` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-datasource-connections-datasource-id-70d9796b7de3" title="Datasource ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasource_connections.datasource_id`

            Datasource ID identifies parent datasource LUID from fan-out. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match datasource connection records to provider records that carry the same datasource ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `datasource_id` as a record-level identifier on `DatasourceConnections`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasource-connections-id-87bc39d846eb" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasource_connections.id`

            ID is the declared record key for each datasource connection row. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same datasource connection source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per datasource connection record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasource-connections-serveraddress-705c5fd3f7df" title="Server Address" icon="file-code" iconType="sharp-duotone-solid">
            Developer identifier: `datasource_connections.serverAddress`

            Server Address carries the source configuration value named Server Address for each datasource connection row. It preserves the configuration or technical value needed to explain how the provider object is defined.

            * **Enables:** inspect the exact server address when validating the configuration or technical definition of a datasource connection record.
            * **Interpretation:** The provider supplies `serverAddress` as configuration or technical metadata on `DatasourceConnections`; consumers must preserve the exact syntax and documented vocabulary.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasource-connections-serverport-43bea6f7646e" title="Server Port" icon="file-code" iconType="sharp-duotone-solid">
            Developer identifier: `datasource_connections.serverPort`

            Server Port carries the source configuration value named Server Port for each datasource connection row. It preserves the configuration or technical value needed to explain how the provider object is defined.

            * **Enables:** inspect the exact server port when validating the configuration or technical definition of a datasource connection record.
            * **Interpretation:** The provider supplies `serverPort` as configuration or technical metadata on `DatasourceConnections`; consumers must preserve the exact syntax and documented vocabulary.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasource-connections-type-5eaba2d1ca78" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasource_connections.type`

            Type carries the source state or classification named Type for each datasource connection row. It preserves the provider's current classification of this record.

            * **Enables:** separate datasource connection records by the exact provider-reported type value when describing their recorded state.
            * **Interpretation:** The provider supplies `type` per datasource connection record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasource-connections-username-39d0d1c60398" title="User Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasource_connections.userName`

            User Name records connection login username (not email). It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the datasource connection record to the provider-reported actor represented by user name.
            * **Interpretation:** The provider supplies `userName` as identity or attribution context on each datasource connection record. Names and contact values can change and are not stable identifiers unless the provider documents them as such.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-datasources-9b9dd8c4b307" title="Datasources" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `datasources`

        Datasources contain published data sources.

        * **Enables:** catalog published data sources with their project, owner, and extract metadata.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/datasources` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-datasources-certificationnote-04f68244b93d" title="Certification Note" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.certificationNote`

            Certification Note carries the source-authored value named Certification Note for each datasource row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact certification note value attached to each datasource record.
            * **Interpretation:** The provider supplies `certificationNote` at datasource granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-contenturl-fd3ac3ec6b09" title="Content URL" icon="comment-dots" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.contentUrl`

            Content URL carries the provider-reported content url for each datasource record. It retains the exact provider location for the referenced resource.

            * **Enables:** open or trace the exact provider resource referenced by content URL on a datasource record.
            * **Interpretation:** The provider supplies `contentUrl` as a URL or resource locator on each datasource record. It identifies a Tableau catalog location but does not prove who can open it.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-createdat-cd278b58f0cc" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.createdAt`

            Created At carries the source date or timestamp named Created At for each datasource row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place datasource records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per datasource record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-description-cc080f3dbd9f" title="Description" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.description`

            Description carries the source-authored value named Description for each datasource row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact description value attached to each datasource record.
            * **Interpretation:** The provider supplies `description` at datasource granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-encryptextracts-faa9b84d7b2d" title="Encrypt Extracts" icon="diagram-project" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.encryptExtracts`

            Encrypt Extracts carries the source true-or-false flag named Encrypt Extracts for each datasource row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select datasource records for which the provider reports encrypt extracts as true or false.
            * **Interpretation:** The provider supplies `encryptExtracts` as a boolean per datasource record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-hasextracts-77e01e63356c" title="Has Extracts" icon="diagram-project" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.hasExtracts`

            Has Extracts carries the source true-or-false flag named Has Extracts for each datasource row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select datasource records for which the provider reports has extracts as true or false.
            * **Interpretation:** The provider supplies `hasExtracts` as a boolean per datasource record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-id-5ca0fb92e111" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same datasource source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per datasource record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-iscertified-d3a060899c57" title="Is Certified" icon="diagram-project" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.isCertified`

            Is Certified carries the source true-or-false flag named Is Certified for each datasource row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select datasource records for which the provider reports is certified as true or false.
            * **Interpretation:** The provider supplies `isCertified` as a boolean per datasource record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-name-a3108961d98f" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.name`

            Name carries the source-authored value named Name for each datasource row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each datasource record.
            * **Interpretation:** The provider supplies `name` at datasource granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-owner-id-be1caa1b88fd" title="Owner ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.owner_id`

            Owner ID carries the source identifier named Owner ID for each datasource row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match datasource records to provider records that carry the same owner ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `owner_id` as a record-level identifier on `Datasources`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-owner-name-985a3ad7e0e4" title="Owner Name" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.owner_name`

            Owner Name carries the source person or account value named Owner Name for each datasource row. It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the datasource record to the provider-reported actor represented by owner name.
            * **Interpretation:** The provider supplies `owner_name` as identity or attribution context on each datasource record. Names and contact values can change and are not stable identifiers unless the provider documents them as such.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-project-id-ed5e05b8f946" title="Project ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.project_id`

            Project ID carries the source identifier named Project ID for each datasource row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match datasource records to provider records that carry the same project ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `project_id` as a record-level identifier on `Datasources`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-project-name-c8a906d54683" title="Project Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.project_name`

            Project Name carries the source-authored value named Project Name for each datasource row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact project name value attached to each datasource record.
            * **Interpretation:** The provider supplies `project_name` at datasource granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-type-39cbb5f67314" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.type`

            Type carries the source state or classification named Type for each datasource row. It preserves the provider's current classification of this record.

            * **Enables:** separate datasource records by the exact provider-reported type value when describing their recorded state.
            * **Interpretation:** The provider supplies `type` per datasource record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-updatedat-e4b731e3afe3" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each datasource row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place datasource records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per datasource record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-datasources-useremotequeryagent-ded5b60cc14e" title="Use Remote Query Agent" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `datasources.useRemoteQueryAgent`

            Use Remote Query Agent carries the source true-or-false flag named Use Remote Query Agent for each datasource row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select datasource records for which the provider reports use remote query agent as true or false.
            * **Interpretation:** The provider supplies `useRemoteQueryAgent` as a boolean per datasource record; false and missing are distinct when the field is optional.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-extract-refresh-tasks-40eeddf9ec91" title="Extract Refresh Tasks" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `extract_refresh_tasks`

        Extract Refresh Tasks contain scheduled extract refresh tasks.

        * **Enables:** review scheduled extract refresh configuration and consecutive failure counts.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/tasks/extractRefreshes` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-consecutivefailedc-abc5dbc880b4" title="Consecutive Failed Count" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.consecutiveFailedCount`

            Consecutive Failed Count carries the source measure named Consecutive Failed Count for each extract refresh task row. It preserves the stated measure at this record's granularity.

            * **Enables:** measure the provider-reported consecutive failed count for each extract refresh task record.
            * **Interpretation:** The provider supplies `consecutiveFailedCount` at extract refresh task granularity as a count at one value per record; zero and missing are not interchangeable.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-datasource-id-5de518165e1f" title="Datasource ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.datasource_id`

            Datasource ID carries the source identifier named Datasource ID for each extract refresh task row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match extract refresh task records to provider records that carry the same datasource ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `datasource_id` as a record-level identifier on `ExtractRefreshTasks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-datasource-name-b30f794357d8" title="Datasource Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.datasource_name`

            Datasource Name carries the source-authored value named Datasource Name for each extract refresh task row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact datasource name value attached to each extract refresh task record.
            * **Interpretation:** The provider supplies `datasource_name` at extract refresh task granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-extractrefresh-cbe4ee78d8dd" title="Extract Refresh" icon="money-check-dollar" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.extractRefresh`

            Extract Refresh records nested `extractRefresh` payload from Tableau tasks.task envelope. It retains configured attributes whose keys or shape are not fixed by this base schema.

            * **Enables:** interpret extract refresh according to the provider and Workspace configuration that produced each extract refresh task record.
            * **Interpretation:** Keys and value shapes within `extractRefresh` can vary with provider and customer configuration; consumers must inspect the observed Workspace schema rather than assume a fixed contract.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-id-305bd839d6e7" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.id`

            ID identifies prefer `extractRefresh`.id when nested. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same extract refresh task source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per extract refresh task record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-priority-92a42d3a67dc" title="Priority" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.priority`

            Priority carries the source state or classification named Priority for each extract refresh task row. It preserves the provider's current classification of this record.

            * **Enables:** separate extract refresh task records by the exact provider-reported priority value when describing their recorded state.
            * **Interpretation:** The provider supplies `priority` per extract refresh task record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-schedule-frequency-2625774e90ee" title="Schedule Frequency" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.schedule_frequency`

            Schedule Frequency carries the source period or schedule value named Schedule Frequency for each extract refresh task row. It preserves the provider-defined period or schedule cadence for this record.

            * **Enables:** group extract refresh task records by the provider-defined schedule frequency period or schedule.
            * **Interpretation:** The provider supplies `schedule_frequency` per extract refresh task record using its own period or schedule vocabulary; it is not an elapsed-duration measurement.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-schedule-id-945def39a020" title="Schedule ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.schedule_id`

            Schedule ID carries the source identifier named Schedule ID for each extract refresh task row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match extract refresh task records to provider records that carry the same schedule ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `schedule_id` as a record-level identifier on `ExtractRefreshTasks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-schedule-name-738e1b4389f4" title="Schedule Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.schedule_name`

            Schedule Name carries the source-authored value named Schedule Name for each extract refresh task row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact schedule name value attached to each extract refresh task record.
            * **Interpretation:** The provider supplies `schedule_name` at extract refresh task granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-schedule-nextrunat-9b4641f7b5f5" title="Schedule Next Run At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.schedule_nextRunAt`

            Schedule Next Run At carries the source date or timestamp named Schedule Next Run At for each extract refresh task row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place extract refresh task records on a timeline by schedule next run at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `schedule_nextRunAt` per extract refresh task record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-type-c3d800d0573d" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.type`

            Type carries the source state or classification named Type for each extract refresh task row. It preserves the provider's current classification of this record.

            * **Enables:** separate extract refresh task records by the exact provider-reported type value when describing their recorded state.
            * **Interpretation:** The provider supplies `type` per extract refresh task record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-workbook-id-9d9206bed49a" title="Workbook ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.workbook_id`

            Workbook ID carries the source identifier named Workbook ID for each extract refresh task row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match extract refresh task records to provider records that carry the same workbook ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `workbook_id` as a record-level identifier on `ExtractRefreshTasks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-extract-refresh-tasks-workbook-name-7890ddcfcb63" title="Workbook Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `extract_refresh_tasks.workbook_name`

            Workbook Name carries the source-authored value named Workbook Name for each extract refresh task row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact workbook name value attached to each extract refresh task record.
            * **Interpretation:** The provider supplies `workbook_name` at extract refresh task granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-flow-runs-2d94d94c5064" title="Flow Runs" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `flow_runs`

        Flow Runs contain historical Tableau Prep flow runs.

        * **Enables:** track historical Tableau Prep runs by status, progress, and timestamps.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/flows/runs` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-flow-runs-backgroundjobid-ffb1397f173e" title="Background Job ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.backgroundJobId`

            Background Job ID carries the source identifier named Background Job ID for each flow run row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match flow run records to provider records that carry the same background job ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `backgroundJobId` as a record-level identifier on `FlowRuns`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-runs-completedat-80b118cb253d" title="Completed At" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.completedAt`

            Completed At carries the source state or classification named Completed At for each flow run row. It preserves the provider's current classification of this record.

            * **Enables:** separate flow run records by the exact provider-reported completed at value when describing their recorded state.
            * **Interpretation:** The provider supplies `completedAt` per flow run record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-runs-flow-id-222c3209f7c4" title="Flow ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.flow_id`

            Flow ID carries the source identifier named Flow ID for each flow run row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match flow run records to provider records that carry the same flow ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `flow_id` as a record-level identifier on `FlowRuns`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-runs-id-907c0e7d63f0" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.id`

            ID is the declared record key for each flow run row. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same flow run source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per flow run record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-runs-progress-e307897e05e0" title="Progress" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.progress`

            Progress records Tableau's numeric progress value for the flow run. It preserves the execution-state value returned by the provider.

            * **Enables:** distinguish flow runs at different stages of execution after applying the scale used by the source export.
            * **Interpretation:** The provider supplies `progress` as an integer but this schema does not declare its range or unit; zero and missing are not interchangeable.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-runs-startedat-ff8ea40dd704" title="Started At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.startedAt`

            Started At carries the source date or timestamp named Started At for each flow run row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place flow run records on a timeline by started at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `startedAt` per flow run record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-runs-status-a55e5e507af4" title="Status" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_runs.status`

            Status carries the source state or classification named Status for each flow run row. It preserves the provider's current classification of this record.

            * **Enables:** separate flow run records by the exact provider-reported status value when describing their recorded state.
            * **Interpretation:** The provider supplies `status` per flow run record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-flow-tasks-dafc3fd502ad" title="Flow Tasks" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `flow_tasks`

        Flow Tasks contain scheduled flow run tasks.

        * **Enables:** review scheduled Tableau Prep flow task configuration.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/tasks/flows` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-flow-tasks-consecutivefailedcount-12bd7a6bb343" title="Consecutive Failed Count" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.consecutiveFailedCount`

            Consecutive Failed Count carries the source measure named Consecutive Failed Count for each flow task row. It preserves the stated measure at this record's granularity.

            * **Enables:** measure the provider-reported consecutive failed count for each flow task record.
            * **Interpretation:** The provider supplies `consecutiveFailedCount` at flow task granularity as a count at one value per record; zero and missing are not interchangeable.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-flow-id-9a3f1ed0c864" title="Flow ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.flow_id`

            Flow ID carries the source identifier named Flow ID for each flow task row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match flow task records to provider records that carry the same flow ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `flow_id` as a record-level identifier on `FlowTasks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-flow-name-feb92e21afd8" title="Flow Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.flow_name`

            Flow Name carries the source-authored value named Flow Name for each flow task row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact flow name value attached to each flow task record.
            * **Interpretation:** The provider supplies `flow_name` at flow task granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-flowrun-890934a0cd70" title="Flow Run" icon="money-check-dollar" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.flowRun`

            Flow Run records nested `flowRun` payload when present on tasks.task. It retains configured attributes whose keys or shape are not fixed by this base schema.

            * **Enables:** interpret flow run according to the provider and Workspace configuration that produced each flow task record.
            * **Interpretation:** Keys and value shapes within `flowRun` can vary with provider and customer configuration; consumers must inspect the observed Workspace schema rather than assume a fixed contract.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-id-aa108d037c82" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.id`

            ID is the declared record key for each flow task row. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same flow task source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per flow task record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-priority-584e1099565e" title="Priority" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.priority`

            Priority carries the source state or classification named Priority for each flow task row. It preserves the provider's current classification of this record.

            * **Enables:** separate flow task records by the exact provider-reported priority value when describing their recorded state.
            * **Interpretation:** The provider supplies `priority` per flow task record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-schedule-frequency-8b07ccf0c9b9" title="Schedule Frequency" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.schedule_frequency`

            Schedule Frequency carries the source period or schedule value named Schedule Frequency for each flow task row. It preserves the provider-defined period or schedule cadence for this record.

            * **Enables:** group flow task records by the provider-defined schedule frequency period or schedule.
            * **Interpretation:** The provider supplies `schedule_frequency` per flow task record using its own period or schedule vocabulary; it is not an elapsed-duration measurement.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-schedule-id-d8c2af795b09" title="Schedule ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.schedule_id`

            Schedule ID carries the source identifier named Schedule ID for each flow task row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match flow task records to provider records that carry the same schedule ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `schedule_id` as a record-level identifier on `FlowTasks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-schedule-name-c04869ebf9a1" title="Schedule Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.schedule_name`

            Schedule Name carries the source-authored value named Schedule Name for each flow task row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact schedule name value attached to each flow task record.
            * **Interpretation:** The provider supplies `schedule_name` at flow task granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flow-tasks-type-3941029c4a81" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flow_tasks.type`

            Type carries the source state or classification named Type for each flow task row. It preserves the provider's current classification of this record.

            * **Enables:** separate flow task records by the exact provider-reported type value when describing their recorded state.
            * **Interpretation:** The provider supplies `type` per flow task record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-flows-940ec2a91766" title="Flows" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `flows`

        Flows contain Tableau Prep flows.

        * **Enables:** catalog Tableau Prep flows by project and owner.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/flows` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-flows-createdat-8d3d47a142f0" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.createdAt`

            Created At carries the source date or timestamp named Created At for each flow row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place flow records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per flow record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-description-56a9ada2b24f" title="Description" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.description`

            Description carries the source-authored value named Description for each flow row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact description value attached to each flow record.
            * **Interpretation:** The provider supplies `description` at flow granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-id-7f8fc9c7abd3" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same flow source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per flow record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-name-30381e1e09b3" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.name`

            Name carries the source-authored value named Name for each flow row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each flow record.
            * **Interpretation:** The provider supplies `name` at flow granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-owner-id-22d4a0e6a9f8" title="Owner ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `flows.owner_id`

            Owner ID carries the source identifier named Owner ID for each flow row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match flow records to provider records that carry the same owner ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `owner_id` as a record-level identifier on `Flows`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-owner-name-e79e6cd92d34" title="Owner Name" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `flows.owner_name`

            Owner Name carries the source person or account value named Owner Name for each flow row. It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the flow record to the provider-reported actor represented by owner name.
            * **Interpretation:** The provider supplies `owner_name` as identity or attribution context on each flow record. Names and contact values can change and are not stable identifiers unless the provider documents them as such.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-project-id-a3a4abb74bf2" title="Project ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.project_id`

            Project ID carries the source identifier named Project ID for each flow row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match flow records to provider records that carry the same project ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `project_id` as a record-level identifier on `Flows`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-project-name-dde068c91c63" title="Project Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.project_name`

            Project Name carries the source-authored value named Project Name for each flow row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact project name value attached to each flow record.
            * **Interpretation:** The provider supplies `project_name` at flow granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-flows-updatedat-588e5ab32531" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `flows.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each flow row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place flow records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per flow record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-group-users-f15ca4fbe30b" title="Group Users" icon="people-group" iconType="sharp-duotone-solid">
        Developer identifier: `group_users`

        Group Users contain users that belong to a Tableau group.

        * **Enables:** map site accounts to a specific Tableau group.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/groups/{group_id}/users` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-group-users-authsetting-6d791bee3d5a" title="Auth Setting" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `group_users.authSetting`

            Auth Setting carries the source access or role value named Auth Setting for each group user row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported auth setting attached to each group user record.
            * **Interpretation:** The provider supplies `authSetting` at group user granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-group-users-group-id-5f25d7c80a54" title="Group ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `group_users.group_id`

            Group ID identifies parent group LUID from fan-out. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match group user records to provider records that carry the same group ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `group_id` as a record-level identifier on `GroupUsers`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-group-users-id-6518003c1e74" title="ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `group_users.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same group user source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per group user record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-group-users-lastlogin-583d0e2d698d" title="Last Login" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `group_users.lastLogin`

            Last Login carries the source date or timestamp named Last Login for each group user row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place group user records on a timeline by last login and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `lastLogin` per group user record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-group-users-name-002879b44471" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `group_users.name`

            Name carries the source-authored value named Name for each group user row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each group user record.
            * **Interpretation:** The provider supplies `name` at group user granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-group-users-siterole-45eb555ad1d9" title="Site Role" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `group_users.siteRole`

            Site Role carries the source access or role value named Site Role for each group user row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported site role attached to each group user record.
            * **Interpretation:** The provider supplies `siteRole` at group user granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-groups-4b655e3d5c7d" title="Groups" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `groups`

        Groups contain Tableau site groups.

        * **Enables:** catalog groups defined on the configured Tableau site.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/groups` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-groups-domain-name-75ee99fe1249" title="Domain Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.domain_name`

            Domain Name carries the source-authored value named Domain Name for each group row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact domain name value attached to each group record.
            * **Interpretation:** The provider supplies `domain_name` at group granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-groups-id-1a302cf8fbee" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same group source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per group record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-groups-import-domainname-06f8b8f08b6c" title="Import Domain Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.import_domainName`

            Import Domain Name carries the source-authored value named Import Domain Name for each group row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact import domain name value attached to each group record.
            * **Interpretation:** The provider supplies `import_domainName` at group granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-groups-import-grantlicensemode-ca82aaf4cbe2" title="Import Grant License Mode" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.import_grantLicenseMode`

            Import Grant License Mode carries the source access or role value named Import Grant License Mode for each group row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported import grant license mode attached to each group record.
            * **Interpretation:** The provider supplies `import_grantLicenseMode` at group granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-groups-import-siterole-c1e3335961e5" title="Import Site Role" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.import_siteRole`

            Import Site Role carries the source access or role value named Import Site Role for each group row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported import site role attached to each group record.
            * **Interpretation:** The provider supplies `import_siteRole` at group granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-groups-name-9e3162c6443b" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `groups.name`

            Name carries the source-authored value named Name for each group row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each group record.
            * **Interpretation:** The provider supplies `name` at group granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-jobs-7b86f31797b4" title="Jobs" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `jobs`

        Jobs contain background jobs on the site.

        * **Enables:** track background jobs by provider-reported type, state, progress, and timestamps.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/jobs` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-jobs-completedat-31d1f96c4b9f" title="Completed At" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.completedAt`

            Completed At carries the source state or classification named Completed At for each job row. It preserves the provider's current classification of this record.

            * **Enables:** separate job records by the exact provider-reported completed at value when describing their recorded state.
            * **Interpretation:** The provider supplies `completedAt` per job record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-createdat-4313db17c142" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.createdAt`

            Created At carries the source date or timestamp named Created At for each job row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place job records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per job record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-datasource-id-f5048f311eb1" title="Datasource ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.datasource_id`

            Datasource ID carries the source identifier named Datasource ID for each job row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match job records to provider records that carry the same datasource ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `datasource_id` as a record-level identifier on `Jobs`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-extractrefreshjob-id-10de9faa9c6f" title="Extract Refresh Job ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.extractRefreshJob_id`

            Extract Refresh Job ID carries the source identifier named Extract Refresh Job ID for each job row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match job records to provider records that carry the same extract refresh job ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `extractRefreshJob_id` as a record-level identifier on `Jobs`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-id-858fbade696d" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.id`

            ID is the declared record key for each job row. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same job source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per job record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-jobtype-a9a346cba5c9" title="Job Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.jobType`

            Job Type carries the source state or classification named Job Type for each job row. It preserves the provider's current classification of this record.

            * **Enables:** separate job records by the exact provider-reported job type value when describing their recorded state.
            * **Interpretation:** The provider supplies `jobType` per job record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-priority-b1b7ff1f9be3" title="Priority" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.priority`

            Priority carries the source state or classification named Priority for each job row. It preserves the provider's current classification of this record.

            * **Enables:** separate job records by the exact provider-reported priority value when describing their recorded state.
            * **Interpretation:** The provider supplies `priority` per job record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-progress-a525bb340ad0" title="Progress" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.progress`

            Progress records Tableau's numeric progress value for the job. It preserves the execution-state value returned by the provider.

            * **Enables:** distinguish jobs at different stages of execution after applying the scale used by the source export.
            * **Interpretation:** The provider supplies `progress` as an integer but this schema does not declare its range or unit; zero and missing are not interchangeable.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-startedat-6f172a75bd10" title="Started At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.startedAt`

            Started At carries the source date or timestamp named Started At for each job row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place job records on a timeline by started at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `startedAt` per job record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-status-bd31ea740e2d" title="Status" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.status`

            Status carries the source state or classification named Status for each job row. It preserves the provider's current classification of this record.

            * **Enables:** separate job records by the exact provider-reported status value when describing their recorded state.
            * **Interpretation:** The provider supplies `status` per job record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-statusnotes-4abfce9b72a1" title="Status Notes" icon="comment-dots" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.statusNotes`

            Status Notes carries the source state or classification named Status Notes for each job row. It preserves the provider's current classification of this record.

            * **Enables:** separate job records by the exact provider-reported status notes value when describing their recorded state.
            * **Interpretation:** The provider supplies `statusNotes` per job record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-type-33ccc1a18e89" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.type`

            Type carries the source state or classification named Type for each job row. It preserves the provider's current classification of this record.

            * **Enables:** separate job records by the exact provider-reported type value when describing their recorded state.
            * **Interpretation:** The provider supplies `type` per job record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-jobs-workbook-id-d844e1c2dbed" title="Workbook ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `jobs.workbook_id`

            Workbook ID carries the source identifier named Workbook ID for each job row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match job records to provider records that carry the same workbook ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `workbook_id` as a record-level identifier on `Jobs`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-projects-5c0a088bc704" title="Projects" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `projects`

        Projects contain Tableau projects.

        * **Enables:** organize published Tableau content by project.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/projects` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-projects-contentpermissions-4bd7b7454013" title="Content Permissions" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.contentPermissions`

            Content Permissions carries the source access or role value named Content Permissions for each project row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported content permissions attached to each project record.
            * **Interpretation:** The provider supplies `contentPermissions` at project granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-createdat-c137e39aedaa" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.createdAt`

            Created At carries the source date or timestamp named Created At for each project row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place project records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per project record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-description-a5533b30d9c2" title="Description" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.description`

            Description carries the source-authored value named Description for each project row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact description value attached to each project record.
            * **Interpretation:** The provider supplies `description` at project granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-id-26f62eecf5de" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same project source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per project record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-name-13cadefe98c5" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.name`

            Name carries the source-authored value named Name for each project row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each project record.
            * **Interpretation:** The provider supplies `name` at project granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-owner-id-57c5f0e4d6b9" title="Owner ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `projects.owner_id`

            Owner ID carries the source identifier named Owner ID for each project row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match project records to provider records that carry the same owner ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `owner_id` as a record-level identifier on `Projects`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-parentprojectid-2a326454e1e2" title="Parent Project ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.parentProjectId`

            Parent Project ID carries the source identifier named Parent Project ID for each project row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match project records to provider records that carry the same parent project ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `parentProjectId` as a record-level identifier on `Projects`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-toplevelproject-523111906e27" title="Top Level Project" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.topLevelProject`

            Top Level Project carries the source true-or-false flag named Top Level Project for each project row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select project records for which the provider reports top level project as true or false.
            * **Interpretation:** The provider supplies `topLevelProject` as a boolean per project record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-updatedat-9e44331add2b" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each project row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place project records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per project record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-projects-writeable-743057b474c4" title="Writeable" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `projects.writeable`

            Writeable carries the source access or role value named Writeable for each project row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported writeable attached to each project record.
            * **Interpretation:** The provider supplies `writeable` at project granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-schedules-bd98e0955cf4" title="Schedules" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `schedules`

        Schedules contain server schedules (Tableau Server only; not available on Tableau Cloud).

        * **Enables:** review Tableau Server schedule cadence and next-run metadata.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/schedules` as a full snapshot. This endpoint is Tableau Server-only; Tableau Cloud schedules are outside its scope.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-schedules-createdat-ad71c7695c47" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.createdAt`

            Created At carries the source date or timestamp named Created At for each schedule row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place schedule records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per schedule record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-executionorder-883e53c62692" title="Execution Order" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.executionOrder`

            Execution Order carries the source measure named Execution Order for each schedule row. It preserves the stated measure at this record's granularity.

            * **Enables:** order or classify schedule records using the provider-defined execution order value.
            * **Interpretation:** The provider supplies `executionOrder` at schedule granularity as a provider-defined ordinal or planning value rather than elapsed time or money; zero and missing are not interchangeable.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-frequency-9b289be46506" title="Frequency" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.frequency`

            Frequency carries the source period or schedule value named Frequency for each schedule row. It preserves the provider-defined period or schedule cadence for this record.

            * **Enables:** group schedule records by the provider-defined frequency period or schedule.
            * **Interpretation:** The provider supplies `frequency` per schedule record using its own period or schedule vocabulary; it is not an elapsed-duration measurement.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-id-16abb9df51aa" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same schedule source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per schedule record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-name-658dcb11ab17" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.name`

            Name carries the source-authored value named Name for each schedule row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each schedule record.
            * **Interpretation:** The provider supplies `name` at schedule granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-nextrunat-27a5aaaeff00" title="Next Run At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.nextRunAt`

            Next Run At carries the source date or timestamp named Next Run At for each schedule row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place schedule records on a timeline by next run at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `nextRunAt` per schedule record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-priority-1de3cc14857e" title="Priority" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.priority`

            Priority carries the source state or classification named Priority for each schedule row. It preserves the provider's current classification of this record.

            * **Enables:** separate schedule records by the exact provider-reported priority value when describing their recorded state.
            * **Interpretation:** The provider supplies `priority` per schedule record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-state-018e00cb54c6" title="State" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.state`

            State carries the source state or classification named State for each schedule row. It preserves the provider's current classification of this record.

            * **Enables:** separate schedule records by the exact provider-reported state value when describing their recorded state.
            * **Interpretation:** The provider supplies `state` per schedule record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-type-8283290dd8b0" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.type`

            Type carries the source state or classification named Type for each schedule row. It preserves the provider's current classification of this record.

            * **Enables:** separate schedule records by the exact provider-reported type value when describing their recorded state.
            * **Interpretation:** The provider supplies `type` per schedule record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-schedules-updatedat-c15dbc6882ac" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `schedules.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each schedule row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place schedule records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per schedule record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-subscriptions-093299ecdc3b" title="Subscriptions" icon="code-branch" iconType="sharp-duotone-solid">
        Developer identifier: `subscriptions`

        Subscriptions contain content subscriptions.

        * **Enables:** review content subscription recipients, schedules, and attachment options.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/subscriptions` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-subscriptions-attachimage-61b971981b30" title="Attach Image" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.attachImage`

            Attach Image carries the provider-reported attach image for each subscription record. It retains the exact provider location for the referenced resource.

            * **Enables:** open or trace the exact provider resource referenced by attach image on a subscription record.
            * **Interpretation:** The provider supplies `attachImage` as a URL or resource locator on each subscription record. It identifies a Tableau catalog location but does not prove who can open it.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-attachpdf-99b53f995568" title="Attach PDF" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.attachPdf`

            Attach PDF carries the source true-or-false flag named Attach PDF for each subscription row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select subscription records for which the provider reports attach PDF as true or false.
            * **Interpretation:** The provider supplies `attachPdf` as a boolean per subscription record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-content-id-332a39d59260" title="Content ID" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.content_id`

            Content ID carries the source identifier named Content ID for each subscription row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match subscription records to provider records that carry the same content ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `content_id` as a record-level identifier on `Subscriptions`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-content-type-b7a8f2dd4caf" title="Content Type" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.content_type`

            Content Type carries the source state or classification named Content Type for each subscription row. It preserves the provider's current classification of this record.

            * **Enables:** separate subscription records by the exact provider-reported content type value when describing their recorded state.
            * **Interpretation:** The provider supplies `content_type` per subscription record using its own state vocabulary; unknown and missing values must remain distinct.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-id-ccd49b22ec0e" title="ID" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.id`

            ID is the declared record key for each subscription row. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same subscription source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per subscription record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-message-57a2bd92af84" title="Message" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.message`

            Message carries the source-authored value named Message for each subscription row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact message value attached to each subscription record.
            * **Interpretation:** The provider supplies `message` at subscription granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-schedule-frequency-2494a6742d63" title="Schedule Frequency" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.schedule_frequency`

            Schedule Frequency carries the source period or schedule value named Schedule Frequency for each subscription row. It preserves the provider-defined period or schedule cadence for this record.

            * **Enables:** group subscription records by the provider-defined schedule frequency period or schedule.
            * **Interpretation:** The provider supplies `schedule_frequency` per subscription record using its own period or schedule vocabulary; it is not an elapsed-duration measurement.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-schedule-id-2be06c860828" title="Schedule ID" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.schedule_id`

            Schedule ID carries the source identifier named Schedule ID for each subscription row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match subscription records to provider records that carry the same schedule ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `schedule_id` as a record-level identifier on `Subscriptions`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-schedule-name-5a4640f495d1" title="Schedule Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.schedule_name`

            Schedule Name carries the source-authored value named Schedule Name for each subscription row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact schedule name value attached to each subscription record.
            * **Interpretation:** The provider supplies `schedule_name` at subscription granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-subject-a8efc83d61f9" title="Subject" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.subject`

            Subject carries the source-authored value named Subject for each subscription row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact subject value attached to each subscription record.
            * **Interpretation:** The provider supplies `subject` at subscription granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-suspended-23bfaa7659af" title="Suspended" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.suspended`

            Suspended carries the source true-or-false flag named Suspended for each subscription row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select subscription records for which the provider reports suspended as true or false.
            * **Interpretation:** The provider supplies `suspended` as a boolean per subscription record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-user-id-59c5e0f1e2f0" title="User ID" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.user_id`

            User ID carries the source identifier named User ID for each subscription row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match subscription records to provider records that carry the same user ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `user_id` as a record-level identifier on `Subscriptions`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-subscriptions-user-name-0c0cb4b27073" title="User Name" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `subscriptions.user_name`

            User Name carries the source person or account value named User Name for each subscription row. It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the subscription record to the provider-reported actor represented by user name.
            * **Interpretation:** The provider supplies `user_name` as identity or attribution context on each subscription record. Names and contact values can change and are not stable identifiers unless the provider documents them as such.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-users-35cdd4b1e074" title="Users" icon="people-group" iconType="sharp-duotone-solid">
        Developer identifier: `users`

        Users contain Tableau site users.

        * **Enables:** inventory accounts returned for the configured Tableau site.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/users` as a full snapshot. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-users-authsetting-f2426e700394" title="Auth Setting" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.authSetting`

            Auth Setting carries the source access or role value named Auth Setting for each user row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported auth setting attached to each user record.
            * **Interpretation:** The provider supplies `authSetting` at user granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-externalauthuserid-fe49627912d6" title="External Auth User ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.externalAuthUserId`

            External Auth User ID carries the source identifier named External Auth User ID for each user row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match user records to provider records that carry the same external auth user ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `externalAuthUserId` as a record-level identifier on `Users`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-id-762fbe1d37d5" title="ID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.id`

            ID identifies Tableau LUID. Kept as string (not Identity.UUID) so the Bronze II scalar hook does not base62-encode it; silver users.id must equal `activity_events`.`actor_user_luid` (PARABLE-3291). Same rationale as Microsoft GUIDs in microsoft.json. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same user source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per user record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-language-63dd6b906595" title="Language" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `users.language`

            Language carries the source location or localization value named Language for each user row. It preserves the geographic, locale, time-zone, or coordinate context represented by the field.

            * **Enables:** interpret dates, times, or localized text for users using the recorded language.
            * **Interpretation:** The provider supplies `language` as location or localization context per user record; it does not establish a person's real-time physical location.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-lastlogin-b72863a1ddcb" title="Last Login" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.lastLogin`

            Last Login carries the source date or timestamp named Last Login for each user row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place user records on a timeline by last login and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `lastLogin` per user record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-locale-cedb2ccfaef9" title="Locale" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `users.locale`

            Locale carries the source location or localization value named Locale for each user row. It preserves the geographic, locale, time-zone, or coordinate context represented by the field.

            * **Enables:** interpret dates, times, or localized text for users using the recorded locale.
            * **Interpretation:** The provider supplies `locale` as location or localization context per user record; it does not establish a person's real-time physical location.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-name-8b5656d4d648" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.name`

            Name carries the source-authored value named Name for each user row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each user record.
            * **Interpretation:** The provider supplies `name` at user granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-users-siterole-a37c65774e9c" title="Site Role" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.siteRole`

            Site Role carries the source access or role value named Site Role for each user row. It documents the access-related value reported for this object or membership.

            * **Enables:** describe the provider-reported site role attached to each user record.
            * **Interpretation:** The provider supplies `siteRole` at user granularity. For Tableau, this metadata does not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-views-4b9cee5ee356" title="Views" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `views`

        Views contain Tableau views/dashboards on a site.

        * **Enables:** catalog site views and dashboards with their workbook and usage metadata.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/views` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-views-contenturl-08c7ecfb1d75" title="Content URL" icon="comment-dots" iconType="sharp-duotone-solid">
            Developer identifier: `views.contentUrl`

            Content URL carries the provider-reported content url for each view record. It retains the exact provider location for the referenced resource.

            * **Enables:** open or trace the exact provider resource referenced by content URL on a view record.
            * **Interpretation:** The provider supplies `contentUrl` as a URL or resource locator on each view record. It identifies a Tableau catalog location but does not prove who can open it. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-createdat-e1486af88ae1" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.createdAt`

            Created At carries the source date or timestamp named Created At for each view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place view records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-id-36a77590daf7" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same view source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per view record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-name-cb90dfd3ae0a" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.name`

            Name carries the source-authored value named Name for each view row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each view record.
            * **Interpretation:** The provider supplies `name` at view granularity in the format stated by its description; omitted or redacted content remains unknown. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-owner-id-b2114d0da017" title="Owner ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `views.owner_id`

            Owner ID carries the source identifier named Owner ID for each view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match view records to provider records that carry the same owner ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `owner_id` as a record-level identifier on `Views`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-project-id-ce2a6e14d716" title="Project ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.project_id`

            Project ID carries the source identifier named Project ID for each view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match view records to provider records that carry the same project ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `project_id` as a record-level identifier on `Views`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-updatedat-4b934bf2c686" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place view records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-usage-totalviewcount-d20e783a5960" title="Usage Total View Count" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.usage_totalViewCount`

            Usage Total View Count carries the source measure named Usage Total View Count for each view row. It preserves the stated measure at this record's granularity.

            * **Enables:** measure the provider-reported usage total view count for each view record.
            * **Interpretation:** The provider supplies `usage_totalViewCount` at view granularity as a count at one value per record; zero and missing are not interchangeable. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-viewurlname-d63596bdea0c" title="View URL Name" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `views.viewUrlName`

            View URL Name carries the provider-reported view url name for each view record. It retains the exact provider location for the referenced resource.

            * **Enables:** open or trace the exact provider resource referenced by view URL name on a view record.
            * **Interpretation:** The provider supplies `viewUrlName` as a URL or resource locator on each view record. It identifies a Tableau catalog location but does not prove who can open it. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-views-workbook-id-54a4f145bbfd" title="Workbook ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `views.workbook_id`

            Workbook ID carries the source identifier named Workbook ID for each view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match view records to provider records that carry the same workbook ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `workbook_id` as a record-level identifier on `Views`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-workbook-views-fbb9aae8ea00" title="Workbook Views" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `workbook_views`

        Workbook Views contain views nested under a workbook (opt-in; site views is default).

        * **Enables:** enumerate the views nested under an opted-in workbook.
        * **Scope:** Reads the declared collection through `GET /api/{apiVersion}/sites/{siteId}/workbooks/{workbook_id}/views` as a full snapshot. This child operation is opt-in and returns views for the selected parent workbook only.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-workbook-views-contenturl-6917f771891c" title="Content URL" icon="comment-dots" iconType="sharp-duotone-solid">
            Developer identifier: `workbook_views.contentUrl`

            Content URL carries the provider-reported content url for each workbook view record. It retains the exact provider location for the referenced resource.

            * **Enables:** open or trace the exact provider resource referenced by content URL on a workbook view record.
            * **Interpretation:** The provider supplies `contentUrl` as a URL or resource locator on each workbook view record. It identifies a Tableau catalog location but does not prove who can open it. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbook-views-createdat-ef3765ff71c6" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbook_views.createdAt`

            Created At carries the source date or timestamp named Created At for each workbook view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place workbook view records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per workbook view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbook-views-id-382665cc110d" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbook_views.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same workbook view source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per workbook view record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbook-views-name-69cf0bb9c64c" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbook_views.name`

            Name carries the source-authored value named Name for each workbook view row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each workbook view record.
            * **Interpretation:** The provider supplies `name` at workbook view granularity in the format stated by its description; omitted or redacted content remains unknown. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbook-views-updatedat-07c1c48d29d6" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbook_views.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each workbook view row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place workbook view records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per workbook view record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbook-views-workbook-id-95ea7dc8ba81" title="Workbook ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbook_views.workbook_id`

            Workbook ID carries the source identifier named Workbook ID for each workbook view row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match workbook view records to provider records that carry the same workbook ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `workbook_id` as a record-level identifier on `WorkbookViews`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-tableau-workbooks-5e51b24c8892" title="Workbooks" icon="diagram-project" iconType="sharp-duotone-solid">
        Developer identifier: `workbooks`

        Workbooks contain published Tableau workbooks.

        * **Enables:** catalog published workbooks with their project, owner, size, and modification metadata.
        * **Scope:** Reads provider changes through `GET /api/{apiVersion}/sites/{siteId}/workbooks` using the declared incremental request boundary. Results are limited to objects returned for the authenticated Tableau site; identifiers and view metadata do not establish effective access.

        <AccordionGroup>
          <Accordion id="provider-permission-field-tableau-workbooks-contenturl-cf5200723c97" title="Content URL" icon="comment-dots" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.contentUrl`

            Content URL carries the provider-reported content url for each workbook record. It retains the exact provider location for the referenced resource.

            * **Enables:** open or trace the exact provider resource referenced by content URL on a workbook record.
            * **Interpretation:** The provider supplies `contentUrl` as a URL or resource locator on each workbook record. It identifies a Tableau catalog location but does not prove who can open it.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-createdat-8a1fc761c9bb" title="Created At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.createdAt`

            Created At carries the source date or timestamp named Created At for each workbook row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place workbook records on a timeline by created at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `createdAt` per workbook record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-defaultviewid-fda5629fe4c3" title="Default View ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.defaultViewId`

            Default View ID carries the source identifier named Default View ID for each workbook row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match workbook records to provider records that carry the same default view ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `defaultViewId` as a record-level identifier on `Workbooks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-description-52bb5be78a83" title="Description" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.description`

            Description carries the source-authored value named Description for each workbook row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact description value attached to each workbook record.
            * **Interpretation:** The provider supplies `description` at workbook granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-encryptextracts-ddce6db6d58b" title="Encrypt Extracts" icon="diagram-project" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.encryptExtracts`

            Encrypt Extracts carries the source true-or-false flag named Encrypt Extracts for each workbook row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select workbook records for which the provider reports encrypt extracts as true or false.
            * **Interpretation:** The provider supplies `encryptExtracts` as a boolean per workbook record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-id-de3b5a917226" title="ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.id`

            ID identifies Tableau LUID. It supplies the declared record identity used when repeated ingestions represent the same source row.

            * **Enables:** recognize repeated ingestions of the same workbook source row before constructing its represented state.
            * **Interpretation:** The provider supplies `id` at one value per workbook record, and `x-transformDedupKey` explicitly marks it as the record key. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-name-b97b5e7d6b34" title="Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.name`

            Name carries the source-authored value named Name for each workbook row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact name value attached to each workbook record.
            * **Interpretation:** The provider supplies `name` at workbook granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-owner-id-3298895cc829" title="Owner ID" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.owner_id`

            Owner ID carries the source identifier named Owner ID for each workbook row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match workbook records to provider records that carry the same owner ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `owner_id` as a record-level identifier on `Workbooks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-owner-name-d0bb41fec08f" title="Owner Name" icon="people-group" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.owner_name`

            Owner Name carries the source person or account value named Owner Name for each workbook row. It keeps the provider-reported person or account context attached to the record.

            * **Enables:** attribute the workbook record to the provider-reported actor represented by owner name.
            * **Interpretation:** The provider supplies `owner_name` as identity or attribution context on each workbook record. Names and contact values can change and are not stable identifiers unless the provider documents them as such.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-project-id-911dd1b58d24" title="Project ID" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.project_id`

            Project ID carries the source identifier named Project ID for each workbook row. It is needed to resolve references that repeat the same provider identifier.

            * **Enables:** match workbook records to provider records that carry the same project ID, without assuming that this field alone makes every row unique.
            * **Interpretation:** The provider supplies `project_id` as a record-level identifier on `Workbooks`. It identifies Tableau catalog relationships and does not establish effective access. Tableau identifiers and view metadata do not prove effective access.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-project-name-969a841b8aa6" title="Project Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.project_name`

            Project Name carries the source-authored value named Project Name for each workbook row. It keeps the exact text, label, or authored value needed to interpret the record.

            * **Enables:** inspect the exact project name value attached to each workbook record.
            * **Interpretation:** The provider supplies `project_name` at workbook granularity in the format stated by its description; omitted or redacted content remains unknown.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-showtabs-843ed9687a2c" title="Show Tabs" icon="diagram-project" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.showTabs`

            Show Tabs carries the source true-or-false flag named Show Tabs for each workbook row. It preserves the provider-reported yes-or-no condition for this record.

            * **Enables:** select workbook records for which the provider reports show tabs as true or false.
            * **Interpretation:** The provider supplies `showTabs` as a boolean per workbook record; false and missing are distinct when the field is optional.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-size-3340ce01d409" title="Size" icon="file-code" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.size`

            Size records Tableau's numeric size attribute for the workbook. It preserves the source value even though this schema does not declare its unit.

            * **Enables:** compare workbook size values within exports that use the same Tableau definition and source configuration.
            * **Interpretation:** The provider supplies `size` as an integer with no unit documented here; do not assume bytes, row count, or another scale without provider context.
          </Accordion>

          <Accordion id="provider-permission-field-tableau-workbooks-updatedat-0d4bfb7770b9" title="Updated At" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `workbooks.updatedAt`

            Updated At carries the source date or timestamp named Updated At for each workbook row. It anchors the named event or boundary on the record's timeline.

            * **Enables:** place workbook records on a timeline by updated at and select the records within an explicit reporting window.
            * **Interpretation:** The provider supplies `updatedAt` per workbook record as a timestamp at the precision returned by the provider; missing values mean the event or boundary was not reported.
          </Accordion>
        </AccordionGroup>
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Troubleshooting">
    ### Personal Access Token (recommended)

    | Error                | Meaning                        | Solution                                           |
    | -------------------- | ------------------------------ | -------------------------------------------------- |
    | `401 Unauthorized`   | Invalid PAT or expired session | Recreate PAT; confirm tokens are enabled           |
    | `403 Forbidden`      | Insufficient permissions       | Use a Site Administrator PAT                       |
    | `404 Site not found` | Wrong site content URL         | Fix Site Name (content URL slug, not display name) |

    #### PATs disabled

    Personal Access Tokens must be enabled by a server/site admin.

    #### Concurrent sign-in

    Signing in again with the same PAT can invalidate the previous session. A
    Tableau sync reuses one signed-in session across its concurrent data
    streams; if multiple Parable connections use the same PAT, keep them on
    separate schedules or use a distinct PAT for each connection.

    **[Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api.htm)** — Official API documentation

    ### Connected Apps (Direct Trust JWT)

    | Error                         | Meaning                               | Solution                                                              |
    | ----------------------------- | ------------------------------------- | --------------------------------------------------------------------- |
    | `401 Unauthorized` on sign-in | Bad JWT claims/secret or disabled app | Regenerate secret; confirm `sub` email exists; confirm app is enabled |
    | `403 Forbidden`               | Missing JWT scope or site role        | Add required `scp` values; use a user with sufficient site role       |
    | Wrong site                    | contentUrl mismatch                   | Fix Site Name (content URL slug)                                      |

    **[Configure Connected Apps with Direct Trust](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm)** — Official Tableau docs

    ### Username and password (Tableau Server)

    | Error              | Meaning                                | Solution                                          |
    | ------------------ | -------------------------------------- | ------------------------------------------------- |
    | `401 Unauthorized` | Bad username/password or MFA challenge | Use PAT instead; confirm account is not MFA-gated |
    | `403 Forbidden`    | Insufficient site role                 | Use a higher-privileged Server user               |

    **[Tableau REST API authentication](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm)** — Official docs
  </Tab>
</Tabs>