Service Accounts

The Tableau Personal Access Token Rapid BI Catalog uses to run scheduled documentation jobs — and the minimum permissions it needs.

Service accountPATSchedulingAdmin only

Scheduled jobs run unattended, so they cannot rely on an end user being signed in. Instead they authenticate with a dedicated Service Account — a Tableau Personal Access Token (PAT) you configure in BI Server Configuration.

A Service Account is required for scheduling
Interactive processing uses the signed‑in user's own Tableau Connected App token. A Service Account is used only by scheduled jobs to download the selected workbooks — so to schedule Tableau jobs for a site, you must configure one.

Scope — per‑site or per‑server

  • Tableau Cloud — the Service Account is configured per site, because a Cloud PAT only authenticates against the site it was created in.
  • Tableau Server — one Service Account is configured per server and covers all of that server's sites.

Minimum Tableau permissions

The Service Account only ever reads and downloads content. Across the full job lifecycle it uses these REST operations:

  • Sign in with the PAT
  • A server‑info reachability probe
  • List projects and workbooks
  • Get a workbook and download it (with includeExtract=False)

It therefore needs read/download access to the projects and workbooks you intend to document, and must be an explicit member of the relevant sites. It never publishes, writes, moves, or deletes content.

No extract data and no Metadata API
Because workbooks are downloaded with includeExtract=False and lineage is parsed from the workbook itself, the Service Account does not need "Download Full Data" / View Underlying Data, and no Tableau Metadata API access is required.

Keep‑alive

Tableau expires a PAT after 15 days of inactivity. To prevent that, Rapid BI Catalog automatically re‑signs each Service Account's PAT once it has been idle for 7 days, keeping it valid between scheduled runs.

Next Steps