Tableau Cloud Audit

Why this project exists

I want to inspect a Tableau Cloud environment with SQL, keep a history across collections and understand exactly what data is being shared. The collector brings site metadata and activity into a local DuckDB package.

How it is structured

The collector is a working alpha that uses Tableau’s REST API, Admin Insights through the VizQL Data Service, and the Metadata API. Users, groups, content, permissions, activity and lineage are collected; coverage depends on access and available sources. The package file schema describes every table.

Why local. Why DuckDB.

Local collection lets you inspect the package before deciding what to share. DuckDB keeps queryable tables in one file: no database service to operate, and SQL you can run again after the next collection.

A deliberate separation

The collector gathers and structures data. The analyst still needs to decide what it means. An inactive account is a candidate for review, not automatically a licence that can be removed.

tca export creates a separate copy without the identity vault. Inspect that export and What we collect before sharing; the original local package contains identity information.

Try the workflow

Start with Getting started for installation, Python requirements and PAT configuration. Once configured:

tca verify
tca collect
tca summary
tca export

Your first query

Open the collected package with DuckDB and inspect the available tables. This query uses DuckDB’s catalogue, so it does not depend on a particular alpha schema.

SELECT table_schema, table_name
FROM information_schema.tables
WHERE table_schema IN ('meta', 'state', 'history')
ORDER BY table_schema, table_name;

For analysis queries, start with the query cookbook.

See the collector in use

Show the repository demonstration

Demonstration from the project repository; not a customer audit.

What I want to learn next

The next step is testing against real environments: setup friction, unavailable sources, interrupted runs and output that needs clearer explanation. Interfaces and schema may still change.

You can test the open-source collector without buying anything. Share sanitised feedback through GitHub, or contact me to discuss a test. Do not post credentials or customer databases in public issues.