Workspace

The workspace pool is flat and live: workspace.{table}. It is a safe projection of control-plane metadata, not a copy in the lake. Reads see the configuration from the most recent catalog build. A configuration edit invalidates the cached catalog, so the next read reflects the new value.

Provider configuration tables (available)

Each connected provider gets its configuration as tables, one row per connection, keyed by tenant_connector_id. Column names follow the provider’s configuration schema, lowercased; when the schema changes, the table changes with it.

Table	Contents
`workspace.{provider}_ingestion_config`	Ingestion settings you entered for that provider (for Google: `domain`, `adminemail`).
`workspace.{provider}_authentication_config`	Non-secret authentication settings (for Google: `clientemail`, `projectid`).
`workspace.parent_data_filters`	Which parent records ingestion is limited to: one row per allowlisted value, with `parent_tap`, `field`, `operator`, `value`, and `threshold`.

Fields marked secret in a provider’s schema (private keys, tokens, client secrets) are never columns in these tables. Lists of objects in a configuration become child tables named {table}__{field}, joined on parent_pk and ordinal. Which users is Google ingestion limited to?

SELECT f.parent_tap, f.value
FROM workspace.parent_data_filters AS f
JOIN workspace.google_ingestion_config AS c
  ON c.tenant_connector_id = f.tenant_connector_id
WHERE f.operator = 'any_of'
ORDER BY f.value

Planned tables

These tables are specified but not yet available:

Table	Contents
`workspace.users`	Workspace members (id, email, name, title, status).
`workspace.providers`	Connected tools and sync status.
`workspace.provider_connections`	Enabled taps on those connections.
`workspace.roles`	Roles. Names are display values and can change.
`workspace.role_permissions`	Permission strings on each role.
`workspace.user_roles`	Which users hold which roles.
`workspace.parables`	Parables in the workspace.
`workspace.sql_plots`	Plots (slug, schedule, enabled).
`workspace.query_runs`	Plot run history and spend.

Secrets, tokens, sessions, and credential material are not in this pool. A common join is workspace members against a directory tap:

SELECT
  u.email,
  u.name,
  gu.orgunitpath,
  gu.isadmin
FROM workspace.users AS u
JOIN providers.google.users AS gu
  ON gu.primaryemail = u.email

workspace.users.email and provider person-email columns are the same scalar (Contact.Email), so that join is valid. Person-email columns are marked x-transformPersonEmail on the tap schema; see How taps project into tables. Google Workspace users are at providers.google.users. Language-specific Flight SQL clients are on Querying the lake.

Getting Started

SDKs

Connectors

Parable Data Engine

Provider configuration tables (available)

Planned tables

​Provider configuration tables (available)

​Planned tables

Provider configuration tables (available)

Planned tables