- Query Service overview
- Query Service packaging
- Query Service guardrails
- Get started
- Data Distiller
- Data Distiller statistics and machine learning
- Data Distiller audiences
- Examples
- Overview
- Abandoned browse
- Attribution analysis
- Bot filtering
- Bot filtering using statistics and machine learning introduction
- Create a trended report of events
- Consent analysis
- Customer lifetime value
- Data exploration
- Decile-based derived datasets
- Fuzzy match
- List the page views of a user
- List visitors by their page views
- Predict customer churn using SQL
- Propensity score
- Retrieve similar records with higher-order functions
- Return and use merchandising variables from analytics data
- SQLAlchemy
- View the roll-up report for a visitor
- Web and mobile analytics insights
- Key concepts
- Data Distiller Hypercubes
- Connect clients to Query Service
- Query Service UI
- Query Service API
- Data Distiller Authorization API
- Data Governance
- Best practices
- SQL reference
- Frequently asked questions
- IP address allowlist
- API reference
- Platform release notes
Credentials guide
Adobe Experience Platform Query Service allows you to connect with external clients. You can connect to these external clients by using either expiring credentials or non-expiring credentials.
The credentials panel is not automatically available to all users. Please contact your Adobe account team to request the Credentials tab to be included in the Query Service workspace should you require it. If requested, this change is organization wide and is conducted by Adobe’s engineering team. It is not a setting controlled by users.
Expiring credentials
You can use expiring credentials to quickly set up a connection to an external client.
The Expiring credentials section provides the following information:
- Host: The name of the host to connect your client to. This incorporates the name of your organization as seen in the top ribbon of the Platform UI.
- Port: The port number of the host to connect to.
- Database: The name of the database to connect a client to.
- Username: The username used to connect to Query Service.
- Password: The password used to connect to Query Service. Passwords in the UI have been hashed for security. Select the copy icon (
) to copy your complete, un-hashed credentials to the clipboard. - PSQL command: A command that automatically has inserted all the relevant information for you to connect to Query Service using PSQL on the command line.
- Expires: The expiry date and time for the expiring credentials. The default validity duration of the token is 24 hours but it can be changed in the advanced settings of the Admin Console.
To change the session life for your expiring credentials connection to Query Service, navigate to the Admin Console and select the following on screen options: Settings > Privacy and Security > Authentication Settings > Advanced settings > Max session life.
See the Adobe Help documentation for more information on the Advanced settings offered by Admin console.
Connect to Customer Journey Analytics data within query sessions
Use the Customer Journey Analytics BI extension with Power BI or Tableau to access your Customer Journey Analytics data views with SQL. By integrating Query Service with the BI extension, you can access your data views directly within Query Service sessions. This integration streamlines functionality for BI tools that use Query Service as their PostgreSQL interface. This functionality eliminates the need to duplicate data views in BI tools, ensures consistent reporting across platforms, and simplifies the integration of Customer Journey Analytics data with other sources in BI platforms.
See the documentation to learn how to connect Query Service to a variety of desktop client applications such as Power BI or Tableau
A Customer Journey Analytics workspace project and a data view are required to use this functionality.
To access your Customer Journey Analytics data in either Power BI or Tableau, select the Database dropdown menu, then select prod:cja from the available options. Next, copy your Postgres credentials parameters (Host, Port, Database, Username, and others) for use in your Power BI or Tableau configuration.
When you connect Power BI or Tableau to Customer Journey Analytics, the Query Service ‘concurrent sessions’ entitlement is consumed. If additional sessions and queries are required, an additional ad hoc query users pack add-on can be purchased to obtain five additional concurrent sessions and one additional concurrent query.
You can also access your Customer Journey Analytics data directly from the Query Editor or Postgres CLI. To do this, reference the cja database when writing your query. See the Query Editor query authoring guide for more information on how to write, execute, and save queries.
See the BI extension guide for complete instructions on accessing your Customer Journey Analytics data views with SQL.
Non-expiring credentials
You can use non-expiring credentials to set up a more permanent connection to an external client.
Non-expiring credentials have the following limitations:
- Users must log in with their username and password in the format of
{technicalAccountId}:{credential}. More information can be found in the Generate credentials section. - By default, non-expiring credentials are granted permissions to execute only
SELECTqueries. To runCTASorITASqueries, manually add the “Manage Dataset” and “Manage Schemas” permissions to the role associated with the non-expiring credential. The “Manage Schemas” permission can be found under the “Data Modeling” section, and the “Manage Datasets” permission is located under the “Data Management” section of the Adobe Developer Console. - Third-party clients may perform differently than expected when listing out query objects. For example, some third-party clients such as DB Visualizer will not display the view name in the left panel. However, the view name is accessible if called within a
SELECTquery. Similarly, PowerUI might not list the temporary views created through SQL for selection in dashboard creation.
Prerequisites
Before you can generate non-expiring credentials, you must complete the following steps in Adobe Admin Console:
- Log into Adobe Admin Console and select the relevant Org from the top navigation bar.
- Select a product profile.
- Configure both the Sandboxes and Manage Query Service Integration permissions for the product profile.
- Add a new user to a product profile so they are granted its configured permissions.
- Add the user as a product profile admin to allow an account creation for any active product profile.
- Add the user as a product profile developer in order to create an integration.
To learn more about how to assign permissions, please read the documentation on access control.
All the required permissions are now configured in Adobe Developer Console for the user to use the expiring credentials feature.
Generate credentials
To create a set of non-expiring credentials, return to the Platform UI and select Queries from the left navigation to access the Queries workspace. Next, select the Credentials tab followed by Generate credentials.
A dialog appears that allows you to generate credentials. To create non-expiring credentials, you must provide the following details:
- Name: The name of the credentials you are generating.
- Description: (Optional) A description for the credentials you are generating.
- Assigned to: The user to which the credentials will be assigned. This value should be the email address of the user who is creating the credentials.
- Password (Optional) An optional password for your credentials. If the password is not set, Adobe will automatically generate a password for you.
Once you have provided all the required details, select Generate credentials to generate your credentials.
When Generate credentials is selected, a configuration JSON file is downloaded to your local machine. Since Adobe does not record the generated credentials, you must securely store the downloaded file and keep a record of the credential.
Additionally, if the credentials are not used for 90 days, the credentials will be expunged.
The configuration JSON file contains information such as technical account name, technical account ID, and credential. It is provided in the following format.
{"technicalAccountName":"9F0A21EE-B8F3-4165-9871-846D3C8BC49E@TECHACCT.ADOBE.COM","credential":"3d184fa9e0b94f33a7781905c05203ee","technicalAccountId":"4F2611B8613AA3670A495E55"}
After you have saved your generated credentials, select Close. You can now see a list of all your non-expiring credentials.
You can either edit or delete your non-expiring credentials. To edit a non-expiring credential, select the pencil icon (
). To delete a non-expiring credential, select the delete icon (
).
When editing a non-expiring credential, a modal appears. You can provide the following details to update:
- Name: The name of the credentials you are generating.
- Description: (Optional) A description for the credentials you are generating.
- Assigned to: The user to which the credentials will be assigned. This value should be the email address of the user who is creating the credentials.
Once you have provided all the required details, select Update account to complete the update to your credentials.
Use credentials to connect to external clients
You can use either the expiring or non-expiring credentials to connect with external clients, such as Aqua Data Studio, Looker, or Power BI. The method of input for these credentials will vary depending on the external client. Refer to the external client’s documentation for specific instructions on the use of these credentials.
The image indicates the location of each parameter found in the UI except for the password of the non-expiring credentials. While non-expiring credentials are provided by their JSON configuration files, you can view your expiring credentials under the Credentials tab in the UI.
The table below outlines the parameters that are typically required to connect to external clients.
When connecting to a host using non-expiring credentials, it is still necessary to use all the parameters listed in the EXPIRING CREDENTIALS section except for the password and username.
The format for entering your username and password uses colon separated values as seen in this example username:{your_username} and password:{password_string}.
| Parameter | Description | Example |
|---|---|---|
| Server/Host | The name of the server/host that you are connecting to.
|
acme.platform.adobe.io |
| Port | The port for the server/host you are connecting to.
|
80 |
| Database | The database that you are connecting to.
|
prod:all |
| Username | The username for the user who is connecting to the external client.
|
ECBB80245ECFC73E8A095EC9@AdobeOrg |
| Password | The password for the user who is connecting to the external client.
|
|
Next steps
Now that you understand how both expiring and non-expiring credentials work, you can use these credentials to connect to external clients. For more information detailed information about external clients, please read the connect clients to Query Service guide.
