Data Sources
A datasource is one governed database or API connection that Dataira can inspect and query through a bounded source contract.
Supported databases
| Database | Status | Connection options |
|---|---|---|
| PostgreSQL | Supported | Remote or Tunnel |
| MySQL | Supported | Tunnel |
| BigQuery | Supported | Service account JSON |
| ClickHouse | Supported | Remote or Tunnel |
Snowflake, DuckDB, SQLite, Trino, and other engines are not currently supported as Dataira datasources.
API sources
The OpenAPI v2 preview accepts same-origin OpenAPI 3.x JSON or YAML through
private pinned-IP TLS egress. It compiles only explicitly reviewed GET or
POST operations declared as a side-effect-free query or computation.
Credentials, identity and policy bindings stay server-side; typed projections,
timeouts, row/byte/request budgets, local references, and immutable contract
snapshots bound execution. Remote references, redirects, private destinations,
undeclared parameters, and unknown response shapes fail closed.
Plaintext constant parameter bindings are rejected. Put service credentials in
the encrypted server header configuration; a future secret-reference contract
may add non-header constants without exposing their values in manifests.
Check sourceConnectors.capabilities() before configuration and execution.
Synchronous operations work in preview; async is modeled in the contract but
runtime execution currently rejects it. See the reproducible
FretGuard OpenAPI pilot.
The dev SDK demo's Company Spend datasource uses the OpenAPI-shaped adapter through a private Cloudflare Worker service binding. It proves deterministic per-visitor values, normalized query/metric/dashboard behavior, policy enforcement, revocation, and isolated reset without depending on a partner endpoint.
Generic MySQL uses the private tunnel so Dataira speaks the native MySQL protocol without converting an arbitrary database endpoint into an HTTP API. Direct MySQL setup fails closed. PostgreSQL and ClickHouse may use Remote when their endpoint satisfies the documented TLS and network requirements.
Management surfaces
Platform Data Sources starts with one Add data source flow. It groups
PostgreSQL, MySQL, ClickHouse, and BigQuery under Databases, OpenAPI under
APIs, and reserves Connected apps for future managed connectors such as
GA4. Database setup reuses the guided direct/tunnel onboarding and bounded schema
analysis. OpenAPI uses deterministic contract analysis without executing an
operation or asking business questions. OpenAPI v2 sources can be registered from Platform, @dataira/node, REST, or MCP
create_openapi_source; all use the same idempotent, actor-bound command and
server-side credential storage.
See Source analysis for the shared database/OpenAPI workflow, the MCP question loop, and the no-live-call OpenAPI boundary.
Platform calls these authored contracts Data Contexts. Their portable API/SDK
form, Partner Analytical Packs, links to sources through immutable sourceId, source
generation, spec revision, and contract hash bindings. Publishing never makes a
source available to extra users: the environment token catalog, per-user source
allowlist, row/column policy, and runtime generation fences still apply.
V1 has one active context per Environment. Future organization and end-user overrides may select a different already-published context, but selection is always intersected with the caller's existing source and data policy and can never grant broader access.
Connection flow
Good practice
Use read-only credentials and the smallest useful tables or operations. Keep deterministic business calculations in the partner API. Exclude sensitive fields unless an explicit governed policy requires them.