Data platforms

What's on this screen

Open User settings and choose Data platforms to see the Data Platform and Secret Store credentials and shared access sources available to your account. GitHub repository access is managed separately in Profile. Each row identifies its provider or credential source, Domain count and connection state.

Select a row to open its details. Back to data platforms returns to the list. Use Search domains inside a connection to find a served Domain, then select that Domain to view its resources. The resource view's Back to button names the connection, such as Back to Microsoft Entra.

A connected Identity Provider row identifies the downstream account Vibedata retains. Connections created before a readable account identity was recorded may show the provider's stable account identifier until you reconnect. Providers without a direct Domain may still appear when they provide upstream access.

How to connect a Domain requirement

1. Open Data platforms and select the disconnected credential row.
2. In its details, review the connection state, any missing permissions, and the affected Domain names.
3. Select Connect and complete the provider sign-in. Use Reconnect when an existing connection needs a renewed sign-in or consent.

When both requirements reuse one credential, Vibedata shows one row and lists each affected Domain once. Separate credentials remain separate rows, even when they belong to the same Domain. Connected describes the credential; it does not prove access to every resource in its Domains.

For saved credentials without provider permission reporting, Validate connection checks the saved credential without replacing it. If the provider rejects it, the connection needs attention and the details show the safe error reason.

How to check missing permissions

1. Open the connection's details and find Missing permissions.
2. Select Check permissions to refresh the provider's permission evidence.
3. Review the missing permission names, their purpose, and the guidance naming who can resolve them. Optional permissions are marked (optional).

This section lists missing permissions, not every permission you hold. No missing permissions. appears only when verification reports no gaps. An unchecked, partially checked, newly required or unverified result stays explicit; it is not presented as granted. Completing a check does not itself mean every permission is granted.

If Reconnect required is shown, Check permissions is disabled until you renew the connection. If Microsoft only asks you to sign in again (multi-factor or Conditional Access), the connection stays Connected, shows Reconnect to refresh access, and offers Reconnect while Check permissions stays available; that note is not a missing permission. Reconnecting can resolve user-consent gaps, but it cannot grant administrator-owned access. Follow the named administrator or owner guidance, then check again. If the credential itself is unhealthy, reconnect before relying on previous permission results.

A linked Snowflake connection shows Snowflake user: followed by your user name. If its security integration prevents role switching, send the displayed setting and grant guidance to a Snowflake administrator; reconnecting alone does not fix that restriction.

How to enter or replace a MotherDuck token

1. In Data platforms, select MotherDuck.
2. Choose Connect for a disconnected personal credential, or Manage token for a healthy saved credential. Reconnect also opens the token form when the saved credential needs attention.
3. Enter Token or Replacement token.
4. Choose Connect or Replace token to save it. Back to MotherDuck returns to the connection details.

The saved token is never displayed. Replacing it preserves the affected Domain mappings. A MotherDuck source managed by the deployment is shared access, so it has no personal token form.

How to disconnect a personal connection

1. Open the connection's action menu and choose Disconnect. The action is also available from a personal connection's list-row menu.
2. Review the confirmation. An Identity Provider explains the delegated access that will stop. A stored credential lists its affected Domains and requirements.
3. Select Confirm disconnect.

For MotherDuck, Disconnect MotherDuck? removes your saved token from Vibedata. Future access through that connection needs a token again. It does not revoke the token in MotherDuck, delete databases, or remove provider grants.

For an Identity Provider, disconnect removes the stored token Vibedata uses to act on your behalf. Delegated access depending on it stops until you reconnect; you are not signed out of Vibedata. Domain requirement mappings remain intact.

The stored-credential confirmation retains the connection you reviewed. If another change makes that review stale, reload and review the affected requirements again before confirming. Vibedata does not silently retry your previous decision against a changed connection.

How to inspect shared access

Under ambient authentication, a row can represent an operator-managed host credential, a deployment credential, or access that requires no credential. Its second line names the identity Vibedata acts as, such as an Azure user, an AWS ARN, a Databricks user or a GitHub login. Its details name the source, including values such as tenant, profile, host, connection, authenticator or override source, show Managed by the operator or Managed by the deployment, and list the Domains it serves. The identity remains Identity not reported when the source does not report one.

Vibedata checks each row when the page opens, using the credentials the host already holds, and Check connection checks it again with a fresh credential; pressing it again within 10 seconds shows the first result. Other results are cached for about a minute. A GitHub source is verified by asking GitHub who the token belongs to, so a revoked token shows Expired. Connected means the provider accepted the credential, not that you can reach any particular resource. Resource access is checked separately. A row that needs attention shows the command to run on the Vibedata host, such as az login. The command follows the source: AWS rows name aws configure sso or aws configure for access keys (with the profile when one is in use), or the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN variables when the keys come from the environment, and a Google row whose credentials come from GOOGLE_APPLICATION_CREDENTIALS asks you to check or replace that key file instead of running gcloud. The Snowflake default connection is read from connections.toml without connecting and shows Not tested until you choose Test connection, which connects with a 30 second limit. Vibedata refuses a Snowflake connection that signs in through a browser or MFA prompt and shows Interactive sign-in; use a key pair, programmatic access token or workload identity instead. Shared sources never offer Connect, Reconnect, Manage token, or Disconnect. Follow the source guidance if the operator or administrator needs to renew or configure access. Local and internal sources can report Not required because they need no credential.

How to inspect Domain and Intent resources

1. Open a connection and select one of its Domains.
2. Use Filter by kind or Search resources to narrow that connection's resources in the selected Domain.
3. Expand a resource to inspect its Resource id and, after a failed check, the full Last check error. Use Check or Fix as offered by that resource.
4. Use the named Back to button to return to the connection.

The resource view includes the selected connection's Domain and Intent resources. It does not combine other connections' access in the same Domain or claim an aggregate grant count. Granted is recorded access for the current identity. Not checked means there is no current recorded successful check; it does not prove that no check was ever attempted. Not granted is shown when a returned record explicitly carries an unsuccessful status with a recorded time. A failed action shows its error on the resource.

Use Check to verify access. Fix is offered for resources where Vibedata can apply access. On a shared BigQuery or Databricks Intent, a schema another member's run created after you first opened the Intent may not be yours to read yet. Fix grants you access to the Intent's current schemas; each member runs it for themselves. Under shared ambient access, these actions use the deployment's identity rather than granting a personal identity.

The list distinguishes having no accessible Domains, having no resources, and having no matches for your filters. It shows resource-level results and a pager, not an aggregate count of grants across a Domain. Either filter returns to the first page.

There is no separate Domain resources menu entry: the retired standalone URL redirects to Data platforms. Connection and domain resource details have their own URLs, so you can bookmark or reload them. Use Back to data platforms or Back to [connection name] to return.

How to provision a demo Domain

1. On User settings → Profile → Repository access, connect GitHub with Connect GitHub, or use Re-authenticate if Vibedata reports that the connection needs attention.
2. Open Domains from the global rail. On the Domain landing page, choose the Demo domain card ("A private, sample-filled domain. Data included, nothing to configure.").
3. Leave the page open while Provisioning your demo domain… is shown. You can also return later; Vibedata resumes displaying the active run.
4. When the card shows Ready and Open your demo domain., choose the card to open the Domain.

For first-time Domain Owners, Vibedata continues onboarding inside the provisioned Domain. Open one of its restored Intents, then send your first message in that Intent. This Demo journey is tracked separately from the ordinary new-user setup tour, so an existing Domain membership does not hide it.

What you'll see

• GitHub is not ready — the Demo domain card is disabled and reads Connect GitHub first — a demo domain is created in a repository.
• In progress — the card reads Provisioning your demo domain… and is disabled.
• Success — the card shows Ready and Open your demo domain.
• Failure — the card shows a safe explanation followed by Select to try again.
• Connected — the credential or shared source is available; resource grants are checked separately.
• Disconnected — open a personal connection and choose Connect. A row with no linked account does not show an account identity.
• Reconnect required — open the personal connection and choose Reconnect. A retained connection may still identify its account while it needs attention.
• Not installed, Not signed in, Expired, Ambiguous, Sign-in failed, Interactive sign-in — the shared source needs attention from its operator on the host; the row shows the command to run.
• Couldn't verify — the check timed out or the provider was unreachable; check again.
• Not checked — a shared source has no current availability observation.
• Not tested — the Snowflake default connection was read but not connected; choose Test connection.
• Not required — the source needs no credential.

Quick reference

Control	What it does
Connect	Starts the personal provider sign-in or token form.
Reconnect	Renews a personal sign-in or opens the replacement-token form.
Check permissions	Refreshes provider permission evidence.
Validate connection	Checks a saved personal credential without permission reporting.
Check connection	Checks a shared source when supported, minting a fresh credential.
Manage token	Opens the write-only replacement-token form.
Disconnect	Opens the personal connection's confirmation.
Confirm disconnect	Removes Vibedata-held credential material after review.
Search domains	Filters the Domains served by the selected connection.
Check / Fix	Verifies or applies access for the selected resource, as supported.