Databricks SQL

Keel calls the SQL Statement Execution API over HTTPS (no driver) with an OAuth M2M service principal or a personal access token.

Read-only role script

-- Run in a SQL editor as a metastore or catalog admin, then use the service principal in Keel.
-- Create the service principal (Settings › Identity and access) and an OAuth secret for it first.
GRANT USE CATALOG ON CATALOG main TO `keel-reader`;
GRANT USE SCHEMA ON CATALOG main TO `keel-reader`;
GRANT SELECT ON CATALOG main TO `keel-reader`;
-- The principal also needs CAN USE on the SQL warehouse (warehouse › Permissions).
-- Optional, for usage-based inference: query history.
GRANT USE CATALOG ON CATALOG system TO `keel-reader`;
GRANT USE SCHEMA ON SCHEMA system.query TO `keel-reader`;
GRANT SELECT ON TABLE system.query.history TO `keel-reader`;

Before you run it:

• Run it in a SQL editor as a metastore or catalog admin. Replace main with your Unity Catalog catalog and keel-reader with the service principal's application name.
• Give the principal CAN USE on the SQL warehouse (warehouse › Permissions) — that one is not SQL.
• The system catalog grants are optional (query history, for usage-based inference).

In Keel

Sources › Connect source › Databricks SQL: Workspace host, SQL warehouse ID, catalog, client id (or user) and client secret (or token). Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Syntax-checked only. There is no Databricks engine in CI (a fake server tests the connector), so this script is not run; every docs build lints it and a unit test keeps it identical to the product's. See Connect sources.