Spreadsheets and databases

Spreadsheets and databases connect under Integrations. The general rules (kinds of connection, card statuses, Read only, disconnecting) are on the Connecting services page.

PostgreSQL is the only database in the catalog. Another database (MySQL, MS SQL and so on) cannot be connected directly; if a system on top of it has an HTTP API, connect it as a Custom API. Yandex DataLens dashboards and datasets connect through a separate integration.

Google Sheets

Sheets, cells and ranges of Google spreadsheets. More on the integration page.

What the agent can do

Reads sheets and ranges and writes values into cells if the account has edit rights.

Open the spreadsheet at the link … and total the Revenue column for October. Do not change anything in the spreadsheet.

Open in chat

Before you start

A Google account that sees the spreadsheets you need at sheets.google.com: the agent sees exactly the spreadsheets it sees.

Steps

1

Click Connect via Google

In the Google Sheets card click Connect via Google and sign in to the right account in a separate window.

2

Give the agent the spreadsheet link

The Sheets API has no file list, so name the spreadsheet by its link or ID: the agent does not search by name.

Permissions to grant

  • Writing: the account needs the Editor role. Ask the file owner to click Share and add the account with that role. With Viewer or Commenter the agent only reads.
  • One spreadsheet: connect a separate Google account without your files and share only the spreadsheet you need with it through Share. The agent sees only what you shared with that account.

Limitations

  • Google Drive is not part of the access: the agent works with spreadsheets only.
  • An uploaded .xlsx file cannot be read over the API. Open it and choose File → Save as Google Sheets, then work with the copy.

How to revoke access

Click Disconnect here. Access to a single spreadsheet is closed in the spreadsheet itself: remove the connected account from Share.

Troubleshooting

  • The agent cannot find the spreadsheet: give the link, not the name, and check that the spreadsheet is visible to the connected account.
  • Writing fails: the account has the Viewer or Commenter role.
  • A corporate domain blocks access: the Google Workspace admin opens Security → Access and data control → API controls and marks the app as Trusted.

PostgreSQL

Read-only SQL over Supabase, Neon, Yandex Managed PostgreSQL, RDS and your own database. More on the integration page.

What the agent can do

Runs read queries: SELECT, WITH, SHOW and EXPLAIN, one query per call. INSERT, UPDATE and any DDL are refused, even if the role has the rights.

Before you start

  • Owner access to the database to create a role.
  • A public database address and an open port for the fixed Samreshuuu addresses listed in the requirements on the PostgreSQL connection page.

Steps

1

Create a read-only role

In the Supabase or Neon SQL Editor, otherwise in psql as the owner: CREATE ROLE analytics_ro LOGIN PASSWORD '…'. The role's password becomes the connection password.

2

Grant read rights

GRANT pg_read_all_data TO analytics_ro (PostgreSQL 14 and newer). For older versions: GRANT USAGE ON SCHEMA and GRANT SELECT ON ALL TABLES IN SCHEMA for every schema, not only public.

3

Open access to the database

Allow the database port in the firewall and hostssl in pg_hba.conf for this role, database and the addresses from the requirements. At a cloud provider set up the same rules.

4

Fill in the form

Host (the server name from the certificate, without a protocol), Port, Database, the role's Username and Password. For your own CA upload the Root certificate (sslrootcert) in PEM.

Permissions to grant

Read only: pg_read_all_data or SELECT on the schemas you need. The role needs no write rights, the connection would not use them anyway.

Limitations

  • pg_read_all_data does not bypass row-level security, and Supabase enables it almost everywhere: without a SELECT policy such tables return zero rows.
  • The connection always uses TLS with chain and server name verification. The host must match the name in the certificate; an IP address needs an IP SAN.
  • With the Supabase pooler the project's .<ref> is added to the username.

How to revoke access

Click Disconnect here. In the database drop the role or change its password.

Troubleshooting

  • A table returns zero rows: row-level security is on with no SELECT policy for this role.
  • Connecting fails: a successful read from DataLens or a check from the machine itself does not prove the database is open to the Samreshuuu addresses. Check the firewall and pg_hba.conf rules for exactly those addresses.
  • Certificate error: the host does not match the name in the certificate, or your own CA's root certificate is not uploaded.

Frequently asked questions

Can I give the agent access to a single Google spreadsheet?

The agent sees the spreadsheets the connected Google account sees. To open just one, connect a separate account and share only that spreadsheet with it through Share. The agent finds the spreadsheet by its link, not by its name.

The agent cannot open an Excel file uploaded to Google Sheets. What do I do?

An uploaded .xlsx cannot be read over the API. Open it, choose File → Save as Google Sheets, and give the agent the link to the copy.

Can the agent write to my PostgreSQL database?

No. The PostgreSQL connection is read-only: SELECT, WITH, SHOW and EXPLAIN are allowed, write queries and DDL are refused. Create a dedicated read-only role for it.

I have MySQL or another database. Can I connect it?

PostgreSQL is the only database in the catalog. If your system has an HTTP API, connect it on the Custom API tab.

See also

Was this page helpful?

Didn't find an answer? How to reach us