Systems and connections¶
Navigate: Configure → Systems (/systems).
A system is one database, warehouse, lake or application that Paridity reads from. Mappings compare an object in one system against an object in another.
Credentials never enter Paridity¶
connection_ref is a URI pointer into your secrets backend, resolved at run
time by the worker. The platform stores the pointer, never the secret.
aws-secrets://arn:aws:secretsmanager:us-east-1:123:secret/name
azure-keyvault://vault-name/secrets/secret-name
gcp-secretmanager://projects/proj/secrets/name/versions/latest
infisical://environment/path/SECRET_NAME
vault://secret/path/to/credential
The form offers shortcut chips for the common schemes plus a dev-only env://.
vault:// is accepted but has no chip — type it. A value that doesn't start
with a supported scheme is rejected with an explicit list of what is allowed.
When you edit a system whose secret is already stored, the field is replaced by
two choices — Leave unchanged or Replace with new value — so you never
have to re-enter a pointer you aren't changing. Test entered credential
(testing a replacement value before you save it) needs the right to change the
system's connection reference (system.update, or system.create); without it
the button is disabled, and Test connection on the stored value still works
for anyone who may run discovery (discovery.execute).
Connectors¶
Choose a connector first; the rest of the form adapts to it. Cards are grouped as SQL Database, Data Warehouse, Lake / Files, Application and Streaming / CDC, with an Active only filter.
| Status | Meaning |
|---|---|
| (no badge) | Production-ready. |
| Beta | Usable, with narrower verification. (None currently.) |
| Future Release | Visible but disabled — cannot be configured. SAP Application, Kafka CDC Stream. |
Sixteen production connectors: Oracle, SQL Server, PostgreSQL, MySQL/MariaDB, IBM Db2 LUW, SAP HANA, Snowflake, Google BigQuery, Amazon Redshift, Databricks, Trino/Hive, ClickHouse, File Dataset, Qlik Cloud, Salesforce, Object Store (inventory-level — it verifies your landing zone's object inventory against a manifest or mirror; file contents are File Dataset's job). ClickHouse has its own page: ClickHouse (provisioning, versions, read modes).
Most offer a Deployment Flavor — for example Oracle covers on-prem, Amazon RDS, Exadata and RAC; PostgreSQL covers self-managed, RDS, Aurora, AlloyDB and Azure; File Dataset covers Parquet, CSV, JSONL, Avro, ORC, fixed-width and QVD. The flavor sets sensible defaults and, for some, changes the guidance shown.
Looking for Iceberg or Delta Lake? They are table formats, not systems, so they are not connector cards. The picker shows a Table formats row (and finds them when you search "iceberg" or "delta"): choose a format, then the engine that reads it - Trino, Databricks, Snowflake or File Dataset - and the normal system form opens for that engine. On a Trino system, Test Connection reports the catalog in play. See Lakehouse tables (Iceberg) and Delta Lake outside Databricks.
Configuring a system¶
| Field | Notes |
|---|---|
| Name | Required, unique per tenant. Used in mappings and replication profiles. |
| Business Domain | Required when creating. Drives access scoping. |
| Description | Optional operator note. Not a secret. |
| Deployment Flavor | See above. |
| Connection Reference | The secrets pointer. Required. |
| Enabled | Edit mode only. A disabled system cannot be selected for new mappings. |
Advanced¶
| Field | Range | What it does |
|---|---|---|
| Max Concurrency | 1–20 in the form (the platform supports up to 50) | A hard ceiling. No mapping can exceed this for this system, regardless of its own setting. The recommended value for the chosen connector is shown. |
| Query timeout (seconds) | 10–3600 | Overrides the platform default for this system. |
| Default source / target watermark type | free text | Pre-fills new mappings. |
| Default schema | text | Scopes discovery and browsing. Leave blank to expose everything. |
| Cost per TB scanned / egress (USD) | ≥ 0 | Feeds Cost & Usage. Scan bytes are priced at each system's own scan rate, and egress is priced per side: bytes pulled from the source are billed at the source system's egress rate, bytes pulled from the target at the target system's rate (#2413). Runs recorded before per-side egress accounting have only a combined byte count and stay priced at the source rate; the Cost & Usage page footnotes them when any fall in the window. Only engines that report bytes scanned (Snowflake, Databricks, BigQuery, file datasets, Qlik Cloud, Trino/Hive, and — harvested from the engine catalogue — Oracle, SQL Server, Redshift (#2456) and Db2 LUW (#2457)) produce scan volume; for every other engine, PostgreSQL included by design (#2457), Cost & Usage says not measured rather than $0. On the harvested engines the bytes are a calibration denominator, not a vendor-metered unit: they bill by instance/RPU/cluster hours or per core. Leave blank to inherit the tenant default. |
| Scheduled rate changes | edit mode | Set a future effective date for renegotiated rates. Historical cost is never rewritten. |
| Tags | key/value | Keys accept [a-zA-Z0-9_:.-], 1–64 characters. |
Connector-specific fields¶
- Qlik Cloud — Scratch space (a shared space where the Paridity identity can create ephemeral reload apps; engine reads fail until it is set) and Reload timeout (30–3600s). Reload compute runs on your Qlik capacity, so keep concurrency at 2–4.
- Oracle — Server OS timezone. Required for SCN-based watermark windowing when the server clock is not fixed UTC, because Oracle resolves SCN↔time in the server's frame. Validated live on connect.
- PostgreSQL / MySQL — Transport encryption (TLS). Connections are
encrypted by default and refused otherwise — there is no silent
plaintext fallback. The default, Require encryption, negotiates TLS
with no certificate setup needed; Verify CA / Verify identity
additionally authenticate the server against a CA certificate (supply it
via
sslrootcert=in the DSN inside your secret for PostgreSQL, or thessl_cakey in the secret for MySQL) and are recommended for any hop crossing a network segment you do not fully control. Disable is an explicit opt-out for a genuinely trusted, isolated segment: the form shows a warning, the change is recorded in the audit log, and every connection made with a weakened mode is logged. A directive inside the secret payload (sslmode/ssl_mode) — or, for PostgreSQL, embedded in the DSN — is also honored; the System-form setting wins when both are present. For MySQL the enforcement is proven server-side on every connect (the session's own negotiated cipher is checked), because the MySQL driver cannot refuse plaintext on its own. Note: MySQL 8 servers enable TLS out of the box; MariaDB does not — a MariaDB system needs TLS configured on the server or an explicit Disable decision.
Testing a connection¶
Test Connection appears on the edit form and reports success with a latency,
or the failure reason - its first line, at most 200 characters (a timeout reads
timeout); the full driver message is in the server log under the request's
reference (X-Request-ID). When you are replacing a stored secret the button becomes
Test Entered Credential, so you can validate the new pointer before saving.
For Qlik Cloud it additionally renders a space access matrix showing, per space, whether the identity is assigned (engine-readable) or merely visible — with remediation text. That distinction is the usual cause of "it lists but won't read".
Test Connection is available while creating a system too, so you can validate a secrets pointer before committing anything. Nothing is saved by the test — it resolves the pointer through your secrets backend, dials, and reports the result. Because it takes a pointer rather than credentials, it can only reach secrets your deployment already holds.
If a PostgreSQL or MySQL test fails mentioning TLS or SSL: the server could not provide an encrypted transport and Paridity refused to proceed unencrypted (the fail-closed default). Either enable SSL on the database server — the right fix for anything reaching production — or, if this hop is genuinely on a trusted, isolated network, set Transport encryption to Disable on the system. Paridity never falls back to an unencrypted connection on its own.
Browsing a system¶
The folder icon on any row opens Browse schemas & tables: schema counts, table and view counts, a filter, and per-table columns with types, nullability and detected primary/unique keys — with a suggested PK for reconciliation.
If nothing appears, that is expected for connectors with no schema concept (file datasets, object stores, Salesforce), or where credentials are unavailable in that environment. Trino does introspect — it lists the schemas and tables in the connection's catalog.
Deleting¶
A system cannot be deleted while anything still points at it — mappings or replication profiles. The message tells you how many of each, so you can clear them in one pass rather than discovering the second blocker after removing the first.
A delete that fails leaves the reason on screen and the button available, so you can fix the cause — usually a mapping still referencing the system — and retry without reopening the dialog.