> ## Documentation Index
> Fetch the complete documentation index at: https://docs.validio.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP IQ

> Connect Validio to SAP IQ to monitor and validate your operational data.

SAP IQ (formerly Sybase IQ) is a column-oriented relational database management system designed for high-performance analytics and data warehousing. Integrate Validio with your SAP IQ database to monitor, analyze, and validate your data assets.

In addition to monitoring and validation, Validio can build data [Lineage](https://docs.validio.io/v11.0/docs/lineage.md) for SAP IQ by reading its query logs, including the statements that run inside stored procedures. This requires making the query log files available in S3-compatible object storage. See [Lineage requirements](#lineage-requirements).

To integrate with SAP IQ,

1. Create a user in SAP IQ with the appropriate permissions for Validio. See [Prerequisites](#prerequisites).
2. Create a Validio credential to connect to the SAP IQ account. See [Add a SAP IQ Credential](#add-a-sap-iq-credential).
3. Create a Validio source to monitor the tables in the SAP IQ database. See [Add a SAP IQ Source](#add-a-sap-iq-source).

## Prerequisites

Create a user in SAP IQ with read-only access so that Validio can read and validate your data. For more information about credentials in Validio, see [Credentials](https://docs.validio.io/v11.0/docs/credentials.md).

> [!WARNING]
>
> **Credential Permission Requirements**
>
> Validio Credentials **require** `VIEWER` access rights when connecting to sources to read and access data. Admins must ensure that they do not provide `EDITOR` access rights to their credentials.

The following SQL script provides steps for setting up a user with the necessary permissions for the source in Validio. Run it as a user with administrative privileges:

```sql title="SQL" theme={null}
-- Create the Validio user.
CREATE USER Validio IDENTIFIED BY '<password>';

-- Allow Validio to list the databases on the server.
-- sa_db_list is a system procedure owned by dbo.
GRANT EXECUTE ON dbo.sa_db_list TO Validio;

-- Grant read access to the system catalog views that Validio uses to
-- discover tables, schemas, and views, to infer table schemas, and to
-- read the view and stored procedure definitions used for lineage.
GRANT SELECT ON SYS.SYSTAB TO Validio;        -- Tables
GRANT SELECT ON SYS.SYSUSER TO Validio;       -- Users (schemas)
GRANT SELECT ON SYS.SYSOBJECT TO Validio;     -- Views and tables
GRANT SELECT ON SYS.SYSREMARK TO Validio;     -- Notes/descriptions
GRANT SELECT ON SYS.SYSTABCOL TO Validio;     -- Table columns
GRANT SELECT ON SYS.SYSDOMAIN TO Validio;     -- Fallback column type
GRANT SELECT ON SYS.SYSVIEW TO Validio;       -- View definitions
GRANT SELECT ON SYS.SYSPROCEDURE TO Validio;  -- Stored procedure definitions

-- Grant read access to each table you want Validio to monitor.
GRANT SELECT ON <owner>.<table> TO Validio;
```

> [!NOTE]
>
> **Catalog grants and row filtering**
>
> The system catalog views (`SYS.*`) are readable by `PUBLIC` by default in SAP IQ, so the catalog grants above may already be in effect — they are included to make the requirement explicit. The grants that always matter are `CREATE USER` and `EXECUTE` on `dbo.sa_db_list`.
>
> Catalog row filtering still applies: even with `SELECT` on the catalog views, the user only sees catalog rows for objects it has a privilege on. Grant `SELECT` on each table you want Validio to monitor so it can infer and validate their schemas.

### Lineage requirements

SAP IQ writes its query logs to local disk, not to object storage. To build lineage, Validio reads the query log files from an S3-compatible object store, so you need a process that copies the logs from the SAP IQ server to that store. Once the logs are there, enable **Configure query log storage** on the credential and fill in the [Query Log Storage Parameters](#query-log-storage-parameters).

Query log storage is optional. Without it, Validio still infers schemas and validates your data, but it does not build lineage.

Lineage covers statements that run inside stored procedures as well as ordinary queries, so reads and writes inside a procedure appear as lineage edges. This needs no configuration beyond the `SELECT` grant on `SYS.SYSPROCEDURE` in the script above.

## Add a SAP IQ credential

![The SAP IQ credential configuration form, showing host, port, server, user, password, and SSL mode fields](https://mintcdn.com/validio/h4NQPs1kJwlpB1Yj/images/docs/integrations/1021-sapiq-config.png?fit=max\&auto=format\&n=h4NQPs1kJwlpB1Yj\&q=85\&s=6778d8390482df1930201f7d0d85f005)

SAP IQ credential configuration

To add a credential for SAP IQ,

1. Navigate to **Credentials** and click **+ New credential**.
2. Under **Namespace**, select a namespace where the resources will be created.
3. For **Credential Type**, select **SAP IQ**.
4. Fill in the credential parameter fields. Refer to the [SAP IQ Credential Parameters](#sap-iq-credential-parameters) table.
5. (Optional) To enable lineage, toggle **Configure query log storage** and fill in the connection details for the object storage that holds your SAP IQ query log files. Refer to the [Query Log Storage Parameters](#query-log-storage-parameters) table.
6. (Optional) Click **Test credential** to validate the connection to the SAP IQ account. If validation fails, check that you provided the correct parameter values and try again.
7. (Optional) Check **Use for catalog and schema checks** to automatically discover assets and add them to the catalog page.
8. Click **Create**.

Once the credential is created, you can add a [source](https://docs.validio.io/v11.0/docs/sources.md) to start monitoring SAP IQ data. If you configured query log storage, Validio also begins building lineage and you can view SAP IQ assets and their relationships on the [Catalog](https://docs.validio.io/v11.0/docs/catalog.md) and [Lineage](https://docs.validio.io/v11.0/docs/lineage.md) pages.

### SAP IQ credential parameters

| Parameter | Description |
| :- | :- |
| Name | Identifier for the credential, referenced when configuring a source. |
| Host | DNS hostname or IP address of the SAP IQ database server. |
| Port | Port number of the SAP IQ database server. |
| Server | SAP IQ server (engine) name to connect to. |
| User | Username of the SAP IQ account with read access to the desired tables. |
| Password | Password of the specified SAP IQ account. |
| SSL mode | Select **Disable** for an unencrypted connection, or **Require** to encrypt the connection between Validio and the SAP IQ server with TLS. |
| PEM certificate bundle | (Optional, SSL mode **Require**) Paste or upload the PEM certificate used to verify the server certificate. |
| Certificate name | (Optional, SSL mode **Require**) Expected Common Name or Subject Alternative Name on the server certificate. Set this when it does not match the host you connect to. |

### Query log storage parameters

| Parameter | Description |
| :- | :- |
| Bucket | Name of the S3-compatible bucket that contains the SAP IQ query log files. |
| Path | (Optional) Path or prefix within the bucket where the query log files are stored. Leave empty to read from the bucket root. |
| Access key | Access key with read access to the bucket. |
| Secret key | Secret key for the specified access key. |
| Region | Region of the object storage. Whether this is required depends on the storage implementation: AWS S3 requires it, while many on-premises and S3-compatible stores do not. |
| Endpoint URL | (Optional) Endpoint URL of the object storage. Set this for S3-compatible stores that are not AWS S3, such as Dell EMC ECS. |
| Use path-style addressing | (Optional) Enable path-style addressing (`<endpoint>/<bucket>`) instead of virtual-hosted-style addressing (`<bucket>.<endpoint>`). Required for many on-premises and S3-compatible stores where virtual-hosted-style URLs do not resolve. |
| PEM certificate bundle | (Optional) Paste or upload the certificate used to verify the object storage server certificate. Set this when the store uses a self-signed or private CA certificate. |

## Add a SAP IQ source

![The SAP IQ source configuration form, showing credential, database, schema, and table selection](https://mintcdn.com/validio/h4NQPs1kJwlpB1Yj/images/docs/integrations/920-sapiq-source.png?fit=max\&auto=format\&n=h4NQPs1kJwlpB1Yj\&q=85\&s=943cfebbc4dfcf0ebdc7d8659b08a9c0)

SAP IQ source configuration

To add a source for SAP IQ,

1. Navigate to **Sources** and click **+ New source**.
2. Under Source type, select **SAP IQ**.
3. Under **Config**,
   1. Select the valid **Credential** or create a new credential to authenticate your connection to the database.
   2. You have two options for specifying the dataset and tables to monitor:
      1. **Select an existing table** -- Enter the **Database**, **Schema**, and **Table** to specify where the data comes from. Selecting more than one table will create a new source for each table. Refer to the [Source Configuration Parameters](#sap-iq-source-configuration-parameters) table.
      2. **Use Custom SQL** -- Write a valid SQL query to specify the data to monitor. See [Custom SQL Sources](https://docs.validio.io/v11.0/docs/sources/custom-sql-sources.md).
   3. Set the **Polling schedule**, which is how frequently the validators on the source will check for changes.
4. Under **Schema**, click **Continue** to automatically infer the schema fields from the tables you selected. If you select many tables, this operation can take a few minutes to complete.
5. Under **Source details**,
   1. Add **Tags** to help group related sources or to use for routing notifications.
   2. Add an **Owner** who will be the contact for incident notifications.
   3. Assign a **Priority**, which indicates the importance of incidents detected on this source.
6. Click **Continue** to create the source.
   Source names are generated automatically and will be displayed when the source creation completes. If there are more than 5 sources, you will see the names for the first five and a count of the remaining sources.

### SAP IQ source configuration parameters

| Parameter | Description |
| :- | :- |
| Credential | SAP IQ credential. |
| Database | Name of the SAP IQ database. |
| Schema | Name of the schema that contains the table. |
| Table | Name of the table to read data from. |