Manage workspace settings
Configure members, connected tools, notification delivery and account security.
Settings separates workspace administration from your own account security. The available actions depend on your role, grants and installation mode.
Workspace
Manage the workspace's members and invitations. Owners and administrators can review roles and resource access. Project and item grants define which saved sources, queries, views, dashboards and datasets a member can use; a project filter does not grant access.
After changing permissions, verify the intended reader experience using a separate account. Publishing a dashboard does not freeze a revoked member's authority. See identity and access for role and dependency rules.
API keys and connected agents
Create a key for a specific integration and grant only the resources and operations it needs. Reading metadata and running a query are separate capabilities. Copy a new key once, store it securely and revoke it when the integration is retired.
The separate Agents & MCP section includes client-specific setup instructions and shows this instance's actual endpoint and supported authentication. Hosted OAuth connections can be reviewed or disconnected here. Packaged Desktop uses a scoped, expiring key; revoke that key to disconnect. For a persistent desktop connection, use the CLI's authenticated discovery and stdio transport instead of saving its changing localhost port. Connections remain tied to their workspace and the owner's current authority. Use the MCP guide for setup and execution boundaries.
Notifications
Workspace owners and administrators configure notification channels and scheduler delivery settings. Email channels use the installation's configured mail service. A webhook or provider destination has its own secret and delivery requirements.
Saving a destination and sending a test are separate operations. Choose a test destination before exercising reports or workflows. Inspect delivery results rather than assuming a saved configuration means delivery succeeded. See scheduled reports for schedules, exports and retries.
Chat integrations let each member link their Slack or Teams identity and invoke approved published workflows using their current permissions. Setup includes the provider callback, allowed channels, signed requests, and explicit account linking. Outgoing notifications and incoming commands have separate credentials. Follow Slack and Microsoft Teams for the complete setup and command guide.
Activity
Review the workspace's audit activity and filter it to the operation you are investigating. Access to activity is permission-controlled. Audit settings and retention determine which records remain available; the activity screen is not a query profiler or a permanent record of every database result.
For query performance, use query cost, which distinguishes plans from actual execution observations.
Account and appearance
Account settings manage your profile, password, passkeys, two-factor authentication and active sessions when account security is enabled. A local instance using device identity presents its own limited account state instead of offering unavailable account actions.
Choose the interface language in Settings and the Light, Dark or Dim appearance from the account menu. Appearance changes presentation only; it does not change query definitions, source values or saved data.