> For the complete documentation index, see [llms.txt](https://docs.decube.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.decube.io/databases/sap-hana.md).

# SAP HANA (BETA)

## Supported Capabilities

{% tabs %}
{% tab title="Supported Capabilities" %}
**General**

* **Metadata** — metadata extraction and display of asset information (tables, columns, schemas). Types collected: Schema, Table, Column, View
* **View Table** — view tables, which are virtual tables based on SQL queries
  {% endtab %}

{% tab title="Not Supported" %}
**General**

* Profiling
* Preview
* Data Quality
* External Table
* Stored Procedure
* Calculation View
* Analytic View
* Attribute View
  {% endtab %}
  {% endtabs %}

## Connection Requirements

Connecting to decube requires credentials to your SAP HANA instance. At a minimum, we require:

* `username`
* `password`
* `host address`
* `host port`
* `database / tenant name`

The `source name` will be for you to differentiate and recognize particular sources within the decube application.

We strongly encourage you to create a decube **read-only user** for this credential purpose. Follow the steps below to set up a custom user with least-privilege access.

### Custom User for decube

Creating a dedicated database user for decube follows the principle of least privilege, giving decube only the permissions it needs to monitor your data without risking broader database security.

1. Create the decube user

Log in to your SAP HANA instance with an administrative account (e.g., `SYSTEM` or a user with `USER ADMIN` privileges) and run:

```sql
-- Create the dedicated service user, keep note of the username and password
CREATE USER DECUBE PASSWORD "<password>" NO FORCE_FIRST_PASSWORD_CHANGE;

-- Disable password expiration for uninterrupted ingestion
ALTER USER DECUBE DISABLE PASSWORD LIFETIME;
```

2\. Grant the required permissions

decube requires `SELECT METADATA` granted to the `DECUBE` user, for every schema you want to ingest:

```sql
-- Grant metadata read access for each schema you wish to ingest.
GRANT SELECT METADATA ON SCHEMA "<schema_name>" TO DECUBE;
```

See the SAP documentation on [SELECT METADATA](https://help.sap.com/docs/SAP_HANA_PLATFORM/4fe29514fd584807ac9f2a04f6754767/20f674e1751910148a8b990d33efbdc5.html) for more detail.

## Encryption & SSL Configuration

decube supports encrypted SSL connections to SAP HANA instances via the **Enable SSL** toggle.

If your enterprise database or cloud environment enforces custom CA verification, select **Use Customer CA Cert** and upload your `.pem` or `.crt` certificate file.