Connect Single Origin to Databricks

Single Origin reads metadata only from your Databricks workspace: catalog, schema, table, view and column information, plus comments and lineage exposed through Unity Catalog. It never reads the contents of your tables.

You connect Single Origin by granting a dedicated service principal the Unity Catalog BROWSE privilege, which is built for metadata discovery. The setup takes a few minutes, and nothing leaves your environment.

What you're granting

You grant a service principal that represents Single Origin the following. None of these grant access to the data inside your tables.

Grant	Scope	What it allows
`BROWSE`	Catalog	Discover objects and view their metadata (names, schemas, columns, comments, tags, lineage and `information_schema`) without read access to the underlying data. Works independently of `USE CATALOG` and `USE SCHEMA`.
`CAN USE` on a SQL warehouse	Workspace	Compute to run the metadata queries. This is compute access only; it grants no access to data.
Workspace access	Workspace	Lets the service principal connect to the workspace.

BROWSE is the Unity Catalog privilege designed for this: a principal can see that objects exist and read their metadata, while data access stays fully restricted.

Before you start

You'll need:

An account admin or metastore admin (to grant BROWSE), plus a workspace admin (to add the service principal and grant warehouse access).
A service principal for Single Origin. Create one in the account console under User management → Service principals, then generate an OAuth secret (client ID and secret) for it. You share the client ID and secret with Single Origin, which connects using OAuth machine-to-machine authentication.
A SQL warehouse Single Origin can use to run metadata queries. A 2X-Small or Small warehouse is enough.
Your workspace URL and the warehouse's HTTP path. Find both on the warehouse's Connection details tab.

In the steps below, <single-origin-application-id> is the service principal's application ID (a UUID), not its display name.

Choose a method

Add the service principal to the workspace. In the account console, open Workspaces → your workspace → Permissions and add the Single Origin service principal.
Grant BROWSE on each catalog. In your workspace, click Catalog, select a catalog, open the Permissions tab, click Grant, choose the Single Origin service principal and select BROWSE. Repeat for every catalog you want Single Origin to see.
Grant warehouse access. Open SQL Warehouses, select the warehouse, open Permissions and give the service principal Can use.

Run this once per catalog you want Single Origin to see, in a notebook or the SQL editor:

GRANT BROWSE ON CATALOG `<catalog_name>` TO `<single-origin-application-id>`;

BROWSE is granted at the catalog level and covers every object in that catalog. Warehouse access and workspace access are set in the UI (the Catalog Explorer and workspace UI tab), the Databricks CLI or Terraform (the Terraform tab); they aren't GRANT statements.

If you manage Databricks with the Databricks Terraform provider, use the configuration below.

ℹ️
Resource arguments vary by provider version. Adjust them to match the provider version you've pinned.

# Grant BROWSE on each catalog Single Origin should see
resource "databricks_grant" "single_origin_browse" {
  for_each = toset(["<catalog_name>"]) # add more catalogs as needed

  catalog    = each.value
  principal  = "<single-origin-application-id>"
  privileges = ["BROWSE"]
}

# Let the service principal use the SQL warehouse
resource "databricks_permissions" "single_origin_warehouse" {
  sql_endpoint_id = "<warehouse_id>"

  access_control {
    service_principal_name = "<single-origin-application-id>"
    permission_level       = "CAN_USE"
  }
}

Finish up

Once the grants are in place, send these to your Single Origin contact (or enter them in the onboarding flow): your workspace URL, the warehouse HTTP path, and the service principal's client ID and OAuth secret. Single Origin connects and starts reading metadata. No further action is needed on your side.

Revoking access

You can remove Single Origin's access at any time. To revoke metadata access, run this once per catalog:

REVOKE BROWSE ON CATALOG `<catalog_name>` FROM `<single-origin-application-id>`;

To cut off the connection completely, delete the service principal's OAuth secret (or the service principal itself) in the account console. It can no longer authenticate.