> ## Documentation Index > Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # SAP HANA Setup > Prerequisites, permissions, network requirements, and step-by-step instructions for connecting SAP HANA to Prizm. This page covers everything you need to connect SAP HANA (on-premises or SAP HANA Cloud) to Prizm: prerequisites, the permissions Prizm needs, network requirements, and the connection wizard. ## Prerequisites | Requirement | Required | Notes | | :- | :- | :- | | SAP HANA instance reachable from Prizm | Yes | Host and SQL port. Typically `39015` on-premises and `443` on SAP HANA Cloud | | Database user for Prizm | Yes | A dedicated technical user is recommended | | Prizm platform storage | Yes | Configured in your organization's platform settings. Used for exceptions and for large comparison results | | Spark cluster | Recommended | Needed to run comparison metrics at scale, especially segment metrics with many groups | | Schema Owner filter | No | Optional connection field that limits discovery to schemas owned by a given user | > [!NOTE] > > **SAP HANA is schema-scoped.** There is no separate "database" or catalog layer to choose, as there is for Snowflake. Prizm names assets with slashes: `SCHEMA/TABLE` for tables and `SCHEMA/TABLE/COLUMN` for columns. ## Required SAP HANA Permissions Give the Prizm user least-privilege access to the objects in scope. Prizm reads catalog views and runs `SELECT` statements (including metric queries) on the tables you monitor. ### Catalog and metadata | Access | Used for | | :- | :- | | `SELECT` on `SYS.SCHEMAS` | Schema discovery and the Schema Owner filter | | `SELECT` on `SYS.TABLES` and `SYS.VIEWS` | Table and view inventory | | `SELECT` on `SYS.TABLE_COLUMNS` and `SYS.VIEW_COLUMNS` | Column metadata | | `SELECT` on `SYS.CONSTRAINTS`, `SYS.REFERENTIAL_CONSTRAINTS`, and `SYS.INDEXES` | Primary key, foreign key, and structural metadata | | `SELECT` on `SYS.M_TABLES` and `SYS.M_TABLE_STATISTICS` (where available) | Row counts and statistics for observability | If your SAP HANA deployment provides a catalog-read or monitoring-style role, you can grant that instead of the individual `SELECT` privileges above. Otherwise grant `SELECT` on the views listed, plus any tenant-specific statistics views your version exposes. ### User data (in-scope schemas) | Access | Used for | | :- | :- | | `SELECT` on tables and views in the **included** schemas | Profiling, quality, and business metrics, and lookups | | `SELECT` on the source and target tables used in **comparison** metrics | Reconciliation metrics | ### Optional | Access | Used for | | :- | :- | | `ALTER SYSTEM CANCEL SESSION` (or equivalent) | Cancelling long-running queries | | DDL on user objects | Not required. Prizm needs no DDL to observe your data | ### Example grants The following creates a dedicated user with role-based catalog access. Adjust it to your security policy and replace `` with each schema you plan to include. ```sql theme={null} -- Create the Prizm connection user CREATE USER PRIZM_SVC PASSWORD "" NO FORCE_FIRST_PASSWORD_CHANGE; -- Catalog read access to the SYS.* system views GRANT CATALOG READ TO PRIZM_SVC; -- Read access to the monitoring (M_*) views GRANT MONITORING TO PRIZM_SVC; -- Read access to the data in each schema in scope GRANT SELECT ON SCHEMA TO PRIZM_SVC; ``` > [!NOTE] > > Prizm is read-only on SAP HANA. None of these grants allow Prizm to change data or objects. ## Network and Security Checklist | Item | Guidance | | :- | :- | | Firewall | Allow TCP traffic from Prizm to the SAP HANA host and port. This includes any Spark workers that run comparison metrics | | SAP HANA Cloud | Usually port `443`. Allowlist Prizm's egress IP addresses if your instance restricts inbound connections | | TLS | Follow your SAP HANA Cloud and corporate TLS requirements for the connection | | Secrets | Store credentials in a vault and rotate passwords according to your policy | | Least privilege | Limit includes and excludes to production schemas only | ## Connector Setup **1. Open the connector wizard** Navigate to **Source** and click the **+** icon next to the source list. Search for **SAP HANA** and select it from the connector grid. **2. Enter source details** | Field | Description | | :- | :- | | Connection Name | A label for this connection (for example, `saphana-prod`) | | Description | Optional notes about what this connection covers | | Host | Hostname of the SAP HANA server, for example `hana.example.com` or a SAP HANA Cloud host such as `.hana..hanacloud.ondemand.com`. The host can't be changed after you save | | Port | SQL port of the instance. Defaults to `39015`. Self-managed systems typically use `315`; SAP HANA Cloud uses `443` | | Authentication Type | **Username And Password** | | Schema Owner | Optional. Limits discovery to schemas owned by this user (`SYS.SCHEMAS.SCHEMA_OWNER`). This is a schema-owner filter, not a database name | ![The SAP HANA Source Details form](https://mintcdn.com/dqlabs/-llXdpktU4fg82jU/images/sources/sap-hana/form-top.png?fit=max\&auto=format\&n=-llXdpktU4fg82jU\&q=85\&s=7b1150add512fda41d9fd8550a36e47b) **3. Provide credentials** Toggle **Use Vault** to retrieve credentials from a vault instead of entering them directly. Prizm supports HashiCorp Vault, Azure Key Vault, and AWS Secrets Manager. ![The SAP HANA credential fields and optional Schema Owner](https://mintcdn.com/dqlabs/-llXdpktU4fg82jU/images/sources/sap-hana/form-bottom.png?fit=max\&auto=format\&n=-llXdpktU4fg82jU\&q=85\&s=5d330f5c1fc7f3d61a6148ec26a7c75d) **Username & Password (default)** | Field | Description | | :- | :- | | Username | The SAP HANA user created in Prerequisites | | Password | The user's password, stored encrypted | **Use Vault** | Field | Description | | :- | :- | | Select Vault | Choose from the vault instances already configured for your organization | | Key | The key or path within that vault where the SAP HANA credential is stored | Credentials retrieved this way are not entered into the connector form. **4. Validate the connection** Click **Validate** (or **Test connection**). Prizm runs a simple query (`SELECT 1 FROM DUMMY`) to confirm it can connect. If you set a **Schema Owner**, Prizm also checks that at least one non-system schema exists for that owner. > [!WARNING] > > Validation must succeed before you can click **Next**. If it fails, check the host, port, credentials, firewall rules, and Schema Owner value. **5. Choose what to profile** Click **Next** to open the source configuration step. Scope is schema-first, so there is no database selection. | Section | Description | | :- | :- | | Include | Schemas, and tables or views, to profile. Wildcards are supported where configured | | Exclude | Schemas, and tables or views, to leave out of profiling | | Additional configuration | Storage is set at the organization level and covers features such as exceptions and comparison results. Turn on **Override default storage** to override the schema and directory for this source | **6. Save** Complete the configuration. The source then appears in the **Source** list, where the **Valid** column shows a green check for a working connection. Its assets appear in the catalog once the first run completes. Filter the Asset page by **SAP HANA** to see them. ## Run Your First Jobs For a new source, run jobs in this order: 1. **Technical.** Registers the schema assets. 2. **Operational.** Discovers tables, views, and columns. 3. **Profile, Structural, and Business.** Run these as needed once the assets exist. When they complete, the catalog shows **Schema → Table/View → Column**. Metrics, alerts, and the schema change timeline fill in for the assets in scope, and comparison metrics run when a Spark cluster is configured. ## Spark Connectivity for Comparison Metrics Comparison and reconciliation metrics can run on Spark and read SAP HANA over JDBC. Make sure your Spark workers can reach the SAP HANA host and port, and that the credentials work from there. The connection uses the SAP JDBC driver in this form: ```text theme={null} jdbc:sap://:/?autocommit=true&loginTimeout=300 ``` ## Next Steps > **[What We Collect](/sources/sap-hana/what-we-collect)** > > See what Prizm extracts from SAP HANA. > **[FAQ](/sources/sap-hana/faq)** > > Common questions about credentials, scoping, and permissions. > **[Troubleshooting](/help/troubleshooting)** > > Diagnose connection failures, permission errors, and timeouts. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.