Connect a data source in DQE One Standalone

Before you can create a process, DataPipeline or RuleSet, you need to connect at least one data source. DQE One Standalone supports 7 source types: Salesforce, Microsoft Dynamics 365, PostgreSQL, BigQuery, Snowflake, SFTP and CSV file upload.

Where to connect a data source

You can connect a data source from two places:

• The Data Source step of the process (or DataPipeline, or RuleSet) creation wizard — heading "Choose your data source", with a "Connect to your software" section reading "Select your software plugin and log in to your software. A system administrator account is required."
• My Account → Credentials — an accordion section ("Update your credentials here") where you can create a connection ahead of time, independently of any process. Pick a connector from the Select connector list, then click New.

Both places open the exact same connection form, so everything below applies to either entry point.

Reusing an existing connection

If you've already connected a given source before, the connection window shows your saved credentials as cards (with a green or red dot showing whether the connection is currently valid) — click one to reuse it without re-entering anything. Click Use another account to open a blank form instead, or Back to existing account to return to the saved list.

Salesforce

DQE One Standalone connects to Salesforce with the JWT Bearer flow: it signs a request with a private key that you control, and Salesforce accepts it because the matching certificate is registered in an External Client App. No password and no interactive login are involved. Complete the steps below in order, then click Connect to Salesforce.

Step 1: Choose the integration user

Use a dedicated Salesforce user (or create one) that DQE One Standalone will act as. Its Salesforce username is the value you enter in the Username field. This user must belong to the profile you select in step 4 (System Administrator in this guide).

Step 2: Generate the certificate

The External Client App requires a certificate. Generate it on your computer with OpenSSL. Dots and "+" signs scroll by during generation: this is normal. Generation is complete when the command prompt returns.

• Windows: install Git for Windows from https://git-scm.com/download/win with the default options. Open Git Bash, paste the command below and press Enter. The files are created in your personal folder (C:\Users\your-name).

  MSYS_NO_PATHCONV=1 openssl req -x509 -newkey rsa:2048 -sha256 -days 730 -nodes -keyout dqe-standalone-private.key -out dqe-standalone-certificate.crt -subj "/CN=dqe-standalone/O=YourCompany/C=FR"

• Mac: open Terminal (Cmd + Space, type "Terminal"), paste the command below and press Enter. The files are created in your home folder (in Finder: Go → Home).

  openssl req -x509 -newkey rsa:2048 -sha256 -days 730 -nodes -keyout dqe-standalone-private.key -out dqe-standalone-certificate.crt -subj "/CN=dqe-standalone/O=YourCompany/C=FR"

You now have two files:

• dqe-standalone-certificate.crt: the only file you upload to Salesforce (step 3).
• dqe-standalone-private.key: keep it safe and never share it, including with DQE. Its content is pasted into the form in step 6.

The certificate is valid for 730 days. Before it expires, repeat this step and upload the new certificate to the External Client App.

Step 3: Create the External Client App

1. In Salesforce, go to Setup → Quick Find → External Client App Manager and click New External Client App.
2. Under Basic Information, enter the app name and the contact email.
3. Under App Settings, enable OAuth.
4. Enter a callback URL, for example http://localhost:5000/callback. It is not used by DQE One Standalone, but the field is mandatory.
5. Under OAuth Scopes, select Full access.
6. Under Flow Enablement, check Enable JWT Bearer Flow and upload the file dqe-standalone-certificate.crt.
7. Click Create.

Step 4: Set the policies

1. In the Policies tab, click Edit.
2. Under OAuth Policies → Permitted Users, select Admin approved users are pre-authorized.
3. Under App Policies, select the System Administrator profile. Without this step, Salesforce refuses the login (see the troubleshooting table below).
4. Save the policies.

Step 5: Retrieve the Consumer Key

1. In the Settings tab, go to OAuth Settings and click Consumer Key and Secret.
2. Enter the verification code that Salesforce sends you, then copy the Consumer Key.

Step 6: Fill in the connection form

• Username: the Salesforce username of the integration user from step 1. It is often in email format, but it is not always the user's email address.
• Salesforce Instance Url: the URL you use to log in to this org, for example https://yourcompany.my.salesforce.com. Use only the domain, with no path and no trailing slash. It is also shown under Setup → Company Information. For a sandbox, use its My Domain URL, for example https://yourcompany--dev.sandbox.my.salesforce.com.
• External Client App Consumer Key: the key copied in step 5.
• External Client App Private Key: the content of the file dqe-standalone-private.key, starting with -----BEGIN PRIVATE KEY----- and ending with -----END PRIVATE KEY-----. Upload the file or paste the text.

Then click Log In.

This is a direct credentials form, not an interactive Salesforce login popup, so there is no consent screen to click through. The Instance Url must be a real Salesforce domain (ending in .salesforce.com), or the connection is rejected.

Troubleshooting the Salesforce connection

Microsoft Dynamics 365

Click Connect to Dynamics, fill in:

• Tenant
• Client Id
• Client Secret
• Scope — your Dynamics environment URL (e.g. https://yourorg.crm.dynamics.com).

The Migrate Run & Process checkbox is selected by default. Leave it checked the first time you connect a given Dynamics org — after logging in, DQE One Standalone will push Process/Run metadata into Dynamics so it can be tracked there too (a progress loader appears while this runs).

Click Log In. A Microsoft sign-in window opens — sign in and consent, then close the confirmation page it shows you ("Successfully Connected"). DQE One Standalone finishes connecting automatically once you do.

Prerequisite: your IT team needs to create an Azure AD App Registration (giving you the Tenant ID, Client ID and Client Secret above) with a redirect URI of {your DQE One Standalone URL}/dynamics/code.

Where to find this in Azure / Dynamics

• Tenant and Client Id: in the Azure Portal, under Microsoft Entra ID → App registrations, open your app registration — its Overview page shows the Directory (tenant) ID and Application (client) ID.
• Client Secret: on the same app registration, go to Certificates & secrets → New client secret. Copy the Value immediately — Azure only shows it once.
• Scope (your environment URL): in the Power Platform admin center → Environments, open your environment — its Environment URL is shown on the Details page.
• Redirect URI: add it yourself on the app registration, under Authentication → Add a platform → Web.

PostgreSQL

Click Connect to Postgres, fill in Host, Port, Username, Password and Database, then click Log In. Make sure the database is reachable from DQE One Standalone's server (network/ firewall access).

Where to find this

These are your own PostgreSQL server's connection details — ask whoever manages that database (your DBA or infrastructure team) for the host, port, database name and a username/password with access to it.

BigQuery

Click Connect to BigQuery. Open the Service Account JSON key file you downloaded from Google Cloud Console and copy these 5 values across:

• Client Id
• Client Email
• Project Id
• Private Key Id
• Private Key — upload or paste the PEM-formatted value (the private_key field in the JSON file).

Then click Log In.

Where to find this

In Google Cloud Console, go to IAM & Admin → Service Accounts, select (or create) the service account to use, open its Keys tab, then Add Key → Create new key → JSON. This downloads a JSON file containing all 5 values above — open it and copy each field into the matching box.

Snowflake

Click Connect to Snowflake, fill in:

• Host — your Snowflake account host, ending in .snowflakecomputing.com.
• Client Id
• Client Secret

Click Log In. A Snowflake sign-in window opens — sign in and authorize, then close the confirmation page. Snowflake connections always use this sign-in step (including every time the connection is silently refreshed in the background afterwards).

Prerequisite: your Snowflake administrator needs to set up a Security Integration (OAuth client) giving you the Client ID/ Secret above, with a redirect URI of {your DQE One Standalone URL}/snowflake/code.

Where to find this

Your Host is your Snowflake account identifier plus .snowflakecomputing.com (visible in the URL you use to open Snowflake, or under Admin → Accounts). The Client Id and Client Secret come from the Security Integration — a Snowflake ACCOUNTADMIN creates it with a CREATE SECURITY INTEGRATION ... TYPE = OAUTH statement, then retrieves the secret with SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('integration_name'). Ask your Snowflake administrator if you don't have ACCOUNTADMIN access yourself.

SFTP

Click Connect to SFTP, fill in Host, Port and Username, then choose an authentication method:

• Password — enter your Password.
• Key Pair — paste your Private Key content, and optionally its Private Key Password.

Click Log In.

Prerequisite: your SFTP host must be added to an allow-list before you can connect — the Host you type here must match it exactly. This allow-list is a server-side setting of the machine running DQE One Standalone itself, not something configurable from within the app:

• If you host DQE One Standalone yourself, your own infrastructure team adds the host to that server's configuration.
• If DQE Software hosts it for you, ask your DQE project manager or DQE Support to add it.

If you see a "not allowed" message when connecting, this is the first thing to check.

Once connected, you'll choose 4 locations on the SFTP server: an Input file, an Output directory, a Logs directory and a Reject directory (files that fail to be read during a run are moved here). When browsing for a file, you can type a filename mask using * and ? wildcards to select several matching files at once.

CSV file upload

In the wizard, choose Import data files and drag a CSV file onto the drop zone (or click to browse). There's no login step and nothing to configure beforehand — the file is uploaded directly.

Managing saved credentials

Go to My Account → Credentials to see every connection you've saved, with its connector type and masked login. From here you can:

• Create a new connection ahead of time (New button), without needing to start a process first.
• Delete a connection — only possible if it isn't used by any existing Process or RuleSet.

The Edit button on a saved credential is always disabled — you can't currently update a saved connection's details from this screen. To change credentials, delete the old connection (once unused) and create a new one.