Sign in Subscribe
Troubleshooting

Fixing Permission, Script, and Publishing Errors When Building Tableau Data Apps

Yehwan Hwang

• 4 min read
Share
Data App Errors in Tableau MCP & Plugin — feature image for the Tableau data app troubleshooting post

Tableau Data Apps are built with an AI client and the Tableau plugin. You may hit the errors below while querying the data source, preparing the workspace, publishing, or checking the result. We encountered them on November 6, 2026, publishing a data app to Tableau Cloud (2026.3.3) from Claude Code on Windows with Tableau MCP and tableau-plugin (commit a8febd1). Each entry gives the fix we confirmed.

  • VIZQL_DATA_API_ACCESS / Permission denied (403): The data source lacks API Access. Request the permission, or test with a data source you can query.
  • python3 prints Python and exits: This appears to be the Microsoft Store app execution alias. Run python instead.
  • Plan path escapes the unzip directory: A Windows path separator issue. Run a copy of the script with a one-line fix.
  • workbookFilePath is only supported when staged S3 uploads are not configured.: An expected branch, not a failure. Upload first, then publish with workbookUploadId.
  • get-view-image returns a sign-in page: Cause unknown. Check the app in a signed-in browser.

1. What should you do when a data source query fails with 'VIZQL_DATA_API_ACCESS'?

The user does not have the required permissions: VIZQL_DATA_API_ACCESS to access the data source.
Permission denied (403): you are authenticated to this Tableau MCP server (site "…", pod "…") but this request was refused. Your account may lack the required site role or permission, or the capability may not be enabled for this site. Use an account with the required permissions, or confirm the capability is enabled for this site.

Cause

Both errors mean the data source lacks API Access. Tableau MCP's query-datasource returned the first, and get-datasource-metadata returned the second. Tableau's help describes API Access as the capability that lets a user query data sources through VizQL Data Service, and a data app's queryAsync() sends its requests to the same VizQL Data Service. In our test, the shared data source in the Samples project couldn't be queried without this permission.

Solution

  1. Request API Access on the data source: The official docs require creators, too, to have View, Connect, and API Access on each data source the app uses. Ask whoever manages the data source's permissions.
  2. Test with a data source you can query: In our test, the same tools succeeded once we switched to a data source the user had published. Ownership is the likely reason, but we didn't check the permission rules.

Before sharing the app, also check viewer permissions: View, Full Data Query, and API Access on the workbook, plus View, Connect, and API Access on the data source.

2. What should you do when the workspace scripts fail on Windows?

Running the plugin's scripts directly on Windows can hit two problems.

python3 prints Python and exits

Running python3 printed only Python and exited with code 49. On this machine, python3 resolves to AppData\Local\Microsoft\WindowsApps\python3.exe in the user folder, which by its name is a Microsoft Store app execution alias. The plugin docs use python3 ..., but running the installed interpreter as python (Python 3.14.7 in our test) works.

Plan path escapes the unzip directory

\u2717 Plan path escapes the unzip directory: Data App Name/Data App Name.twb
  • Cause: The check abs_path.startswith(unzip_dir + '/') on line 51 of apply_plan.py. On Windows, os.path.abspath returns \ separators, so valid paths are flagged as escaping. Both a dummy plan and the real postUnzip plan failed.
  • Fix: Leave the original as is and change one line in a copy.
-        if abs_path != unzip_dir and not abs_path.startswith(unzip_dir + '/'):
+        if abs_path != unzip_dir and not abs_path.startswith(unzip_dir + os.sep):
  • What we confirmed: A dummy valid plan exited 0, and a dummy escaping plan (../outside.txt) exited 1, rejected as intended. The real postUnzip plan exited 0 with 3 edits and 3 renames.
  • Reported: We filed this as tableau/tableau-plugin#35.

3. What should you do when publish-workbook rejects 'workbookFilePath'?

workbookFilePath is only supported when staged S3 uploads are not configured. Call request-workbook-upload first and pass workbookUploadId.
  • Cause: This isn't a failure; it reflects how the site handles uploads. On sites with staged uploads, you can't publish by file path (workbookFilePath), and the plugin docs anticipate this branch.
  • Fix: Get an upload URL with request-workbook-upload, upload the .twbx to it with curl -X PUT, then call publish-workbook with workbookUploadId. Our upload returned HTTP 200, and publishing returned status: "published" and warnings: [].

4. What should you do when get-view-image returns a sign-in page instead of the app?

Tableau MCP's get-view-image returned a PNG (40,604 bytes) with no error, but the image showed the "Sign in to Tableau Cloud" page instead of the app.

  • Cause: Unknown. The same view displayed correctly in a signed-in browser, so there's no evidence the app was at fault.
  • Fix: After publishing, open the app yourself in a signed-in browser. Even when a tool returns success, check what the image actually shows.

Reference

Note:

This post is based on tableau-plugin commit a8febd1 and Tableau Cloud (2026.3.3) as of November 6, 2026. Results may change as the plugin and the beta are updated.