M↓ View as Markdown ↗

MySQL¶

Connect a MySQL database to Actian AI Analyst so you can build Models on its tables and let your AI Analysts query them.

Availability

Who can do this: members with the Edit capability in the active Workspace. If your organization has turned on Restrict connection management, you also need the Manage organization capability.
Plan: Studio lists only the connectors that your organization's plan and your deployment include. If MySQL is missing from the list, ask your administrator.
Deployment: Actian SaaS and self-managed deployments.

To connect MySQL, you:

Create a dedicated user account.
Grant read access to the databases and tables you want to analyse.
Allow AI Analyst's IP addresses through your firewall or network rules.
Add the connection in Studio.

Queries are read-only

AI Analyst runs the queries behind answers, Models, Metrics and previews inside a read-only transaction, so MySQL refuses data changes made through those queries. No write or administrative privileges are needed. Still use a dedicated user that can only read the data you want to expose. See Read-only access.

1. Create a user in MySQL¶

Create a dedicated MySQL user that AI Analyst uses to query your data:

-- Replace with your own username and a secure password
CREATE USER 'analyst_user'@'%' IDENTIFIED BY '<your_secure_password>';

-- Grant usage access (no database access yet)
GRANT USAGE ON *.* TO 'analyst_user'@'%';

Use a strong password and don't reuse credentials across systems.

2. Grant read access to your data¶

Decide which databases and tables AI Analyst should read, typically your reporting or analytics databases.

-- Replace your_database with the actual name
GRANT SELECT ON your_database.* TO 'analyst_user'@'%';

This gives the user read access to all tables in that database. For finer control, grant access table by table:

GRANT SELECT ON your_database.sales_data TO 'analyst_user'@'%';
GRANT SELECT ON your_database.customer_summary TO 'analyst_user'@'%';

Repeat the grants for each database AI Analyst needs. In MySQL, each database you grant access to appears as a schema that you can expose in Studio.

Optional hardening¶

Restrict host access: once you have AI Analyst's outbound addresses (step 3), replace '%' with those addresses in the CREATE USER and GRANT statements.
Limit resource usage: apply resource limits such as MAX_QUERIES_PER_HOUR to the user if needed.

3. Allow AI Analyst to reach your server¶

If your MySQL server is behind a firewall or network rules, allow inbound connections on its port (3306 by default) from AI Analyst's outbound IP addresses:

Actian SaaS: when your deployment publishes its outbound addresses, the Setup help panel next to the connection form lists them under Which IPs to allow. If the panel doesn't list any addresses, contact Actian support for them.
Self-managed deployment: allow the outbound addresses of your own AI Analyst installation. If the database has a private network address, your operator must also allow that private range for warehouse connections.

See Network access for details.

4. Add the connection in Studio¶

In Studio, open Connections, click + (Add connection) and choose MySQL under Warehouses.
Under Connection details, enter a Name. Names must be unique among the connections you can see. See Connections and Workspaces. Optionally add a Description.
Optionally, tick Private to this Workspace so that only the active Workspace can see and use the connection. See Who can see the connection.

Under Credentials, fill in the fields:

Field	Value
Host	Your server's hostname or IP address, without a protocol (no `https://`)
Port	`3306` by default
Database	The default database AI Analyst connects to
Username	`analyst_user`
Password	The password you set in step 1
SSL mode	Disable by default. If your server requires encryption, see SSL mode.

Instead of typing each field, you can click Paste a connection string, paste a string such as mysql://user:password@host:3306/database, and click Fill the form. Nothing is sent until you test the connection.

Click Test connection. When the test succeeds, Schemas appears and lists the databases the user can see. The first one is selected.
The preselected database is exposed by default. To change it, select the databases to expose for browsing and model authoring. Changing the selection resets the test, so click Test connection again afterwards. Your selection is kept.
Click Save connection. The button stays disabled until a test succeeds and the connection has a name.

Studio opens the new connection. Credentials are encrypted at rest and are never shown again after saving. To browse tables, re-test the connection or update credentials later, see Manage connections.

SSL mode¶

The SSL mode options behave as follows in AI Analyst:

SSL mode	Encrypts the connection	Verifies the server certificate
Disable (default)	No	No
Require	Yes	Yes
Require (no verify)	Yes	No
Verify CA	Yes	No. It currently behaves like Require (no verify).
Verify full	Yes	Yes

If your server requires encrypted connections, choose Require. If the test then fails with Could not establish a secure connection, your server probably uses a self-signed certificate or one issued by a private certificate authority. Choose Require (no verify) to keep the connection encrypted without verifying the certificate. Uploading a CA certificate or a client certificate is not supported.

Who can see the connection¶

A new connection is attached to the Workspace you are working in.

Organization connection (default): an organization admin can attach it to other Workspaces later.
Private to this Workspace: only this Workspace can see or use it. An organization admin can later share it with the whole organization. A shared connection can't be made private again.

See Connections and Workspaces.

Local and private addresses

If you enter localhost, a private IP address or a hostname without a domain, the form shows This looks like a local address. The form doesn't block you, but you can only save after a successful test, and the test only succeeds if AI Analyst's servers can reach the address and your deployment allows it. AI Analyst refuses private addresses unless the deployment allows that range. On a self-managed deployment, ask your operator to allow it. See Network access. localhost points to the server AI Analyst connects from, not to your computer.

Next steps¶

Before people can ask questions about this data:

Create Models on the tables you want to analyse.
Add the Models to an AI Analyst.

You can also monitor the connection's health.

Troubleshooting¶

Message after Test connection or Save connection	Likely cause and fix
Fill in … before testing the connection	A required field is empty. Fill in the fields it names.
Authentication failed	Check the Username and Password. If you restricted the user by host, check that it allows AI Analyst's IP addresses.
Could not reach the warehouse	Check the Host and Port, and that your firewall allows AI Analyst's IP addresses (step 3).
Could not establish a secure connection	The SSL settings don't match the server. See SSL mode.
This warehouse user cannot see those objects	Grant `SELECT` as shown in step 2.
The test succeeds but Schemas doesn't appear	The user can't see any database. Check the grants in step 2. The request to list schemas can also fail after the test (a brief error appears). Click Test connection again.
Warehouse host is not allowed	The host is a private or blocked address, doesn't resolve, or includes a protocol, path or port. Use a publicly reachable host name, or on a self-managed deployment ask your operator to allow the private range. See Network access.
A connection with this name already exists	Choose a different Name. This message appears after you click Save connection.