Coalesce Quality Recon Configuration

Disable SSL certificate verification.

Snowflake account identifier.

Virtual warehouse to use for queries.

Role to assume after connecting.

PEM-encoded private key content for key-pair authentication.

Path to a PEM-encoded private key file.

Passphrase to decrypt the private key.

Databases to include. If empty, all accessible databases are scraped.

Use GET_DDL() to retrieve DDL for tables and views.

Database containing the ACCOUNT_USAGE schema. Defaults to SNOWFLAKE.

Set to "externalbrowser" to use SSO browser-based authentication.

GCP project ID.

Region for BigQuery resources.

Inline JSON content of the service account key.

Path to the service account key JSON file.

Explicit list of dataset names to scrape. When set, only these datasets are queried
and project-level bigquery.datasets.list permission is not required.

Estimate table freshness from Redshift query logs instead of metadata.

Disable SSL certificate verification.

Additional DSN parameters passed to the driver.

Database the connection opens with, so an unqualified table name in a query
resolves against it. It does not restrict what is scraped: metadata comes
from system tables and covers every database the user can see, whatever this
says. Empty opens on "default".

Disable SSL certificate verification.

How ClickHouse system tables are read. Omit to keep reading across a
cluster named "default", which every ClickHouse Cloud service provides.

Use a plain HTTP connection instead of HTTPS.

Catalogs to include. Required for most Trino deployments.

Databricks workspace URL.

Personal access token for authentication.

OAuth client ID (M2M authentication).

OAuth client secret (M2M authentication).

SQL warehouse ID to use for queries.

Trust the server certificate without validation.

Encryption mode (e.g. "true", "false", "strict").

Federated authentication method (e.g. "ActiveDirectoryDefault").

Pre-acquired access token for Azure AD authentication.

Azure AD application client ID for service principal auth.

Oracle service name.

Enable SSL/TLS for the connection.

Verify the server's SSL certificate.

Path to Oracle Wallet directory for authentication.

Enable Oracle Diagnostics Pack features (AWR, ASH).

File path, ':memory:' for in-memory, or MotherDuck database name.

MotherDuck organization/account name (for cloud mode).

MotherDuck authentication token (required for cloud MotherDuck).

AWS region hosting the Athena service and Glue Data Catalog.

Athena workgroup. Defaults to "primary" when empty. Must have a
ResultConfiguration.OutputLocation configured.

Glue Data Catalog name. Defaults to "AwsDataCatalog" when empty.

Static AWS credentials. Pair accesskeyid with secretaccesskey.

Optional STS session token, when accesskeyid+secretaccesskey are
short-lived STS credentials.

Named AWS shared-config profile (from ~/.aws/credentials or
~/.aws/config). Used only when static credentials are absent.

IAM role ARN to assume via STS. Wraps whichever base credentials
resolved above (or the host's default chain when no other auth is set).

External ID required by the role's trust policy. Pair with role_arn.

Optional STS session name. Defaults to "synq-athena".

Scope filter for include/exclude filtering by Glue catalog, Glue
database, and table. Mapping: ScopeRule.database = Glue catalog,
ScopeRule.schema = Glue database, ScopeRule.table = Glue table/view.

Use SHOW CREATE TABLE to retrieve full table DDL (CTAS bodies, Iceberg
TBLPROPERTIES, Hive external LOCATION/SerDe). One Athena query per
table — billed at the 10MB scan minimum each.

Use SHOW CREATE VIEW to retrieve full view DDL instead of the
rewritten body from informationschema.views.viewdefinition.

For Iceberg tables, fan out one Athena query per table to read row
count, total file size, snapshot commit timestamp, and partition
columns from the table's $files / $snapshots / $partitions metadata
tables. Hive externals are unaffected.

Hostname of the workspace's SQL analytics endpoint. Copy it from the
Fabric portal: open your Warehouse or Lakehouse, then Settings → SQL
connection string.

Default database for queries that don't name one explicitly. Optional —
defaults to "master". Because metadata and metric queries are always
fully qualified, this only affects ad-hoc SQL that omits the database.

Application (client) ID of the Entra ID service principal. When authtype
is "managedidentity", this instead selects a user-assigned identity.

Client secret for the service principal. Supply it through an environment
variable (e.g. ${FABRICCLIENTSECRET}) rather than committing it in plain
text.

Entra ID tenant (directory) ID. Optional — inferred from the endpoint
hostname when omitted. Set it only when the service principal lives in a
different tenant than the workspace.

A pre-acquired Entra ID OAuth access token for the SQL scope
(https://database.windows.net/.default). Optional — when set it overrides
every other authentication method. Mainly for hosted deployments that mint
their own token.

Optional include/exclude filter that limits which databases, schemas and
tables are scanned. When omitted, the whole workspace is scanned.

Host name or IP address of the Db2 server (HOSTNAME).

TCP/IP port of the instance (PORT): the SVCENAME database manager
configuration parameter, or SSL_SVCENAME when security is SSL. Optional,
defaults to 50000, or 50001 with SSL.

Database name or alias (DATABASE), as in CONNECT TO <database>.

Authorization ID to connect with (UID). Db2 checks it against the
server's operating system, or LDAP when an LDAP plugin is configured.

Password of the authorization ID (PWD). Supply it through an environment
variable (e.g. ${DB2_PASSWORD}) rather than committing it in plain text.

Set to SSL to connect over SSL/TLS (SECURITY=SSL). Leave it out for a
plain TCP/IP connection.

Content of the same certificate, starting with
-----BEGIN CERTIFICATE-----, for when you can't point to a file. Needs
security set to SSL.

How the authorization ID and password travel to the server
(AUTHENTICATION). SERVER (default) sends them unencrypted, so use it with
SSL on an untrusted network. SERVER_ENCRYPT encrypts them and needs the
instance's AUTHENTICATION to accept encrypted credentials.

Connection name (must exist in connections map).

Base SQL query (mutually exclusive with 'table'). Supports {{variable_name}} interpolation.

Table reference (mutually exclusive with 'query'). Accepts "db.schema.table" string or structured object.

Explicit list of the columns to compare, read from the table or from the query's result. Mutually exclusive with 'exclude_columns'.

Columns to leave out of the comparison, from the table or the query's result (resolved at runtime). Mutually exclusive with 'columns'.

SQL WHERE clause filter (only with 'table'). Applied as WHERE (condition). Supports {{variable_name}} interpolation.

Time-travel timestamp. Wraps query with database-specific time-travel syntax.

Whether a run may drill into a mismatch of this reconciliation. Defaults to true, also when a bisection block omits it. false keeps run --auto-drill and workspace runs to the quick check for this reconciliation, whatever the run's own drill setting; run-drill still drills it.

Number of segments per bisection level.

Stop drilling when segment row count falls below this.

Segmentation strategy.

Column for time-based partitioning (required when strategy is 'time').

Time truncation granularity.

How much a drill reports about mismatched rows. detailed reads their
column values and works only when synq-recon runs locally: Coalesce
Quality refuses to save, promote or run a suite that sets it.

Column(s) defining the drill-down hierarchy.

ThresholdConfig defines tolerance for aggregate differences.

Tolerance for the difference between the source and target row counts. A difference within it reports mismatched within threshold instead of mismatched, and no drill runs. When not set, the counts must be equal.

Per-query timeout (e.g., '30s', '5m'). A query that runs past it fails with a timeout and is not retried. Covers setup and teardown statements too; to bound the whole reconciliation, use its timeout.

Maximum retry attempts for transient query failures. Setup and teardown statements are never retried.

Initial backoff delay before the first retry.

Backoff multiplier applied after each retry.

Timestamp or date column the window filters each table side on, with no hand-written predicate. A query side, or a table 'where' that already references {{windowstart}} or {{windowend}}, is filtered only by what its SQL says.

How far back to look from the run's reference time, and so positive (e.g., '14d', 'P14D', '14 days', {count: 14, period: day}). A zero or negative lookback is ignored.

'sliding' (default) ends the window at the run's reference time. 'fixed' ends it at the last period boundary in UTC (midnight for a whole number of days, the hour for whole hours, otherwise the minute), so every run inside one period compares the same rows.

Simple: same column for both source and target watermark derivation.

Medium: different columns per side.

Advanced: full per-side watermark derivation config.

Advanced: full per-side watermark derivation config.

How to combine watermarks when both sides are configured: min, max, source, target.

Truncate the combined watermark to a time boundary before applying.

Time offset applied after truncation. Negative durations create a safety buffer (e.g., '-30m', '-PT30M', '-30 minutes', {count: -30, period: minute}).

Advanced: custom apply config for WHERE clause generation.

Decimal places decimal and floating-point columns are compared at (0-18), or "exact". When not set, a decimal column is compared at the scale both sides share and a floating-point column at the digits both sides hold. "exact" compares a decimal at its declared scale, which must be known and the same on both sides, and a floating-point column digit for digit, which needs both sides on the same kind of database: otherwise the reconciliation fails rather than rounding.

Settings for individual columns, overriding the settings above. Written on a reconciliation, an entry beats the reconciliation's own settings. Written on the suite, it applies to every reconciliation with that column that does not set the same setting itself.

How much of a second timestamp columns are compared to, timestamp key columns included. When not set, a timestamp is compared at the precision both sides hold, the coarser of the two. Both sides are cut to it, never rounded.

The time zone the source side's timestamps without a time zone hold their wall clock in, as an IANA name such as Europe/Warsaw. When not set, UTC. A timestamp with a time zone is not affected.

The time zone the target side's timestamps without a time zone hold their wall clock in, as an IANA name such as Europe/Warsaw. When not set, UTC. A timestamp with a time zone is not affected.