---
name: redash-connect
description: Connect to Redash to run SQL queries against Humand databases. Includes data source table, core tables (Users, Instances, FeatureFlags, CommunityFeatures) and client commands. Use when the user mentions Redash, wants to query data, run queries, or analyze instance/user information.
---

# Redash Connect

Base skill for interacting with Redash via API. Includes the core tables every PM needs.

## Client

The script is at `scripts/redash_client.py` (alongside this SKILL.md). Requires `requests` (`pip install requests`) and a `config.json` in the same folder:

```json
{"redash_url": "https://redash.humand.co", "api_key": "..."}
```

### Commands

```bash
# List available data sources
python3 scripts/redash_client.py list-datasources

# Run ad-hoc SQL (datasource ID, query)
python3 scripts/redash_client.py run-adhoc 1 "SELECT * FROM \"Users\" LIMIT 5" --format csv

# Run saved query
python3 scripts/redash_client.py run-saved QUERY_ID --format csv
python3 scripts/redash_client.py run-saved QUERY_ID --params '{"fecha": "2026-01-01"}'

# Search saved queries
python3 scripts/redash_client.py list-queries --search "usuarios"

# Get last result without re-executing
python3 scripts/redash_client.py get-result QUERY_ID --format json
```

Use CSV format for tabular analysis, JSON for programmatic processing. Use `python3` (not `python`) on macOS.

## Data sources

| ID | Name | Contents |
|----|------|----------|
| 1 | Humand Prod \| Read replica | Main database (monolith): users, instances, segmentations, legacy permissions, audit, feature flags |
| 4 | Redash \| Query Results | Queries on results from other queries (to cross data from different DSs) |
| 13 | Insights | Backend security events + Amplitude data (monthly tables + daily_active_users) |
| 25 | Cerberus | Roles and permissions (new model, replaces capabilities if `CERBERUS_ENABLED = true`) |
| 26 | Squidward Prod | Squidward microservice |
| - | Employeelifecycle | Onboarding and Tasks (if feature flag `VIEW_EMPLOYEE_LIFECYCLE`) |
| - | Panda | Service Management (associated with `Users.isAgent`) |

### When to use each DS

| I need to know... | Look in | Condition |
|-------------------|---------|-----------|
| Users, org structure, segmentations | DS 1 | Always |
| User permissions | DS 1 (Capabilities + UserCapabilities) | If `CERBERUS_ENABLED` = false |
| User permissions | DS 25 (Cerberus) | If `CERBERUS_ENABLED` = true |
| Activity / security events | DS 13 (api_events) | Always |
| Product activity (DAU, events) | DS 13 (Amplitude / daily_active_users) | Always |
| Onboarding / Tasks | Employeelifecycle | If feature flag `VIEW_EMPLOYEE_LIFECYCLE` |
| Onboarding / Tasks (legacy) | DS 1 | If NOT `VIEW_EMPLOYEE_LIFECYCLE` |

### Architectural context

Humand started as a monolith (DS 1). Newer modules were created as independent microservices with their own DBs. Check `FeatureFlags` or `CommunityFeatures` to determine whether a module runs in the monolith or a microservice.

## Core tables (DS 1)

### Users

| Column | Description |
|--------|-------------|
| `id` | PK. FK in all other tables |
| `instanceId` | Which community it belongs to |
| `employeeInternalId` | User identifier (employee number, email, etc). **Unique per community** |
| `email` | Not required. May repeat within the same community |
| `status` | `active` / `unclaimed` / `deactivated` (see below) |
| `deletedAt` | If set → was deleted, regardless of status |
| `firstLogin` | Date of first login |
| `isAgent` | Associated with Service Management (Panda) |

**Statuses**: `unclaimed` = created, never logged in. `active` = logged in at least once. `deactivated` = deactivated by an admin.

**Gotchas**: `workdays` is deprecated, DO NOT USE. Profile fields (uuid) are resolved against the Instances schema.

### Instances

The Humand client base. Each instance = one community/client.

| Column | Description |
|--------|-------------|
| `id` | PK |
| `name` | Community name |
| `deletedAt` | If set → was deleted |
| `isTest` | **NOT reliable** — almost nobody sets it. Use `InstanceCrmData.status` |

### InstanceCrmData

Instance CRM data. JOIN with `Instances` via `instanceId`.

| Column | Description |
|--------|-------------|
| `instanceId` | FK to Instances |
| `status` | `PRODUCTION`, `TEST`, `ONBOARDING`, etc. Reliable source for filtering real instances |

### FeatureFlags

Controls which features are enabled per instance. Key to knowing whether to look in the monolith or a microservice.

| Column | Type | Description |
|--------|------|-------------|
| `id` | integer | PK |
| `instanceId` | integer | FK to Instances |
| `code` | varchar | Flag name in UPPERCASE (e.g.: `CERBERUS_ENABLED`, `VIEW_EMPLOYEE_LIFECYCLE`) |
| `value` | text | Flag value (e.g.: `true`, `false`, or custom values) |
| `type` | enum | Flag type |
| `description` | varchar | Flag description |
| `createdAt` / `updatedAt` | timestamp | Audit dates |

Key flags: `CERBERUS_ENABLED` (permissions in Cerberus vs Capabilities), `ROLES_AND_PERMISSIONS_VISIBLE` (roles UI visible but not functional), `VIEW_EMPLOYEE_LIFECYCLE` (onboarding in microservice).

### CommunityFeatures

Features enabled at community level (apps/modules).

| Column | Type | Description |
|--------|------|-------------|
| `id` | integer | PK |
| `instanceId` | integer | FK to Instances |
| `code` | varchar | Feature name |
| `scope` | varchar | Feature scope/state |
| `createdAt` / `updatedAt` | timestamp | Audit dates |

## Security rules

- **NEVER expose credentials**: do not write the API key in inline commands, temporary scripts, or messages.
- **ALWAYS use the script**: all Redash interaction MUST go through `redash_client.py`. NEVER use curl or inline requests.
- Credentials live ONLY in `config.json`.

## Related skills

- **Need details on segmentations, audit, sessions, or the legacy permissions model?** → Read skill `redash-schema`, which has reference files per data source.
- **Need to build a Redash dashboard?** → Read skill `redash-dashboard`.
- **Interpreting composite communities or cleaning up demos?** → Read skill `redash-comunidades-compuestas`.
- **Who has privileged permissions / is an admin?** → Read skill `redash-permisos-cerberus`.
