PostgreSQL setup guide

Agents read your numbers and run reports.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open PostgreSQL, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

PostgreSQL can be connected 2 ways.

Connection string

API key.

1. Create a read-only login for Everdeck. As a database admin, on PostgreSQL 14 or later run: CREATE ROLE everdeck_ro LOGIN PASSWORD '<a long random password>'; GRANT pg_read_all_data TO everdeck_ro; ALTER ROLE everdeck_ro SET default_transaction_read_only = on; ALTER ROLE everdeck_ro SET statement_timeout = '30s'; On PostgreSQL 13 or earlier, grant CONNECT on the database, USAGE on each schema and SELECT ON ALL TABLES IN SCHEMA instead, and add ALTER DEFAULT PRIVILEGES ... GRANT SELECT ON TABLES so new tables stay readable. To hide sensitive tables, grant SELECT table by table instead of pg_read_all_data.
2. Make the database reachable over the internet with TLS, and allow Everdeck's outbound IP addresses in your firewall or your provider's network allowlist (ask Everdeck support for the current list of addresses). On Supabase, use the Session pooler connection string, which works over IPv4.
3. Paste the connection string with sslmode=require (or verify-full). Percent-encode special characters in the password (@ becomes %40, / becomes %2F), or use the key=value form instead: host=db.example.com port=5432 dbname=app user=everdeck_ro password=... sslmode=require With sslmode=require Everdeck asks for SCRAM channel binding (channel_binding=require). A connection pooler that can't do channel binding (PgBouncer, or some providers' poolers) refuses that sign-in: add &channel_binding=disable to the connection string (channel_binding=disable in the key=value form). Everdeck still never sends the password itself.

Field	What to enter
Connection string	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at PostgreSQL until you delete or rotate it there.

Host, user and password

Username and password.

1. Create a read-only login for Everdeck. As a database admin, on PostgreSQL 14 or later run: CREATE ROLE everdeck_ro LOGIN PASSWORD '<a long random password>'; GRANT pg_read_all_data TO everdeck_ro; ALTER ROLE everdeck_ro SET default_transaction_read_only = on; ALTER ROLE everdeck_ro SET statement_timeout = '30s'; On PostgreSQL 13 or earlier, grant CONNECT on the database, USAGE on each schema and SELECT ON ALL TABLES IN SCHEMA instead, and add ALTER DEFAULT PRIVILEGES ... GRANT SELECT ON TABLES so new tables stay readable.
2. Make the database reachable over the internet with TLS, and allow Everdeck's outbound IP addresses in your firewall or your provider's network allowlist (ask Everdeck support for the current list of addresses).
3. Enter the host, port, database name, the everdeck_ro user and its password. With TLS required, Everdeck asks for SCRAM channel binding. If a connection pooler in front of the database can't do channel binding, use the Connection string method instead and add channel_binding=disable to it.

Field	What to enter
Host	Text. For example db.example.com.
Port (optional)	Text. Starts as 5432.
Database name	Text. For example app.
User	Text. For example everdeck_ro.
Password	A secret: Everdeck saves it encrypted and never shows it again.
Encryption (optional)	Choice: TLS required (sslmode=require), TLS with certificate and host name check (sslmode=verify-full). Starts as require.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at PostgreSQL until you delete or rotate it there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List schemasTier 0 · ReadReads outside contentpostgresql_list_schemas

  The database's schemas (other than PostgreSQL's own) with how many tables and views each holds that the connection can read.

• List tablesTier 0 · ReadReads outside contentpostgresql_list_tables

  Tables, views and materialized views in a schema that the connection can read, with estimated row count, size and the table comment. Optionally filter by part of the name.

• Describe a tableTier 0 · ReadReads outside contentpostgresql_describe_table

  A table's or view's columns (name, type, nullable, default, comment), primary key, unique constraints, foreign keys in both directions, indexes and estimated row count. Read this before writing SQL that joins tables.

• Preview rowsTier 0 · ReadReads outside contentpostgresql_preview_table

  The first rows of a table or view, optionally only some columns and sorted by one column (for example the newest orders by created_at, descending).

• Run a read-only SQL queryTier 0 · ReadReads outside contentpostgresql_run_query

  Run one read-only SQL query (SELECT, WITH ... SELECT, VALUES or TABLE) and get column names and up to max_rows rows. Use $1, $2... placeholders with params for values instead of pasting them into the SQL. Writes, DDL, several statements, and queries running longer than the timeout are refused. Qualify tables with their schema when not in public.

• Check a query planTier 0 · ReadReads outside contentpostgresql_explain_query

  Show PostgreSQL's plan for a read-only query without running it: estimated cost and rows, and whether it uses indexes or scans whole tables. Use it before a query on a big table.

What can start work

These events from PostgreSQL can become tasks for your agents through Intake. How Intake works.

New rows appeared in a table the company chooses (for example orders, signups or tickets), detected by an increasing ID or timestamp column.

Connect PostgreSQL first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If PostgreSQL later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit.

To stop agents using PostgreSQL, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.