diff --git a/_data/shared_chrome.json b/_data/shared_chrome.json index 1879300ddf..dc436225ee 100644 --- a/_data/shared_chrome.json +++ b/_data/shared_chrome.json @@ -1,7 +1,7 @@ { "$schema": "https://www.metabase.com/shared/chrome.schema.json", "version": 1, - "generated_at": "2026-08-11T21:17:43+00:00", + "generated_at": "2026-08-14T19:47:27+00:00", "origin": "https://www.metabase.com", "stylesheets": [ { @@ -172,6 +172,6 @@ } } ], - "header_html": "\n \n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n
\n \n \n
\n
\n \"OUTER\n Where data people meet. Oct 5–7, 2026 · Denver, CO\n \n Book your seat\"Chevron\n \n
\n \n
\n\n\n \n\n
\n
\n
\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n \n
\n\n \n
\n\n \n\n
\n \n\n \n\n \n\n \n\n \n\n
\n \n\n
\n \n \n \n \n\n\n 48.7k\n \n \n \n\n\n \n\n Log in\n \n\n Get started\n
\n \n \n \n \n \n
\n
\n
\n
\n \n\n
\n\n \n\n\n\n\n\n \n\n\n\n\n\n \n\n\n\n\n\n \n\n\n\n \n\n\n\n\n\n\n \n Log in\n \n
\n\n
\n
\n\n\n\n\n", - "footer_html": "\n \n
\n \n
\n\n\n\n\n\n\n\n\n\n\n" + "header_html": "\n \n\n\n\n\n\n\n\n\n\n\n\n
\n
\n \n \n
\n
\n \"OUTER\n Where data people meet. Oct 5–7, 2026 · Denver, CO\n \n Book your seat\"Chevron\n \n
\n \n
\n\n\n \n\n
\n
\n
\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n \n
\n\n \n
\n\n \n\n
\n \n\n \n\n \n\n \n\n \n\n
\n \n\n
\n \n \n \n \n\n\n 48.8k\n \n \n \n\n\n \n\n Log in\n \n\n Get started\n
\n \n \n \n \n \n
\n
\n
\n
\n \n\n
\n\n \n\n\n\n\n\n \n\n\n\n\n\n \n\n\n\n\n\n \n\n\n\n \n\n\n\n\n\n\n \n Log in\n \n
\n\n
\n
\n\n\n\n\n", + "footer_html": "\n \n
\n \n
\n\n\n\n\n\n\n\n" } diff --git a/_docs/latest/ai/settings.md b/_docs/latest/ai/settings.md index c84a821334..1a957ac922 100644 --- a/_docs/latest/ai/settings.md +++ b/_docs/latest/ai/settings.md @@ -69,8 +69,10 @@ You can specify your own API key and model for Metabot from one of the supported - **Amazon Bedrock**: Claude and GPT models. - **Anthropic**: Claude models (Opus, Sonnet, Haiku, and Fable). - **Microsoft Azure**: Your own Azure deployments of Claude or GPT models. Enter the deployment name you configured in Azure. +- **Mistral** - **OpenAI**: GPT models. -- **OpenRouter**: Claude and GPT models. +- **OpenRouter**: Claude, GPT, Mistral, DeepSeek, and GLM-5.2 models. +- **Z.AI**: GLM-5.2 models. If you're interested in Metabase supporting more AI providers or models, let us know by submitting a [feature request](../troubleshooting-guide/requesting-new-features). diff --git a/_docs/latest/configuring-metabase/config-template.md b/_docs/latest/configuring-metabase/config-template.md index 19f3a42e51..a6307f2348 100644 --- a/_docs/latest/configuring-metabase/config-template.md +++ b/_docs/latest/configuring-metabase/config-template.md @@ -246,9 +246,19 @@ config: map-tile-server-url: https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png mcp-apps-cors-custom-origins: '' mcp-apps-cors-enabled-clients: [] + metabot-advanced-permissions: false + metabot-chat-system-prompt: '' metabot-enabled: true + metabot-icon: metabot + metabot-limit-reset-rate: monthly + metabot-limit-unit: tokens + metabot-name: Metabot + metabot-nlq-system-prompt: '' + metabot-quota-reached-message: You have reached your AI usage limit for the current period. Please contact your administrator. metabot-recent-views-enabled: true + metabot-show-illustrations: true metabot-slack-signing-secret: null + metabot-sql-system-prompt: '' mfa-challenge-signing-key: null mfa-enforcement: 'off' native-query-autocomplete-match-style: substring @@ -357,4 +367,5 @@ config: usage-metadata-retention-days: 90 usage-metadata-schedule: 0 0 2 * * ? * user-visibility: all + warehouse-allowed-networks: null ``` diff --git a/_docs/latest/configuring-metabase/environment-variables.md b/_docs/latest/configuring-metabase/environment-variables.md index 2f37d38aa4..273c831fe8 100644 --- a/_docs/latest/configuring-metabase/environment-variables.md +++ b/_docs/latest/configuring-metabase/environment-variables.md @@ -1558,6 +1558,28 @@ Custom CORS origins for self-hosted MCP clients, space-separated. Popular MCP clients enabled for CORS, stored as CSV client keys (e.g. claude, vscode). +### `MB_METABOT_ADVANCED_PERMISSIONS` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: boolean +- Default: `false` +- [Exported as](../installation-and-operation/serialization): `metabot-advanced-permissions`. +- [Configuration file name](./config-file): `metabot-advanced-permissions` + +Whether the AI feature access admin page shows granular, per-tool group permissions instead of a single on/off toggle per group. + +### `MB_METABOT_CHAT_SYSTEM_PROMPT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `` +- [Exported as](../installation-and-operation/serialization): `metabot-chat-system-prompt`. +- [Configuration file name](./config-file): `metabot-chat-system-prompt` + +Custom instructions appended to Metabot's system prompt for the chat experience (the AI sidebar and embedded Metabot). + ### `MB_METABOT_ENABLED` - Type: boolean @@ -1567,6 +1589,72 @@ Popular MCP clients enabled for CORS, stored as CSV client keys (e.g. claude, vs Whether Metabot is enabled for regular usage. +### `MB_METABOT_ICON` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `metabot` +- [Exported as](../installation-and-operation/serialization): `metabot-icon`. +- [Configuration file name](./config-file): `metabot-icon` + +The icon for Metabot. Set to `metabot` for the default icon, or a data URI for a custom uploaded image (up to 1MB). + +### `MB_METABOT_LIMIT_RESET_RATE` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: keyword +- Default: `monthly` +- [Exported as](../installation-and-operation/serialization): `metabot-limit-reset-rate`. +- [Configuration file name](./config-file): `metabot-limit-reset-rate` + +How often Metabot usage limits reset: `daily`, `weekly`, or `monthly`. + +### `MB_METABOT_LIMIT_UNIT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: keyword +- Default: `tokens` +- [Exported as](../installation-and-operation/serialization): `metabot-limit-unit`. +- [Configuration file name](./config-file): `metabot-limit-unit` + +The unit used for Metabot usage limits: `tokens` or `messages`. + +### `MB_METABOT_NAME` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `Metabot` +- [Exported as](../installation-and-operation/serialization): `metabot-name`. +- [Configuration file name](./config-file): `metabot-name` + +The display name for Metabot, shown throughout the Metabase UI. + +### `MB_METABOT_NLQ_SYSTEM_PROMPT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `` +- [Exported as](../installation-and-operation/serialization): `metabot-nlq-system-prompt`. +- [Configuration file name](./config-file): `metabot-nlq-system-prompt` + +Custom instructions appended to Metabot's system prompt for the natural language query (AI exploration) experience. + +### `MB_METABOT_QUOTA_REACHED_MESSAGE` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `You have reached your AI usage limit for the current period. Please contact your administrator.` +- [Exported as](../installation-and-operation/serialization): `metabot-quota-reached-message`. +- [Configuration file name](./config-file): `metabot-quota-reached-message` + +The message shown to users when they reach their usage quota. + ### `MB_METABOT_RECENT_VIEWS_ENABLED` - Type: boolean @@ -1574,6 +1662,17 @@ Whether Metabot is enabled for regular usage. Whether the user's recently viewed items are included in the Metabot system prompt. +### `MB_METABOT_SHOW_ILLUSTRATIONS` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: boolean +- Default: `true` +- [Exported as](../installation-and-operation/serialization): `metabot-show-illustrations`. +- [Configuration file name](./config-file): `metabot-show-illustrations` + +Whether to show Metabot illustrations in the UI. + ### `MB_METABOT_SLACK_SIGNING_SECRET` - Type: string @@ -1582,6 +1681,17 @@ Whether the user's recently viewed items are included in the Metabot system prom Signing secret for verifying requests from the Metabot Slack app. +### `MB_METABOT_SQL_SYSTEM_PROMPT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `` +- [Exported as](../installation-and-operation/serialization): `metabot-sql-system-prompt`. +- [Configuration file name](./config-file): `metabot-sql-system-prompt` + +Custom instructions appended to Metabot's system prompt for the SQL generation experience. + ### `MB_MFA_CHALLENGE_SIGNING_KEY` - Type: string @@ -2638,6 +2748,19 @@ Cron schedule (in UTC) for usage metadata batch processing. Note: Sandboxed users will never see suggestions. +### `MB_WAREHOUSE_ALLOWED_NETWORKS` + +- Type: keyword +- Default: `null` + +Controls which networks Metabase may connect to for warehouse connections. +Options: +- external-only (only globally routable public addresses) +- allow-private (external + private networks but NOT loopback or link-local) +- allow-all (no restrictions). +Defaults to external-only on Metabase Cloud and allow-all when self-hosted. +Also covers the SSH tunnel host and the database auth-provider URLs. + ## Other environment variables The following environment variables can only be set via the environment. They cannot be set by the configuration file. diff --git a/_docs/latest/permissions/impersonation.md b/_docs/latest/permissions/impersonation.md index dd9ddbe435..40a62fb563 100644 --- a/_docs/latest/permissions/impersonation.md +++ b/_docs/latest/permissions/impersonation.md @@ -178,6 +178,16 @@ If instead you want to give a group SQL access to some, but not all, of the sche Connection impersonation doesn't apply to people in the Metabase Admins group, as their more permissive privileges take precedence. +## Impersonated queries must be a single SELECT statement + +When people with impersonated access use the native SQL editor, they will only be able to write queries with a single select statement. Metabase will check each native query before running it and reject anything that isn't a single `SELECT` statement. Common table expressions (`WITH`) and set operations (`UNION`, `INTERSECT`, `EXCEPT`) count as a single `SELECT` statement, so those queries will run. + +Examples of queries Metabase will reject: + +- Multiple statements separated by semicolons, like `SET ROLE analyst; SELECT * FROM people;` +- Statements that create or change tables, including temporary tables (`CREATE`, `ALTER`, `DROP`) +- Role-switching statements like `SET ROLE` or `USE ROLE` + ## Metabase gives people the most permissive access to data across all of their groups So if a person is in two groups with different permissions for the same database: diff --git a/_docs/latest/questions/native-editor/writing-sql.md b/_docs/latest/questions/native-editor/writing-sql.md index 0e15c27c71..52d32a7551 100644 --- a/_docs/latest/questions/native-editor/writing-sql.md +++ b/_docs/latest/questions/native-editor/writing-sql.md @@ -103,9 +103,9 @@ You can use [Snippets](snippets) to save, reuse, and share SQL code across multi When you run a query from the SQL editor, Metabase sends the query to your database exactly as it is written. Any results or errors displayed in Metabase are the same as the results or errors that you would get if you ran the query directly against your database. If the SQL syntax of your query doesn’t match the SQL dialect used by your database, your database won’t be able to run the query. -## The native query editor is designed for reading data, not writing it +## SQL commands the editor doesn't support -The native SQL editor is designed for asking questions about your data. Don't use the editor for: +The native SQL editor is designed for asking questions about your data. The editor doesn't support: - Multi-statement queries - Stored procedures and function calls @@ -113,6 +113,8 @@ The native SQL editor is designed for asking questions about your data. Don't us Depending on your connection's privileges, some of the above actions may work, but none are officially supported, and we recommend against using the native query editor for these tasks. +On databases that use [impersonation](../../permissions/impersonation), Metabase enforces this: queries must be a single `SELECT` statement, and Metabase will reject multi-statement queries, temporary tables, and DDL. + ## Question version history For questions, [dashboards](../../dashboards/start), and [models](../../data-modeling/models), Metabase keeps a version history for the previous fifteen versions of that item. diff --git a/_docs/v0.63/ai/settings.md b/_docs/v0.63/ai/settings.md index 0b665effed..ca14bed35c 100644 --- a/_docs/v0.63/ai/settings.md +++ b/_docs/v0.63/ai/settings.md @@ -66,8 +66,10 @@ You can specify your own API key and model for Metabot from one of the supported - **Amazon Bedrock**: Claude and GPT models. - **Anthropic**: Claude models (Opus, Sonnet, Haiku, and Fable). - **Microsoft Azure**: Your own Azure deployments of Claude or GPT models. Enter the deployment name you configured in Azure. +- **Mistral** - **OpenAI**: GPT models. -- **OpenRouter**: Claude and GPT models. +- **OpenRouter**: Claude, GPT, Mistral, DeepSeek, and GLM-5.2 models. +- **Z.AI**: GLM-5.2 models. If you're interested in Metabase supporting more AI providers or models, let us know by submitting a [feature request](../troubleshooting-guide/requesting-new-features). diff --git a/_docs/v0.63/configuring-metabase/config-template.md b/_docs/v0.63/configuring-metabase/config-template.md index be5c5eadf5..fe3863900f 100644 --- a/_docs/v0.63/configuring-metabase/config-template.md +++ b/_docs/v0.63/configuring-metabase/config-template.md @@ -244,9 +244,19 @@ config: map-tile-server-url: https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png mcp-apps-cors-custom-origins: '' mcp-apps-cors-enabled-clients: [] + metabot-advanced-permissions: false + metabot-chat-system-prompt: '' metabot-enabled: true + metabot-icon: metabot + metabot-limit-reset-rate: monthly + metabot-limit-unit: tokens + metabot-name: Metabot + metabot-nlq-system-prompt: '' + metabot-quota-reached-message: You have reached your AI usage limit for the current period. Please contact your administrator. metabot-recent-views-enabled: true + metabot-show-illustrations: true metabot-slack-signing-secret: null + metabot-sql-system-prompt: '' mfa-challenge-signing-key: null mfa-enforcement: 'off' native-query-autocomplete-match-style: substring @@ -355,4 +365,5 @@ config: usage-metadata-retention-days: 90 usage-metadata-schedule: 0 0 2 * * ? * user-visibility: all + warehouse-allowed-networks: null ``` diff --git a/_docs/v0.63/configuring-metabase/environment-variables.md b/_docs/v0.63/configuring-metabase/environment-variables.md index 38a85d2c8d..a668477d01 100644 --- a/_docs/v0.63/configuring-metabase/environment-variables.md +++ b/_docs/v0.63/configuring-metabase/environment-variables.md @@ -1556,6 +1556,28 @@ Custom CORS origins for self-hosted MCP clients, space-separated. Popular MCP clients enabled for CORS, stored as CSV client keys (e.g. claude, vscode). +### `MB_METABOT_ADVANCED_PERMISSIONS` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: boolean +- Default: `false` +- [Exported as](../installation-and-operation/serialization): `metabot-advanced-permissions`. +- [Configuration file name](./config-file): `metabot-advanced-permissions` + +Whether the AI feature access admin page shows granular, per-tool group permissions instead of a single on/off toggle per group. + +### `MB_METABOT_CHAT_SYSTEM_PROMPT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `` +- [Exported as](../installation-and-operation/serialization): `metabot-chat-system-prompt`. +- [Configuration file name](./config-file): `metabot-chat-system-prompt` + +Custom instructions appended to Metabot's system prompt for the chat experience (the AI sidebar and embedded Metabot). + ### `MB_METABOT_ENABLED` - Type: boolean @@ -1565,6 +1587,72 @@ Popular MCP clients enabled for CORS, stored as CSV client keys (e.g. claude, vs Whether Metabot is enabled for regular usage. +### `MB_METABOT_ICON` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `metabot` +- [Exported as](../installation-and-operation/serialization): `metabot-icon`. +- [Configuration file name](./config-file): `metabot-icon` + +The icon for Metabot. Set to `metabot` for the default icon, or a data URI for a custom uploaded image (up to 1MB). + +### `MB_METABOT_LIMIT_RESET_RATE` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: keyword +- Default: `monthly` +- [Exported as](../installation-and-operation/serialization): `metabot-limit-reset-rate`. +- [Configuration file name](./config-file): `metabot-limit-reset-rate` + +How often Metabot usage limits reset: `daily`, `weekly`, or `monthly`. + +### `MB_METABOT_LIMIT_UNIT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: keyword +- Default: `tokens` +- [Exported as](../installation-and-operation/serialization): `metabot-limit-unit`. +- [Configuration file name](./config-file): `metabot-limit-unit` + +The unit used for Metabot usage limits: `tokens` or `messages`. + +### `MB_METABOT_NAME` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `Metabot` +- [Exported as](../installation-and-operation/serialization): `metabot-name`. +- [Configuration file name](./config-file): `metabot-name` + +The display name for Metabot, shown throughout the Metabase UI. + +### `MB_METABOT_NLQ_SYSTEM_PROMPT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `` +- [Exported as](../installation-and-operation/serialization): `metabot-nlq-system-prompt`. +- [Configuration file name](./config-file): `metabot-nlq-system-prompt` + +Custom instructions appended to Metabot's system prompt for the natural language query (AI exploration) experience. + +### `MB_METABOT_QUOTA_REACHED_MESSAGE` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `You have reached your AI usage limit for the current period. Please contact your administrator.` +- [Exported as](../installation-and-operation/serialization): `metabot-quota-reached-message`. +- [Configuration file name](./config-file): `metabot-quota-reached-message` + +The message shown to users when they reach their usage quota. + ### `MB_METABOT_RECENT_VIEWS_ENABLED` - Type: boolean @@ -1572,6 +1660,17 @@ Whether Metabot is enabled for regular usage. Whether the user's recently viewed items are included in the Metabot system prompt. +### `MB_METABOT_SHOW_ILLUSTRATIONS` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: boolean +- Default: `true` +- [Exported as](../installation-and-operation/serialization): `metabot-show-illustrations`. +- [Configuration file name](./config-file): `metabot-show-illustrations` + +Whether to show Metabot illustrations in the UI. + ### `MB_METABOT_SLACK_SIGNING_SECRET` - Type: string @@ -1580,6 +1679,17 @@ Whether the user's recently viewed items are included in the Metabot system prom Signing secret for verifying requests from the Metabot Slack app. +### `MB_METABOT_SQL_SYSTEM_PROMPT` + +> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans. + +- Type: string +- Default: `` +- [Exported as](../installation-and-operation/serialization): `metabot-sql-system-prompt`. +- [Configuration file name](./config-file): `metabot-sql-system-prompt` + +Custom instructions appended to Metabot's system prompt for the SQL generation experience. + ### `MB_MFA_CHALLENGE_SIGNING_KEY` - Type: string @@ -2636,6 +2746,19 @@ Cron schedule (in UTC) for usage metadata batch processing. Note: Sandboxed users will never see suggestions. +### `MB_WAREHOUSE_ALLOWED_NETWORKS` + +- Type: keyword +- Default: `null` + +Controls which networks Metabase may connect to for warehouse connections. +Options: +- external-only (only globally routable public addresses) +- allow-private (external + private networks but NOT loopback or link-local) +- allow-all (no restrictions). +Defaults to external-only on Metabase Cloud and allow-all when self-hosted. +Also covers the SSH tunnel host and the database auth-provider URLs. + ## Other environment variables The following environment variables can only be set via the environment. They cannot be set by the configuration file. diff --git a/_docs/v0.63/permissions/impersonation.md b/_docs/v0.63/permissions/impersonation.md index 75f1518381..0bd6664bd3 100644 --- a/_docs/v0.63/permissions/impersonation.md +++ b/_docs/v0.63/permissions/impersonation.md @@ -176,6 +176,16 @@ If instead you want to give a group SQL access to some, but not all, of the sche Connection impersonation doesn't apply to people in the Metabase Admins group, as their more permissive privileges take precedence. +## Impersonated queries must be a single SELECT statement + +When people with impersonated access use the native SQL editor, they will only be able to write queries with a single select statement. Metabase will check each native query before running it and reject anything that isn't a single `SELECT` statement. Common table expressions (`WITH`) and set operations (`UNION`, `INTERSECT`, `EXCEPT`) count as a single `SELECT` statement, so those queries will run. + +Examples of queries Metabase will reject: + +- Multiple statements separated by semicolons, like `SET ROLE analyst; SELECT * FROM people;` +- Statements that create or change tables, including temporary tables (`CREATE`, `ALTER`, `DROP`) +- Role-switching statements like `SET ROLE` or `USE ROLE` + ## Metabase gives people the most permissive access to data across all of their groups So if a person is in two groups with different permissions for the same database: diff --git a/_docs/v0.63/questions/native-editor/writing-sql.md b/_docs/v0.63/questions/native-editor/writing-sql.md index 7174a0f83f..3a5215f132 100644 --- a/_docs/v0.63/questions/native-editor/writing-sql.md +++ b/_docs/v0.63/questions/native-editor/writing-sql.md @@ -101,9 +101,9 @@ You can use [Snippets](snippets) to save, reuse, and share SQL code across multi When you run a query from the SQL editor, Metabase sends the query to your database exactly as it is written. Any results or errors displayed in Metabase are the same as the results or errors that you would get if you ran the query directly against your database. If the SQL syntax of your query doesn’t match the SQL dialect used by your database, your database won’t be able to run the query. -## The native query editor is designed for reading data, not writing it +## SQL commands the editor doesn't support -The native SQL editor is designed for asking questions about your data. Don't use the editor for: +The native SQL editor is designed for asking questions about your data. The editor doesn't support: - Multi-statement queries - Stored procedures and function calls @@ -111,6 +111,8 @@ The native SQL editor is designed for asking questions about your data. Don't us Depending on your connection's privileges, some of the above actions may work, but none are officially supported, and we recommend against using the native query editor for these tasks. +On databases that use [impersonation](../../permissions/impersonation), Metabase enforces this: queries must be a single `SELECT` statement, and Metabase will reject multi-statement queries, temporary tables, and DDL. + ## Question version history For questions, [dashboards](../../dashboards/start), and [models](../../data-modeling/models), Metabase keeps a version history for the previous fifteen versions of that item.