Getting Started with Data Quality as Code

This guide will help you install the OpenMetadata Python SDK and configure authentication to start running data quality tests programmatically.

Prerequisites

Before you begin, ensure you have:

Python 3.10 or higher installed
pip package manager
Access to an OpenMetadata 2.0.2 instance
A JWT token for authentication (see Authentication below)

Installation

Install the openmetadata-ingestion package with the necessary extras for your use case:

Basic Installation

pip install "openmetadata-ingestion~=2.0.2.0"

Installation with Database Connectors

Install additional dependencies based on the databases you’ll be testing:

# For PostgreSQL
pip install "openmetadata-ingestion[postgres]~=2.0.2.0"

# For MySQL
pip install "openmetadata-ingestion[mysql]~=2.0.2.0"

# For BigQuery
pip install "openmetadata-ingestion[bigquery]~=2.0.2.0"

# For multiple databases
pip install "openmetadata-ingestion[postgres,mysql,bigquery]~=2.0.2.0"

Installation with DataFrame Support

If you plan to use DataFrame validation features:

pip install "openmetadata-ingestion[pandas]~=2.0.2.0"

Installation with Multiple Features

Combine multiple extras as needed:

# For DataFrame validation with Postgres support
pip install "openmetadata-ingestion[pandas,postgres]~=2.0.2.0"

# For comprehensive ETL support
pip install "openmetadata-ingestion[pandas,postgres,pyarrow]~=2.0.2.0"

Authentication

Data Quality as Code requires authentication with your OpenMetadata instance. The SDK supports JWT token authentication.

Getting a JWT Token

You can obtain a JWT token in two ways:

Note: The Bots tile under Settings is only visible to users with Admin privileges. If you don’t see it, ask your organization’s Collate Admin to generate a bot token for you or grant you Admin access.

Option 1: Using an Existing Bot Token

OpenMetadata provides pre-configured bots like the ingestion-bot:

Log in to your OpenMetadata instance
Navigate to Settings > Bots
Find the ingestion-bot (or create a new bot)
Copy the JWT token

Option 2: Creating a Custom Bot

For production use, create a dedicated bot with specific permissions:

Go to Settings > Bots
Click Add Bot
Provide a name and description
Assign appropriate roles (typically DefaultBotPolicy and Ingestion Bot Policy)
Copy the generated JWT token

Configuring the SDK

Once you have a JWT token, configure the SDK in your Python code.

If your organization uses an external secrets manager for credential storage, initialize it before this first configure() call, not after. SecretsManagerFactory is a singleton: whichever call runs first wins, so initializing it later in Using External Secrets Managers has no effect once configure() has already run here. See that section before continuing if this applies to you.

from metadata.sdk import configure

configure(
    host="http://localhost:8585/api",  # Your Collate API URL
    jwt_token="your-jwt-token-here"
)

Using Environment Variables

For better security, let configure pick them up from environment variables:

from metadata.sdk import configure

configure()

Set the environment variable before running your script:

export OPENMETADATA_HOST="http://localhost:8585/api"
export OPENMETADATA_JWT_TOKEN="your-jwt-token-here"

python your_script.py

Configuration Parameters

The configure() function accepts the following parameters:

Parameter	Type	Required	Description	Environment Variable
`host`	`str`	No	Collate API URL (e.g., `http://localhost:8585/api`)	`OPENMETADATA_HOST`
`jwt_token`	`str`	No	JWT authentication token	`OPENMETADATA_JWT_TOKEN`

Using External Secrets Managers

The Test Runner guide also links here for reference while you’re testing.

Important Note

If your OpenMetadata instance uses database-stored credentials (the default configuration), you do not need to follow this guide. The SDK will automatically retrieve and decrypt credentials. This guide is only necessary when your organization uses an external secrets manager for credential storage.

Why This is Required

The TestRunner API executes data quality tests directly from your Python code (e.g., within your ETL pipelines). To connect to your data sources, it needs to:

Retrieve the service connection configuration from OpenMetadata
Decrypt the credentials stored in your secrets manager
Establish a connection to the data source
Execute the test cases

Without proper secrets manager configuration, the SDK cannot decrypt credentials and will fail to connect to your data sources.

Matching Your Collate Backend’s Secrets Manager

Configure TestRunner to match whatever secrets manager provider your Collate backend already uses. The SDK cannot discover this automatically.

Self-hosted Collate: your administrator already configured the secrets manager for your deployment. Use the same provider and loader values described in Configuration by Provider.
Collate SaaS: the secrets manager is part of the managed platform, so you don’t configure or control it yourself. Contact your Collate administrator for the secrets manager provider, for example SecretsManagerProvider.managed_aws. Also ask for the tenant’s region or vault name and access credentials scoped for your use. These details are tenant-specific, and you can’t find them in code or guess them.

General Setup Steps

Contact your OpenMetadata/Collate administrator to obtain:
- The secrets manager type (AWS, Azure, GCP, etc.)
- The secrets manager loader configuration
- Required environment variables or configuration files
- Any additional setup (IAM roles, service principals, etc.)
Install required dependencies for your secrets manager provider
Configure environment variables with access credentials
Initialize the SecretsManagerFactory before using TestRunner
Authenticate with an ingestion-bot JWT instead of a personal user token. See Authentication for how to obtain one.
Configure the SDK and run your tests

Example using AWS Secrets Manager

Required Dependencies:

pip install "openmetadata-ingestion[aws]~=2.0.2.0"

Example Configuration:

import os

from metadata.generated.schema.security.secrets.secretsManagerClientLoader import SecretsManagerClientLoader
from metadata.generated.schema.security.secrets.secretsManagerProvider import SecretsManagerProvider
from metadata.sdk import configure
from metadata.sdk.data_quality import TestRunner
from metadata.utils.secrets.secrets_manager_factory import SecretsManagerFactory

# Set AWS credentials and region
os.environ["AWS_ACCESS_KEY_ID"] = "your-access-key-id"
os.environ["AWS_SECRET_ACCESS_KEY"] = "your-secret-access-key"
os.environ["AWS_DEFAULT_REGION"] = "us-east-1"  # Your AWS region

# Initialize secrets manager (must be done before configure())
SecretsManagerFactory(
    secrets_manager_provider=SecretsManagerProvider.managed_aws,
    secrets_manager_loader=SecretsManagerClientLoader.env,
)

# Configure OpenMetadata SDK
configure(
    host="https://your-openmetadata-instance.com/api",
    jwt_token="your-jwt-token",
)

# Use TestRunner as normal
runner = TestRunner.for_table("MySQL.production.database.my_table")
results = runner.run()

Configuration by Provider

AWS and AWS Parameters Store

Collate’s ingestion extras: aws (e.g pip install 'openmetadata-ingestion[aws]') SecretsManagerProvider: (one of)

SecretsManagerProvider.aws
SecretsManagerProvider.managed_aws
SecretsManagerProvider.aws_ssm
SecretsManagerProvider.managed_aws_ssm

Environment variables:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_DEFAULT_REGION

Azure Key Vault

Collate’s ingestion extras: azure (e.g pip install 'openmetadata-ingestion[azure]') SecretsManagerProvider: (one of)

SecretsManagerProvider.azure_kv
SecretsManagerProvider.managed_azure_kv

Environment variables:

AZURE_CLIENT_ID
AZURE_CLIENT_SECRET
AZURE_TENANT_ID
AZURE_KEY_VAULT_NAME

Google Cloud Secret Manager

Collate’s ingestion extras: gcp (e.g pip install 'openmetadata-ingestion[gcp]') SecretsManagerProvider: SecretsManagerProvider.gcp Environment variables:

GOOGLE_APPLICATION_CREDENTIALS: path to the file with the credentials json file
GOOGLE_CLOUD_PROJECT

Troubleshooting

Error: “Cannot decrypt service connection”

Cause: Secrets manager not initialized or misconfigured Solution: Ensure SecretsManagerFactory is initialized before calling configure() or creating the TestRunner

Error: “SecretsManagerFactory settings don’t take effect”

Cause: SecretsManagerFactory is a singleton. Only the first call in a Python process takes effect. If configure(), TestRunner, or anything else from metadata.sdk runs first, even through an earlier import, the factory already initializes with defaults. Later SecretsManagerFactory(...) calls are silently ignored. Solution: Call SecretsManagerFactory(...) as the first SDK-related statement in your script. Restart the session if you’re in a long-running or interactive environment, such as a notebook, where the SDK might already have been used.

Error: “Access Denied” or “Unauthorized”

Cause: Insufficient permissions to access secrets Solution:

Verify IAM role/service principal has correct permissions
Check credentials are valid and not expired
Ensure correct region/vault name is specified

Error: “Module not found” for secrets manager

Cause: Missing dependencies for your secrets manager Solution: Install required extras:

# For AWS
pip install "openmetadata-ingestion[aws]"

# For Azure
pip install "openmetadata-ingestion[azure]"

# For GCP
pip install "openmetadata-ingestion[gcp]"

Tests Fail with Connection Errors

Cause: Credentials not properly decrypted or secrets manager misconfigured Solution:

Verify secrets manager provider matches your OpenMetadata backend configuration
Test credential access independently (e.g., using AWS CLI, Azure CLI, gcloud)
Check network connectivity to secrets manager service
Enable debug logging to see detailed error messages:

import logging
logging.basicConfig(level=logging.DEBUG)

Contact Your Administrator

If you’re unsure about:

Which secrets manager your organization uses
Required environment variables or configuration
Access credentials or IAM roles
Permissions needed

Contact your OpenMetadata or Collate administrator for the specific configuration required in your environment.

For More Information

These related pages provide more detail on secrets manager configuration:

Learn how self-hosted deployments configure a secrets manager in Enable Secrets Manager.
Find provider-specific setup steps in Supported Implementations.
See how the Hybrid Runner combines an ingestion-bot JWT with secrets manager configuration in Hybrid Runner Secrets Management.

Verify Installation

Create a simple test to verify your setup:

from metadata.sdk import configure
from metadata.sdk.data_quality import TestRunner

# Configure SDK
configure(
    host="http://localhost:8585/api",
    jwt_token="your-jwt-token-here"
)

# Test connection by creating a runner
try:
    runner = TestRunner.for_table("your_service.database.schema.table")
    print("✓ SDK configured successfully!")
except Exception as e:
    print(f"✗ Configuration failed: {e}")

Replace "your_service.database.schema.table" with the fully qualified name of an actual table in your OpenMetadata instance.

Your First Data Quality Test

Now that you’re set up, let’s run your first data quality test:

from metadata.sdk import configure
from metadata.sdk.data_quality import TestRunner, TableRowCountToBeBetween

# Configure SDK
configure(
    host="http://localhost:8585/api",
    jwt_token="your-jwt-token-here"
)

# Create a test runner for a specific table
runner = TestRunner.for_table("MySQL.ecommerce.public.customers")

# Add a test to verify row count is within expected range
runner.add_test(
    TableRowCountToBeBetween(min_count=1000, max_count=100000)
)

# Run the tests
results = runner.run()

# Print results
for result in results:
    test_case = result.testCase
    test_result = result.testCaseResult

    print(f"Test: {test_case.name.root}")
    print(f"Status: {test_result.testCaseStatus}")
    print(f"Result: {test_result.result}")

Common Installation Issues

Connection Timeout

If you experience connection timeouts, verify:

OpenMetadata instance is running and accessible
API URL is correct (should end with /api)
Network connectivity between your script and OpenMetadata
Firewall rules allow the connection

Import Errors

If you encounter import errors:

ModuleNotFoundError: No module named 'metadata'

Verify the package is installed correctly:

pip list | grep openmetadata

If not listed, reinstall:

pip install --upgrade "openmetadata-ingestion~=2.0.2.0"

Next Steps

Now that you have the SDK installed and configured:

Learn how to run table-level tests using the TestRunner API
Explore DataFrame validation for ETL pipelines
Review the complete test definitions reference

​Getting Started with Data Quality as Code

​Prerequisites

​Installation

​Basic Installation

​Installation with Database Connectors

​Installation with DataFrame Support

​Installation with Multiple Features

​Authentication

​Getting a JWT Token

​Option 1: Using an Existing Bot Token

​Option 2: Creating a Custom Bot

​Configuring the SDK

​Using Environment Variables

​Configuration Parameters

​Using External Secrets Managers

​Important Note

​Why This is Required

​Matching Your Collate Backend’s Secrets Manager

​General Setup Steps

​Example using AWS Secrets Manager

​Configuration by Provider

​AWS and AWS Parameters Store

​Azure Key Vault

​Google Cloud Secret Manager

​Troubleshooting

​Error: “Cannot decrypt service connection”

​Error: “SecretsManagerFactory settings don’t take effect”

​Error: “Access Denied” or “Unauthorized”

​Error: “Module not found” for secrets manager

​Tests Fail with Connection Errors

​Contact Your Administrator

​For More Information

​Verify Installation

​Your First Data Quality Test

​Common Installation Issues

​Connection Timeout

​Import Errors

​Next Steps

​Additional Resources

Getting Started with Data Quality as Code

Prerequisites

Installation

Basic Installation

Installation with Database Connectors

Installation with DataFrame Support

Installation with Multiple Features

Authentication

Getting a JWT Token

Option 1: Using an Existing Bot Token

Option 2: Creating a Custom Bot

Configuring the SDK

Using Environment Variables

Configuration Parameters

Using External Secrets Managers

Important Note

Why This is Required

Matching Your Collate Backend’s Secrets Manager

General Setup Steps

Example using AWS Secrets Manager

Configuration by Provider

AWS and AWS Parameters Store

Azure Key Vault

Google Cloud Secret Manager

Troubleshooting

Error: “Cannot decrypt service connection”

Error: “SecretsManagerFactory settings don’t take effect”

Error: “Access Denied” or “Unauthorized”

Error: “Module not found” for secrets manager

Tests Fail with Connection Errors

Contact Your Administrator

For More Information

Verify Installation

Your First Data Quality Test

Common Installation Issues

Connection Timeout

Import Errors

Next Steps

Additional Resources