Warehouse sync (Snowflake, BigQuery, Postgres)

Instead of uploading files, give TrueUpp one read-only credential pointed at one view with the same columns as a usage CSV. TrueUpp never writes to your warehouse. Ask whoever runs your warehouse to do steps 1 and 2; it takes about fifteen minutes.

1. Create the usage view

Monthly aggregate is the simplest: one row per account, metric and month. Adjust the table and column names to yours:

-- change: analytics.usage_events and its column names to your own table
CREATE VIEW analytics.trueupp_usage AS
SELECT
  customer_id                         AS account_id,
  event_name                          AS metric_name,
  DATE_TRUNC('month', occurred_at)    AS period_start,
  DATE_TRUNC('month', occurred_at) + INTERVAL '1 month' AS period_end,
  SUM(quantity)                       AS usage_units
FROM analytics.usage_events
GROUP BY 1, 2, 3, 4;

For line-level usage, expose account_id, metric_name, usage_at, quantity, event_id, status, retry_of instead. account_id must match the account ID on each TrueUpp contract.

2. Create a read-only credential

Postgres

-- change: choose-a-long-password, and the schema and view names if yours differ
CREATE ROLE trueupp_reader LOGIN PASSWORD 'choose-a-long-password';
GRANT USAGE ON SCHEMA analytics TO trueupp_reader;
GRANT SELECT ON analytics.trueupp_usage TO trueupp_reader;

Paste postgresql://trueupp_reader:PASSWORD@HOST:5432/DBNAME as the connection string. SSL is required and the host must be reachable from the internet. If the password contains @, : or /, URL-encode it.

Snowflake

Create a key pair on your machine:

openssl genrsa 2048 | openssl pkcs8 -topk8 -nocrypt -out trueupp_key.p8
openssl rsa -in trueupp_key.p8 -pubout -out trueupp_key.pub

Then, as an admin in Snowflake (paste the public key without its BEGIN and END lines):

-- change: COMPUTE_WH, ANALYTICS.PUBLIC and the public key to your own
CREATE ROLE TRUEUPP_READER;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE TRUEUPP_READER;
GRANT USAGE ON DATABASE ANALYTICS TO ROLE TRUEUPP_READER;
GRANT USAGE ON SCHEMA ANALYTICS.PUBLIC TO ROLE TRUEUPP_READER;
GRANT SELECT ON VIEW ANALYTICS.PUBLIC.TRUEUPP_USAGE TO ROLE TRUEUPP_READER;
CREATE USER TRUEUPP_SYNC DEFAULT_ROLE = TRUEUPP_READER RSA_PUBLIC_KEY = 'MIIBIjANBg…';
GRANT ROLE TRUEUPP_READER TO USER TRUEUPP_SYNC;

In TrueUpp enter the account identifier (for example xy12345.us-east-1, from your Snowflake URL), the user, warehouse and role, and paste the whole contents of trueupp_key.p8.

BigQuery

1. In Google Cloud, open IAM & Admin › Service accounts › Create service account, named "trueupp-sync".
2. Grant it BigQuery Job User on the project.
3. In BigQuery, share the view (or its dataset) with the service account as BigQuery Data Viewer.
4. On the service account, open Keys › Add key › JSON, and paste the downloaded file's contents into TrueUpp with the project ID.

3. Connect and test

In Settings › Connections › Warehouse sync, choose the warehouse, enter the view as database.schema.view (BigQuery: project.dataset.view) and its schema. The test shows the rows, accounts and date range it can see before anything is saved.

Each daily sync is an import, so validation, coverage and dedupe rules apply as for files. A sync is a snapshot: it replaces the connection's previous import. Periods already approved or pushed never change; a changed number for one of them becomes an adjustment.