> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL

> Read-only SQL against your Postgres database during investigations and for measuring impact.

Go to **Connections**, click **Connect** next to PostgreSQL, and enter the host, port, database, username, password, and SSL mode, or paste a connection string.

If the database isn't reachable from the internet, turn on **SSH tunnel** to connect through a bastion host: a public one, or an EC2 instance behind an EC2 Instance Connect Endpoint. See [SSH tunnels](/integrations/ssh-tunnels) for setup.

With `sslmode=verify-ca` or `verify-full`, Ordyn verifies the server certificate against the public certificate authorities. Databases whose certificates come from a private CA (for example Amazon RDS) need `require` for now. Ordyn can't use certificate or key files, so a connection string naming one (`sslrootcert`, `sslcert`, `sslkey`, `sslcrl`, `passfile`) is refused when you save or test it; `sslrootcert=system` is fine. Connections saved earlier with such parameters keep working, and editing them drops those parameters. Through an [SSH tunnel](/integrations/ssh-tunnels), TLS keeps your connection's `sslmode`.

## Permissions

Use a dedicated read-only role with USAGE and SELECT on the schemas Ordyn should query. Ordyn runs every query in a read-only transaction and never writes to your database.

### Read-only queries

Answer data questions during investigations and measure the impact of open issues.

| Grant | Used for |
| - | - |
| `CONNECT` | On the database |
| `USAGE` | On each schema Ordyn should query |
| `SELECT` | On the tables in those schemas, including tables created later through default privileges |

* Grant schemas one by one rather than `pg_read_all_data`: that role reads every table in every database on the server, and limiting `CONNECT` does not narrow it.

### How to grant

> **Create a read-only role**
>
> ```sql theme={null}
> CREATE ROLE "struct_reader" LOGIN PASSWORD '<password>';
> GRANT CONNECT ON DATABASE "<database>" TO "struct_reader";
> -- Before running the schema grants below, reconnect to "<database>". Repeat them for each chosen schema.
> GRANT USAGE ON SCHEMA "public" TO "struct_reader";
> GRANT SELECT ON ALL TABLES IN SCHEMA "public" TO "struct_reader";
> -- Tables created later: run this as the role that creates them (for example your migration user).
> ALTER DEFAULT PRIVILEGES IN SCHEMA "public" GRANT SELECT ON TABLES TO "struct_reader";
> ```

Replace the values in angle brackets.

Permission catalog version `2026-10-16.1`. See [permission changes](/reference/permission-changes).

## What Ordyn does with it

Answers data questions during investigations, such as how many orders failed in a window, and measures the impact of [open issues](/open-issues/overview) with live queries you can inspect.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.