--- title: "Connect Tealium to Claude: Enrich Visitor Profiles & GDPR Compliance" slug: connect-tealium-to-claude-enrich-visitor-profiles-gdpr-compliance date: 2026-10-25 author: Sidharth Verma categories: ["AI & Agents"] excerpt: "Learn how to connect Tealium to Claude using a managed MCP server. Execute GDPR deletion requests, enrich visitor profiles, and manage iQ tag revisions with AI." tldr: "Connect Tealium to Claude using a managed MCP server. This guide covers how to dynamically generate Tealium MCP tools, handle fragmented auth models, and build AI workflows for GDPR compliance and visitor enrichment." canonical: https://truto.one/blog/connect-tealium-to-claude-enrich-visitor-profiles-gdpr-compliance/ --- # Connect Tealium to Claude: Enrich Visitor Profiles & GDPR Compliance If your team needs to connect Tealium to Claude to orchestrate customer data flows, audit GDPR deletion requests, or manage iQ Tag revisions, you need a [Model Context Protocol (MCP) server](https://truto.one/what-is-mcp-and-mcp-servers-and-how-do-they-work/). This server acts as the translation layer between Claude's LLM function calls and Tealium's REST APIs. You can either build and maintain this translation layer yourself, or use a managed platform like Truto to [dynamically generate a secure, authenticated MCP server URL](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/). If your team uses ChatGPT, check out our guide on [connecting Tealium to ChatGPT](https://truto.one/connect-tealium-to-chatgpt-sync-events-manage-tag-revisions/) or explore our broader architectural overview on [connecting Tealium to AI Agents](https://truto.one/connect-tealium-to-ai-agents-automate-scim-data-layer-hosting/). Giving an AI agent read and write access to an enterprise Customer Data Platform (CDP) like Tealium is fundamentally difficult. You have to handle fragmented authentication mechanisms, map deeply nested JSON schemas to MCP tool definitions, and deal with Tealium's strict rate limits. Every time Tealium updates an endpoint or changes a data model, you have to update your custom integration code, redeploy, and test. This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Tealium, connect it to Claude Desktop, and execute complex CDP workflows using natural language. > Want to give your AI agents secure, authenticated access to Tealium and 100+ other SaaS APIs? Let's talk about [managed MCP architecture](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/). > > [Talk to us](https://truto.one/book-a-demo/) ## The Engineering Reality of the Tealium API A custom MCP server is a self-hosted integration proxy. While the open MCP standard provides a predictable JSON-RPC 2.0 interface for models to discover tools, the reality of implementing it against a massive B2B application like Tealium is painful. Tealium is not a single API; it is a collection of distinct microservices - EventStream, AudienceStream, iQ Tag Management, and SCIM Identity - each with its own quirks. If you decide to build a custom Tealium MCP server, you own the entire lifecycle of these API realities: **Fragmented Authentication Models** Tealium does not use a single, unified auth token across all its APIs. The SCIM API requires a long-lived bearer token that expires after 90 days. Conversely, the EventStream and iQ APIs require exchanging a username and API key for a short-lived JWT that expires in 30 minutes. If you build this in-house, your MCP server must handle credential exchange, token caching, and proactive renewal in the background so the LLM is not constantly interrupted by 401 Unauthorized errors. **Asynchronous GDPR Deletion Lifecycles** Handling privacy requests in Tealium is not a synchronous CRUD operation. When you trigger a GDPR or CCPA erasure via the Privacy API, Tealium queues the deletion across all stitched visitor profiles. This process can take up to 30 days. Your MCP server must expose an initial deletion tool that captures the `transactionId`, and a secondary polling tool that the agent can use to check if the status is `PENDING`, `SUCCESS`, or `FAILED`. **Complex JSON Patch Requirements** Updating iQ Tag profiles or SCIM user groups in Tealium requires exact `application/json-patch+json` syntax. The payload must strictly define arrays of operations with `op`, `path`, and `value` keys. LLMs are notorious for hallucinating JSON schema structures when generating Patch requests. Your MCP tools must be built with strict JSON Schema validation and explicitly typed descriptions to prevent Claude from sending malformed patch operations that corrupt tag configurations. ## How to Generate a Managed MCP Server for Tealium Instead of building a Node.js or Python application to handle Tealium's auth and schemas, you can use Truto to generate a managed MCP server. Truto's architecture is dynamic and documentation-driven. It takes your connected Tealium account, reads the underlying API documentation schemas, and [instantly compiles them into an MCP JSON-RPC endpoint](https://truto.one/auto-generated-mcp-tools-for-ai-agents-a-2026-architecture-guide/). Truto does not store your Tealium visitor data. It acts as a stateless proxy, validating the MCP token and passing the execution down to Tealium in real-time. You can create this server in two ways: via the Truto UI or programmatically via the API. ### Method 1: Via the Truto UI For administrators setting up internal tools, the dashboard is the fastest route: 1. Navigate to the **Integrated Accounts** page in your Truto dashboard and select your connected Tealium instance. 2. Click the **MCP Servers** tab. 3. Click **Create MCP Server**. 4. Define your configuration parameters. You can filter the tools by method (e.g., read-only) or apply specific tags (e.g., `privacy`, `iq_profiles`) to restrict what Claude can access. 5. Click **Generate** and copy the resulting URL (e.g., `https://api.truto.one/mcp/a1b2c3d4...`). ### Method 2: Via the Truto API For developers building autonomous platforms, you can provision Tealium MCP servers dynamically using the Truto REST API. This is ideal for generating short-lived, scoped access tokens for specific agent sessions. ```bash curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \ -H "Authorization: Bearer YOUR_TRUTO_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "name": "Tealium Privacy and iQ Operations", "config": { "methods": ["read", "write"], "tags": ["privacy", "iq"] }, "expires_at": "2026-12-31T23:59:59Z" }' ``` The API returns a secure `url` backed by a cryptographic token stored in Cloudflare KV. The token URL alone is sufficient to serve the MCP tools to Claude. ## How to Connect the Tealium MCP Server to Claude Once you have your Truto MCP URL, you must connect it to your Claude environment. Claude communicates with the MCP server using Server-Sent Events (SSE) and JSON-RPC 2.0 over HTTP POST. ### Method 1: Via the Claude UI If you are using an Enterprise or Team plan with Claude, or utilizing ChatGPT's Custom Connectors interface, you can add the URL directly through the UI: 1. Open your Claude settings. 2. Navigate to **Integrations** - **Add MCP Server**. 3. Paste the Truto MCP URL. 4. Click **Add**. Claude will perform a handshake (`initialize`), request the tool list (`tools/list`), and instantly make the Tealium tools available in your chat context. ### Method 2: Via Manual Configuration File For local development using Claude Desktop, you can update your configuration JSON file. Truto's HTTP endpoints require a small bridge to translate Claude's stdio requirements into SSE HTTP requests. You can use the official `@modelcontextprotocol/server-sse` package to accomplish this. Locate your `claude_desktop_config.json` file (typically in `~/Library/Application Support/Claude/` on macOS or `%APPDATA%\Claude\` on Windows) and add the following: ```json { "mcpServers": { "tealium-truto": { "command": "npx", "args": [ "-y", "@modelcontextprotocol/server-sse", "https://api.truto.one/mcp/a1b2c3d4e5f6..." ] } } } ``` Restart Claude Desktop. The application will execute the `npx` command, establish the SSE connection, and populate your available tools. ## Hero Tools for Tealium Truto automatically generates highly descriptive snake_case tool names based on the Tealium integration schema. Here are the highest-leverage tools available for your AI agents. ### tealium_visitors_search This tool allows the agent to retrieve a comprehensive visitor profile by searching against a specific Visitor ID attribute (like an email address, user ID, or hashed phone number). The response includes badges, audiences, metrics, and current visit properties. **Contextual Usage:** Essential for enriching leads or debugging customer journey issues. The LLM must supply the `attributeId` (the numerical ID of the attribute in Tealium) and the `attributeValue`. > "Look up the Tealium visitor profile for user ID 89432. Tell me which audiences they currently belong to and list any active badges." ### create_a_tealium_event Sends a single, real-time event payload to the Tealium Collect endpoint. This tool accepts arbitrary JSON key-value pairs alongside the required account and profile metadata. **Contextual Usage:** Use this tool when orchestrating cross-system workflows, such as pushing an offline conversion event from your CRM directly into Tealium EventStream. > "Send a purchase_completed event to Tealium for profile 'main'. Include the visitor_id 'v_9921' and set the revenue attribute to 150.00." ### tealium_privacy_visitors_bulk_delete Queues the deletion of a Tealium visitor record for GDPR, CCPA, or other compliance erasure mandates. It searches by a known identifier and schedules the removal of all associated stitched data. **Contextual Usage:** This operation is asynchronous. The tool returns a `transactionId`. You must instruct the LLM to save this ID or follow up later using the `get_single_tealium_privacy_visitor_by_id` tool to check if the deletion finished. > "Initiate a GDPR deletion request in Tealium for the visitor with email address privacy@example.com. Give me the transaction ID so we can track it." ### tealium_iq_profiles_publish Triggers a publish event for a saved Tealium iQ Tag Management profile version. It pushes the compiled JavaScript files to the specified targets (e.g., Dev, QA, Prod). **Contextual Usage:** This is a high-stakes write operation. Ensure the agent has the correct `versionId` (formatted as YYYYMMDDhhmm) before calling this tool. > "Publish version 202604121430 of our main iQ profile to the QA environment. Confirm the publish ID once the request succeeds." ### tealium_scim_users_partial_update Executes a precise JSON Patch operation against a Tealium SCIM user profile to update permissions, active status, or display names. **Contextual Usage:** The agent must construct a valid SCIM operations array. This is perfect for automated offboarding workflows where an employee needs their access revoked without deleting the historical audit trail. > "Update the SCIM user account for j.doe@example.com in Tealium. Set their 'active' status to false and remove them from the 'Account Admins' group." ### tealium_context_api_visitors_search Retrieves real-time visitor moments from the Tealium Context API. This endpoint is highly optimized for low-latency lookups during active sessions, returning current flags and metrics. **Contextual Usage:** Use this when an AI agent acting as a support chatbot needs immediate context on what the user is currently doing on the website (e.g., what page they are on, or what items are in their cart). > "Query the Tealium Context API for the visitor ID currently in this chat session. Tell me their current cart value and if they have the 'High Value' badge active." For the complete inventory of available Tealium tools and exact JSON Schema specifications, visit the [Tealium integration page](https://truto.one/integrations/detail/tealium). ## Workflows in Action By chaining these tools together, Claude can act as an autonomous CDP administrator. Here are two real-world sequences. ### Automating GDPR DSAR Deletions When a customer submits a Data Subject Access Request (DSAR) for erasure, the LLM can handle the entire verification and deletion lifecycle. > "We received a GDPR deletion request for user ID 45992. Verify they exist in Tealium, queue the deletion, and check the status of the transaction." 1. **`list_all_tealium_privacy_visitors`**: The agent first calls this to look up the correct internal attribute ID for "User ID". 2. **`tealium_privacy_visitors_search`**: The agent verifies the user exists and reviews what data is currently held. 3. **`tealium_privacy_visitors_bulk_delete`**: The agent submits the erasure command, receiving `transaction_id: "tx_99812"` in response. 4. **`get_single_tealium_privacy_visitor_by_id`**: The agent immediately polls the transaction ID. It receives a `PENDING` state and informs the user that the background process has successfully started. ```mermaid sequenceDiagram participant User as User participant Claude as Claude Desktop participant Truto as Truto MCP participant Tealium as Tealium API User->>Claude: Delete data for ID 45992 Claude->>Truto: Call tealium_privacy_visitors_search Truto->>Tealium: GET /privacy/visitors?... Tealium-->>Truto: Return visitor payload Truto-->>Claude: JSON Schema mapping Claude->>Truto: Call tealium_privacy_visitors_bulk_delete Truto->>Tealium: POST /privacy/visitors/delete Tealium-->>Truto: Return transactionId Truto-->>Claude: Return execution state Claude-->>User: Deletion queued. ID is tx_99812. ``` ### Real-Time Support Enrichment When a high-tier customer opens a support chat, an AI agent can query their live CDP context before routing the ticket. > "A user just initiated a chat session. Their visitor ID is 'v_7811'. Pull their real-time profile from Tealium and summarize their current engagement state." 1. **`tealium_context_api_visitors_search`**: The agent queries the fast Context API using the visitor ID. 2. **Analysis**: The agent reads the returned `badges` (e.g., "VIP", "Cart Abandoner") and `metrics` (e.g., "LTV: $4,500"). 3. **Output**: The agent generates a summary: "This visitor is a VIP with an LTV of $4,500. They currently have the 'Cart Abandoner' badge active. I recommend routing them directly to tier-1 retention support." ## Security and Access Control Exposing an enterprise system like Tealium to an LLM requires strict governance. [Truto's MCP architecture provides multiple layers of security](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/) at the token level, ensuring agents only touch what they are authorized to touch. * **Method Filtering**: You can strictly limit an MCP server to read-only operations. By setting `methods: ["read"]` during token generation, Truto will strip out all `create`, `update`, and `delete` tools. The LLM simply won't know those operations exist. * **Tag Filtering**: Integration resources in Truto are tagged by domain. You can restrict an MCP server to specific functional areas, such as `tags: ["privacy", "scim"]`, keeping the agent completely locked out of the EventStream or iQ tagging configurations. * **API Token Auth (`require_api_token_auth`)**: By default, the MCP URL is a secure bearer token. For zero-trust environments, you can enable this flag. It forces the caller to provide a valid Truto API token in the `Authorization` header on every request, verifying both the URL and the caller's identity. * **Auto-Expiring Servers (`expires_at`)**: You can assign a time-to-live timestamp when generating the server. Once the clock hits `expires_at`, a Cloudflare Durable Object alarm fires, automatically purging the token from the KV store and the database, instantly killing the agent's access. ## Architecting for Scale and Rate Limits When connecting AI agents to Tealium, you must architect defensively against rate limits. An overly eager LLM looping through a list of 1,000 SCIM users will quickly exhaust API quotas. Truto does not absorb, retry, or apply backoff logic to rate limit errors. When the Tealium API returns an HTTP 429 Too Many Requests, Truto passes that error directly back to the caller. However, Truto does normalize the upstream rate limit information into standardized IETF headers: `ratelimit-limit`, `ratelimit-remaining`, and `ratelimit-reset`. Your AI orchestration framework (like LangChain, LangGraph, or custom application logic) is fully responsible for reading these headers and managing its own retry and backoff behavior. This architectural choice ensures your system retains total visibility and control over its consumption behavior, preventing hidden latency loops inside the proxy layer. Integrating Tealium with Claude doesn't have to require weeks of custom TypeScript, undocumented token refreshes, and brittle JSON patching logic. By leveraging a managed MCP server, you can give your AI agents secure, declarative access to your CDP infrastructure - reducing technical debt and accelerating your automation capabilities.