Databricks Apps Chat UI for Agents: Template, Querying, and Authorization

1.Why Databricks Apps hosts custom agent interfaces

When you build an agent in code, users still need somewhere to talk to it. Databricks Apps is the platform's answer. It runs data and AI applications on serverless compute inside the workspace, so you don't need separate infrastructure. Apps integrate with Unity Catalog for governance, Databricks SQL for queries, and OAuth for authentication. The documentation lists "RAG chat apps" as a typical use case, next to dashboards, data entry forms, and operational interfaces.

You can write apps in Python with frameworks like Streamlit, Dash, and Gradio, or in Node.js with React, Angular, Svelte, or Express. Apps are billed per hour of compute while they run, and each workspace allows only a limited number of apps. For agents in particular, the key point is control: you own the agent code, the server configuration, and how it gets deployed. That makes Apps the right choice when you need custom server behavior, git-based versioning, or development in a local IDE.

The exam objective says "Apps, Slack, Teams, etc.", and Apps is only the first of those surfaces. The others are ready-made: the Databricks Genie app for Slack, the Databricks Genie app in Microsoft Teams, and a Genie Agent embedded as an iframe in an external website or internal portal. With these, users ask questions where they already work, and you don't host or maintain any server code. The last section of this lesson covers each of them.

Sources1234

2.The agent template: built-in chat UI and AgentServer

The template fetches the chat app template automatically and serves it as the agent's frontend, in the same Databricks Apps deployment. The UI supports streaming responses, markdown rendering, and Databricks authentication. You can also turn on persistent chat history and user feedback collection, and you can customize the UI directly in your project. Behind the UI runs the MLflow AgentServer, an async FastAPI server with built-in tracing. It exposes a /responses endpoint and handles request routing, logging, and error handling for you. Databricks recommends starting from the template rather than wiring these pieces together yourself.

To install the template from the workspace UI, click + New > App, choose Agents > Custom Agent (OpenAI SDK), create an MLflow experiment (the tutorial calls it openai-agents-template), and finish setup. After the app is created, click its URL to open the chat UI. You can then sync the source files to your machine and keep developing there.

A good chat experience also depends on how the agent returns output. With the recommended ResponsesAgent interface, streaming works like this: the agent emits several output_text.delta events that share one item_id, then a final response.output_item.done event with the complete text. The done event is what lets Databricks trace the output and show it in AI Playground. If something fails mid-stream, Databricks sends the error with the last token under databricks_output.error. Displaying that error to the user is the client's job. When the interface needs extra context that shouldn't enter chat history, such as a client_type or session_id going in, or retrieval source links coming out, use custom_inputs and custom_outputs.

Sources2

3.Calling the agent from your own client

The built-in UI isn't the only frontend option. Any client can call an agent hosted on Apps. For new applications Databricks recommends the Databricks OpenAI Client. Use the REST API when the platform you're integrating with expects OpenAI-compatible endpoints. ai_query only reaches legacy agents on Model Serving endpoints. One rule surprises people: agents hosted on Databricks Apps accept only a Databricks OAuth token, while legacy Model Serving agents also accept a personal access token (PAT).

curl --request POST \
  --url <app-url>.databricksapps.com/responses \
  --header 'Authorization: Bearer <OAuth token>' \
  --header 'content-type: application/json' \
  --data '{
    "input": [{ "role": "user", "content": "hi" }],
    "stream": true
  }'

If you use the Python client, pass model=f"apps/{app_name}" to client.responses.create. Add stream=True to stream, and pass custom_inputs through extra_body. To connect a conversation in your UI to its MLflow trace, send the x-mlflow-return-trace-id header and read metadata.trace_id from the response.

Sources5

4.Whose permissions does the interface use?

Databricks Apps authorization is built on OAuth 2.0 and uses two identity models. With app authorization, the app acts as its own dedicated service principal. Databricks creates it with the app, keeps it the same across deployments, deletes it with the app, and injects its credentials as DATABRICKS_CLIENT_ID and DATABRICKS_CLIENT_SECRET. This model suits background tasks, shared configuration, and usage logging, but it can't enforce access per user. With user authorization, Databricks forwards the user's access token to the app. Unity Catalog row filters and column masks then apply to each person automatically, and you don't write any filtering logic in the app.

User authorization is limited by scopes. An app may act on the user's behalf only within the scopes it declares, for example sql, genie, files, model-serving, or vector-search. If you declare none, the app gets only iam.access-control:read and iam.current-user:read, which allow no data or compute access. Databricks blocks anything outside the declared scopes, even when the user personally has permission. Users consent the first time they open the app and can't take that consent back later; admins can consent on users' behalf. The forwarded token works only in the app's own workspace.

databricks apps create <app-name> \
  --json '{
    " ? ": ["sql", "files"]
  }'

Sources6

5.Beyond Apps: Slack, Microsoft Teams, and embedded Genie Agents

Some users never open a separate app. For them, Databricks brings Genie into the tools they already use. In the Databricks Genie app for Slack, users send a DM to the app or mention @Genie in a channel or group DM. In the Databricks Genie app in Microsoft Teams, they chat with the app in a direct message or mention @Databricks Genie in a channel or group chat. Both apps are in Public Preview, and an account admin must enable them in the account console first. Both send questions to the Genie One API. Genie One either answers the question itself or, when a channel owner has pinned a specific Genie Agent, sends it to only that agent for consistent, use-case-specific answers. Answers come with sources and suggested follow-up prompts.

Governance follows the person asking. In Slack, Genie answers each question with the credentials of the user who mentioned @Genie, so each person sees only the data Unity Catalog already lets them see. Who else can read the reply is controlled separately by message visibility. Replies are public by default, which means everyone in the channel sees them, including members without access to the underlying data. Set visibility to private to show a reply only to the person who asked. Visibility can be set at three levels, and higher levels override lower ones. A workspace admin setting comes first, then the channel owner's channel-wide setting, then a user's personal setting. Charts appear as images in public replies, but not in private ones.

To put a Genie Agent inside your own web page, open the agent, click Share, click Embed space, and paste the generated iframe code into your site. End users need explicit access to the Genie Agent and to every data asset it uses, and anyone not signed in is asked to authenticate first. Add only domains you trust and control to the allowed embedding surfaces. Add allow="clipboard-write" to the iframe so users can copy CSV data and conversation links:

<iframe src="<your-genie-space-url>" allow="clipboard-write" width="100%" height="600"></iframe>

How do you choose? These surfaces bring Genie data Q&A to Slack, Teams, or a portal with no server to maintain. A custom agent written in code reaches users through the Apps chat UI or through your own client calling its /responses endpoint. Pushing a message into Slack is a different thing. An agent can post to Slack through a Unity Catalog HTTP connection, for example with the slack_sdk WebClient pointed at the connections proxy, or through the built-in system.ai Slack MCP Service. In that case Slack is a tool the agent calls, not a chat interface for users.

Sources3748

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.An app running as its service principal still applies each user's Unity Catalog row filters.Why is that wrong?

   Under app authorization, every user shares the service principal's permissions. To enforce per-user filters and masks, use user authorization.

   Covered in Whose permissions does the interface use?

2. 2.With user authorization, the app can do anything the signed-in user can do.Why is that wrong?

   The app is limited to its declared scopes. Databricks blocks anything outside them, even if the user has the permission.

   Covered in Whose permissions does the interface use?

3. 3.A personal access token works for calling an agent hosted on Databricks Apps, just as it does for Model Serving.Why is that wrong?

   Agents hosted on Apps require a Databricks OAuth token. PATs are accepted only for legacy agents on Model Serving.

   Covered in Calling the agent from your own client

4. 4.Because Genie in Slack answers with each asker's own credentials, nobody in the channel can see data they aren't allowed to access.Why is that wrong?

   Credentials control what Genie can query, not who reads the reply. Public replies are visible to every channel member, including members without access to the underlying data. Use private message visibility to prevent that.

   Covered in Beyond Apps: Slack, Microsoft Teams, and embedded Genie Agents