Authentication Methods

Version: Available in API 3.21 (Tableau Cloud October 2023) and later.Version Overview(Link opens in a new window)

License: No additional license required.

Permissions: Any Tableau Cloud user. If you're a Tableau Cloud site admin, you can list the PATs of a user when you are the site admin on all sites that the PAT owner is a member of. Permissions Overview(Link opens in a new window)

JWT Access Scope: Not available. Access Scopes Overview: Cloud(Link opens in a new window)

URI

GET /api/api-version/sites/site-luid/users/user-luid/personal-access-tokens

URI Parameter Values

Request Body

None

cURL Request Example

curl "http://myco/api/3.21/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/d5704762-603a-42b2-a9a7-f9cd2b2c4253/personal-access-tokens" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"

Response Code

200

Response Body

<tsResponse>
    <personalAccessTokens>
        <personalAccessToken tokenName="user_pat1" tokenGuid="011b6267-a067-473a-9d16-b34cc58f90df" lastUsedAt="2023-06-13T16:55:46Z" expiresAt="2024-06-12T16:55:46Z"/>
        <personalAccessToken tokenName="user_pat4" tokenGuid="0fb30637-b638-4ce2-bbac-ac6611104ed9" lastUsedAt="2023-06-13T16:55:51Z" expiresAt="2024-06-12T16:55:51Z"/>
        <personalAccessToken tokenName="user_pat5" tokenGuid="db8c0b5d-5946-4f7c-a966-af334a3d10a5" lastUsedAt="2023-06-13T16:55:56Z" expiresAt="2024-06-12T16:55:56Z"/>
    </personalAccessTokens>
</tsResponse>

{
  "personalAccessTokens": [
    {
      "tokenName": "user_pat1",
      "tokenGuid": "011b6267-a067-473a-9d16-b34cc58f90df",
      "lastUsedAt": "2023-06-13T16:55:46Z",
      "expiresAt": "2024-06-12T16:55:46Z"
    },
    {
      "tokenName": "user_pat4",
      "tokenGuid": "0fb30637-b638-4ce2-bbac-ac6611104ed9",
      "lastUsedAt": "2023-06-13T16:55:51Z",
      "expiresAt": "2024-06-12T16:55:51Z"
    },
    {
      "tokenName": "user_pat5",
      "tokenGuid": "db8c0b5d-5946-4f7c-a966-af334a3d10a5",
      "lastUsedAt": "2023-06-13T16:55:56Z",
      "expiresAt": "2024-06-12T16:55:56Z"
    }
  ]
}

URI

DELETE /api/api-version/auth/serverAdminAccessTokens

Parameter Values

Request Body

None

Permissions

Only Tableau Server users with server administrator permissions can use this method.

Response Code

204

Response Body

None

Version

Version 3.11 and later. For more information, see REST API and Resource Versions.

Errors

For more information, see Handling Errors.

Version: Available in API 3.21 (Tableau Cloud October 2023) and later.Version Overview(Link opens in a new window)

License: No additional license required.

Permissions: Any Tableau Cloud user. If you're a Tableau Cloud site admin, you can revoke the PAT of a user when you are the site admin on all sites that the PAT owner is a member of. Permissions Overview(Link opens in a new window)

JWT Access Scope: Not available. Access Scopes Overview: Cloud(Link opens in a new window)

URI

DELETE /api/api-version/sites/site-luid/users/user-luid/personal-access-tokens/pat-name

URI Parameter Values

Request Body

None

cURL Request Example

curl "http://myco/api/3.21/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/d5704762-603a-42b2-a9a7-f9cd2b2c4253/personal-access-tokens/my_pat" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"

Response Code

204

Response Body

None

URI

POST /api/api-version/auth/signin

Note: For Tableau Cloud, the server address in the URI must contain the pod name, such as 10az, 10ay, or us-east-1. For example, the URI to sign in to a site in the 10ay pod would be:

https://10ay.online.tableau.com/api/api-version/auth/signin

Parameter Values

Request Body

PAT

Signing in with a user's personal access token (PAT): 

• For Tableau Server, see personal access token(Link opens in a new window).
• For Tableau Cloud, see personal access token(Link opens in a new window).

<tsRequest>
  <credentials personalAccessTokenName="personal-access-token-name"
    personalAccessTokenSecret="personal-access-token-secret" >
      <site contentUrl="content-url" />
  </credentials>
</tsRequest>
        

User name and password

Signing in with a user's user name and password:

<tsRequest>
  <credentials name="username" password="password" >
    <site contentUrl="content-url" />
  </credentials>
</tsRequest>
        

Impersonating user using username and password

Signing in with server administrator's username and password to impersonate a user (not available for Tableau Cloud):

<tsRequest>
  <credentials name="username" password="password" >
	<site contentUrl="content-url" />
	<user id="user-to-impersonate" />
  </credentials>
</tsRequest>

Impersonating user using PAT

Signing in with server administrator's personal access token(Link opens in a new window) (PAT) to impersonate a user (not available for Tableau Cloud):

<tsRequest>
  <credentials personalAccessTokenName="personal-access-token-name"
    personalAccessTokenSecret="personal-access-token-secret" >
	  <site contentUrl="content-url" />
	  <user id="user-to-impersonate" />
  </credentials>
</tsRequest>     

JWT

Signing in with a JSON Web Token (JWT), from a connected app(Link opens in a new window) (Introduced in Tableau Cloud June 2022 (API 3.16); Tableau Server 2022.3 (API 3.17)):

<tsRequest>
  <credentials jwt="json-web-token"
  <site contentUrl="content-url" />
  </credentials>
</tsRequest>			

When a JWT sign-in is used, the JWT must be configured with the scopes of the REST API methods the connected app can access. You can find the scope for a JWT-supported method in a method's properties block or references details under the Access scope section. These sections show the scope declaration to use in the JWT that calls that method. You can also see a full list of JWT-supported scopes in REST API methods that support JWT authorization(Link opens in a new window) (Tableau Cloud Help) or REST API methods that support JWT authorization(Link opens in a new window) (Tableau Server Help).

Note: Both the Sign In and Sign Out methods are supported by JWT authorization but do not require scopes to use.

If you encounter issues with signing in with a JWT, the response body is appended with an additional error code that you can reference in Troubleshoot scopes(Link opens in a new window) (Tableau Cloud Help) or Troubleshoot scopes(Link opens in a new window) (Tableau Server Help). For example, in the following response body, you can reference “10084” to help troubleshoot issues with signing in to Tableau Cloud or Tableau Server using a JWT for REST API authorization.

<error code="401001">
  "summary": "Signin Error",
  "detail": "Error signing in to Tableau Cloud (10084)"
</error>

Attribute Values

Permissions

Any Tableau user can sign in through the REST API. A user that does not have administrator permissions will have limited permissions to perform subsequent operations. Only server administrators can sign in with username and password in order to impersonate other Tableau Server users.

Response Code

200

Response Body

<tsResponse>
  <credentials token="authentication-token"
	  estimatedTimeToExpiration="time-to-expiration" >
	    <site id="site-id" contentUrl="content-url" />
	    <user id="user-id-of-signed-in-user"
  </credentials>
</tsResponse>
        

An estimatedTimeToExpiration value is returned when you sign in using a PAT. The value represents the approximate time until the token returned from the PAT sign in will expire and need to be refreshed. The estimated time is based on regular usage of the token for authenticating calls, but actual time may be shorter if the token is unused for an extended length of time.

Version

Version 1.0 and later. For more information, see REST API and Resource Versions.

Errors

For more information, see Handling Errors.

Example

curl "https://MY-SERVER/api/3.21/auth/signin" -X POST -d @signin.xml

Content of signin.xml:

<tsRequest>
  <credentials personalAccessTokenName="MY_PAT_NAME"
	personalAccessTokenSecret="vFel4qtGTZ2+Po0ZWT7YWg==:nMmSHnQ5kJBP17ZtsBgPtuVWdYJFAbBG"  >
      <site contentUrl="MarketingSite" />
  </credentials>
</tsRequest>

Example response:

<tsResponse version-and-namespace-settings>
  <credentials token="HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3">
    <site id="9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
          contentUrl="MarketingSite"/>
  </credentials>
</tsResponse>

URI

POST /api/api-version/auth/signout

Parameter Values

Request Body

None

Permissions

Any user can call this method.

Response Code

204

Response Body

None

Version

Version 1.0 and later. For more information, see REST API and Resource Versions.

Errors

For more information, see Handling Errors.

Example

curl "http://MY-SERVER/api/3.21/auth/signout" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"

URI

POST /api/api-version/auth/switchSite

Parameter Values

Request Body

<tsRequest>
   <site contentUrl="content-url" />
</tsRequest>
          

Attribute Values

Permissions

Tableau Server users who are not server administrators can switch sites, provided that they have access to the destination site.

Response Code

200

Response Body

<tsResponse>
  <credentials token="authentication-token" >
    <site id="site-id" contentUrl="content-url" />
    <user id="user-id-of-signed-in-user" />
  </credentials>
</tsResponse>
        

Version

Version 2.6 and later. For more information, see REST API and Resource Versions.

Errors

For more information, see Handling Errors.

Example

curl "https://MY-SERVER/api/3.21/auth/switchSite" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"-d @switch_site.xml

Content of switch_site.xml:

<tsRequest>
   <site contentUrl="MarketingSite" />
</tsRequest>

Example response:

<tsResponse version-and-namespace-settings>
  <credentials token="HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3">
    <site id="9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
          contentUrl="MarketingSite"/>
  </credentials>
</tsResponse>