# tableau Api Tableau Cloud Manager REST API (cloud-manager) - Full Documentation # Authentication Before you can perform any activities in Tableau Cloud Manager (TCM), you need to authenticate to Tableau Cloud Manager REST API. Authenticating to Tableau Cloud Manager REST API has different requirements than authenticating directly to Tableau Cloud Manager. ### About authenticating to Tableau Cloud Manager REST API To authenticate, or sign in, to Tableau Cloud Manager REST API, you must be a cloud administrator, and use one of the following: - Personal access token (PAT) - Pass a JSON Web Token (JWT) using a unified access token (UAT) After signing in, you acquire a TCM credentials token. A TCM credentials token is required for any subsequent API requests that you make. You can use the [Authentication Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods) to sign in to the Tableau Cloud Manager REST API. For more information, see [Sign in to Tableau Cloud Manager REST API](#sign-in-to-tableau-cloud-manager-rest-api) below. #### About unified access tokens (UATs) Beginning in December 2025, you can configure a unified access token (UAT) that enables you to pass a JSON Web Token (JWT) to acquire a TCM credentials token. Among its benefits, UATs enable unified JWT-based authentication across Tableau Cloud Manager REST API and Tableau REST API for tenant and site-level administrative and content tasks. For more information, see [Unified Access Tokens](/current/api/cloud-manager/en-us/docs/unified_access_tokens.html). ### About authenticating to Tableau Cloud Manager To authenticate, or sign in, to the TCM UI, you must be a cloud administrator and one of the following authentication types must be enabled for the tenant: - **Single sign-on (SSO)** using Google, OpenID Connect (OIDC), Salesforce, or Security Assertion Markup Language (SAML) authentication. Setting up SSO with an external identity provider (IdP) requires minimal configuration in TCM. You can use the [Single Sign-on Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods) to do the following: - Enable Google, OIDC, Salesforce, or SAML authentication for TCM users - Enable SAML authentication for Tableau Cloud site users - **Tableau with MFA** authentication. When TCM users sign in to TCM for the first time, they’ll be prompted to set up multi-factor authentication (MFA) with a Tableau username and password. For more information, see [Sign In to Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_signin.htm) topic in the Tableau Cloud Help. **Notes:** - SSO is not supported for Tableau Cloud Manager REST API authentication. - If SSO is enabled to authenticate users in TCM, we recommend that there’s at least one cloud administrator that uses “Tableau with MFA” authentication to ensure uninterrupted access to TCM. For more information, see [Set up TCM authentication for users](#set-up-tcm-authentication-for-users) below. #### About configuring SAML authentication in Tableau Cloud Manager Beginning in December 2025, the SAML configuration methods in the TCM REST API enable you, the cloud administrator, to programmatically configure both SAML authentication for Tableau Cloud Manager (tenant) and your Tableau Cloud sites. This includes creating, updating, deleting SAML configurations for both the tenant and specific sites. For more information, see [Single Sign-on Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods). **Table of Contents** ## Sign in to Tableau Cloud Manager REST API To sign in to Tableau Cloud Manager REST API, you need to generate a personal access token (PAT) through the TCM UI first. After you create the PAT, you can use it in the **Sign in with personal access token** method request body. **About personal access tokens** PATs are long-lived access tokens. PATs validate that cloud administrators are allowed to sign in to Tableau Cloud Manager REST API. PATs offer the following advantages: - They can be revoked without disabling the user they’re attached to - They can be used concurrently, which make them ideal for use with scripts that run for different functional areas, such as sites, users, and permissions - A user can have multiple PATs For more information about PATs, see the [Personal Access Tokens for Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_personal_access_tokens.htm) topic in the Tableau Cloud Help. **Notes:** - PATs generated in Tableau Cloud aren’t compatible with TCM. Similarly, PATs generated in TCM aren’t compatible with Tableau Cloud. - To sign in to the Tableau Cloud Manager REST API for the first time, you must generate a PAT using the TCM UI. After that, you can generate new PATs using the [Create personal access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/createPersonalAccessToken) method. ### Step 1: Create a personal access token from TCM UI Before you can sign in to the Tableau Cloud Manager REST API for the first time, you must generate a PAT from the TCM UI first. 1. On the [Tableau Cloud Manager sign-in](https://cloudmanager.tableau.com) page, enter your username (email address). **Note:** The username you enter depends on the authentication set up for TCM. 2. Do _one_ of the following depending on what is displayed: - Select the tenant name and click the **Sign In** button. - Enter the tenant name in the **URI** text box and click the **Continue** button. **Note:** If you don’t know the tenant name, see [How to Find Tenant Name](/current/api/cloud-manager/en-us/docs/tenant.html). 3. Follow the prompts to enter your password and complete the sign-in process. **Note:** Your sign-in experience depends on the authentication set up for TCM. 4. Navigate to your account drop-down in the upper-right corner of the page and select **My Account Settings**. 5. In the Personal Access Tokens section, do the following: - 5.1. Click the **Create Token** button. - 5.2. Enter a token name. - 5.3. Optionally, set the token expiration. - 5.4. Click the **Create** button. - 5.5. Click the **Copy Secret** button to use in your Sign In request. Make sure you store the token secret in a safe location. The token secret is only shown once and won’t be accessible after the dialog box is closed. ### Step 2: Make a sign in request with personal access token The following section describes the different components required to sign in to the Tableau Cloud Manager REST API using the [Sign in with personal access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/personalAccessTokenLogin) method. **Example URI** To call the Tableau Cloud Manager REST API, first make a request using the **Sign in with personal access token** method to generate a TCM credentials token like in the example below. `POST https://cloudmanager.tableau.com/api/v1/pat/login` **Example request body** The **Sign in with personal access token** request body must contain the PAT secret, `token`, like in the example below. ``` { "token": "JKGpaIjBQaS1vlXIIt9g+A==:-jeD0dkAWu-mwZQPgRf3NvgHQBUZ7atQsPxh911YmPU" } ``` **Example response body** The **Sign in with personal access token** request produces the following response body. The response includes the TCM credentials token, `sessionToken`, like in the example below. ``` { "sessionToken": "+iUzQx+s:E9T43sqund-xDGle-9trR7WPLkqCkT_7zks3_dVsV0By_Jji", "userId": "306982a2-4bb0-b858-b82eeI24b857", "tenantId": "56978815-59b6-4a61-b9e8-ede126e23bab", "sessionExpiration": "2024-0706T84:53:13.688541Z" } ``` **Note:** A `sessionExpiration` value is returned in the sign-in response. This value corresponds to when the PAT expires in UTC time. ### Step 3: Include the `x-tableau-session-token` header in subsequent requests After generating the TCM credentials token, `sessionToken`, add it to the header, `x-tableau-session-token`, for all subsequent Tableau Cloud Manager REST API requests. **Example header** `x-tableau-session-token:+iUzQx+s:E9T43sqund-xDGle-9trR7WPLkqCkT_7zks3_dVsV0By_Jji` The TCM credentials token is short-lived. It expires after 4 hours or when the session is idle for 30 continuous minutes with no requests. When the TCM credentials token expires, you need to sign in to Tableau Cloud Manager REST API again to get a new TCM credentials token. ## Set up TCM authentication for users Using the Tableau Cloud Manager REST API, you can configure authentication to Tableau Cloud Manager (TCM) and assign the authentication type to TCM users. You can set the following types of authentication to enable sign-in for TCM users: - **Single sign-on (SSO):** SSO means that TCM is set up to use the same username and password (credentials) you use for other applications in your company. With SSO, your credentials are managed outside of Tableau by a third-party identity provider (IdP). When you sign in to TCM, it’s the IdP that lets Tableau know you’re an approved user. TCM supports authentication through Google, OIDC, Salesforce, or SAML. - **Tableau with MFA:** When multi-factor authentication (MFA) is enabled with Tableau authentication, you use a combination of your Tableau with MFA credentials and a verification method to access TCM. Tableau credentials are made up of an email address and password that you use for accessing TCM. You can choose a verification method after you register for MFA. For more information, see [Register for multi-factor authentication](https://help.tableau.com/current/online/en-us/cloud_manager_signin.htm#mfa-register-user). **Note:** To use Tableau with MFA authentication, skip Step 1 and go directly to [Step 2: Assign authentication to users](#step-2-assign-authentication-to-users) below. ### Step 1: Configure authentication After you make the sign-in request, you can configure Google, OpenID Connect (OIDC), or Salesforce authentication using the [Create or update OIDC configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/createOrUpdateOIDCConfiguration) method. Alternatively, you can configure SAML authentication using [Create SAML configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/createSamlConfiguration) method. The example below sets up Salesforce authentication for the tenant, which has a resource value of `123e4567-e89b-12d3-a456-426614174000` that can be retrieved by using the [Get Tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Tenant-Methods/operation/areTenantNameAndEncodeUriUnique) method. **Example URI** `PUT https://cloudmanager.tableau.com/api/v1/resources/123e4567-e89b-12d3-a456-426614174000/oidcconfiguration` **Example request body** ``` { "enabled": true, "knownProviderAlias": "Salesforce", "salesforceDomain": "login.salesforce.com" } ``` ### Step 2: Assign authentication to user After the authentication type has been configured for the tenant, assign TCM users to use that authentication. #### To assign single sign-on (SSO) authentication to users Using the [Add tenant user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/createUserWithMultiRole) method, set the `idp` value to `OpenID`. In this example, Salesforce authentication is assigned to the new TCM user because Salesforce is the authentication type configured for the tenant, which is specified by the `knownProviderAlias` attribute in [Step 1: Configure authentication](#step-1-configure-authentication) above. **Example URI** `POST https://cloudmanager.tableau.com/api/v1/tenants/f97df110-f4de-492e-8849-4a6af68026b0/users` **Example request body** ``` { "linkRoles": [ { "linkID": "ce9cad81-cd67-43fb-b952-2441d7b5a751", "linkRole": "LINK_ADMIN", "idp": "OpenID" } ] } ``` #### To assign Tableau with MFA authentication to users Using the [Add tenant user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/createUserWithMultiRole) method, set the `idp` value to `TabIDWithMFA`. **Example URI** `POST https://cloudmanager.tableau.com/api/v1/tenants/f97df110-f4de-492e-8849-4a6af68026b0/users` **Example request body** ``` { "linkRoles": [ { "linkID": "ce9cad81-cd67-43fb-b952-2441d7b5a751", "linkRole": "LINK_ADMIN", "idp": "TabIDWithMFA" } ] } ``` # How to Get Tenant Name A tenant in Tableau Cloud is the top-level administrative layer that holds all your sites, users, and licenses. Cloud administrators operate at this level using Tableau Cloud Manager (TCM). To sign in to Tableau Cloud Manager REST API, you must know the name of the tenant that you want to access. **Table of Contents** ## Get tenant name in TCM UI The most direct way to find the tenant name is by signing into the TCM UI from the email invitation you received when you were initially added to TCM. If you don’t have the email invitation, you can follow the “Forgot URI” workflow. ### Option 1: Sign in from email invitation 1. Navigate to the TCM email invitation you received. 2. In the email invitation, click the **Sign In** button. 3. Follow the prompts to enter your password and complete the sign-in process. **Note:** Your sign-in experience depends on the authentication set up for TCM. The tenant name is in the first portion of the URL after you’ve signed in to TCM. For example, if your tenant URL is https://mytenant.cloudmanager.tableau.com, the tenant name you can use to sign in to TCM and in Tableau Cloud Manager REST API requests is `mytenant`. ### Option 2: Sign in using “Forgot URI” workflow 1. On the [Tableau Cloud Manager sign-in](https://cloudmanager.tableau.com) page, enter your username (email address) and click the **Sign In** button. **Note:** The username you enter depends on the authentication set up for TCM. 2. Click **Forgot URI**. This will prompt an email notification to be sent to you. 3. Navigate to the email notification from Tableau and copy the verification code. 4. Back on the **Check your email** page, paste the verification code you copied, and click the **Verify** button. 5. On the **Select where to sign in** page, select the tenant and click the **Sign In** button. For example, select `Cloud Manager: MyTenant`. 6. Follow the prompts to enter your password and complete the sign-in process. **Note:** Your sign-in experience depends on the authentication set up for TCM. The tenant name is in first portion of the URL after you’ve signed in to TCM. For example, if your tenant URL is https://mytenant.cloudmanager.tableau.com, the tenant name you use to sign in to the Tableau Cloud Manager REST API is `mytenant`. ## Get tenant ID To find the tenant ID (`tenantId`), you have one of two options: Sign in to TCM REST API with a personal access token or sign in to TCM (UI) and use your browser’s developer tools. ### Option 1: Sign in to TCM REST API using personal access token 1. Make a call to the [Sign in with personal access token](/current/api/cloud-manager/en-us/reference/index.html##tag/Authentication-Methods/operation/personalAccessTokenLogin) to sign in to the Tableau Cloud Manager REST API. 2. Review the response body for the `tenantId`. ### Option 2: Sign in to TCM (UI) and use browser developer tools The procedure described below uses Google Chrome. 1. Sign in to [Tableau Cloud Manager](https://cloudmanager.tableau.com). 2. On your browser page, navigate to the browser’s developer tools. For example: - 2.1 On the browser menu, select **More Tools** > **Developer Tools**. - 2.2 Click on the **Network** tab. - 2.3 Under Name section, navigate to and click **userinfo**. - 2.4 Review the Response tab for the `tenantId`. # Platform Data The Platform Data API provides platform-agnostic, enterprise-grade observability across your Tableau Cloud deployment. Accessible through Tableau Cloud Manager (TCM) REST API, the Platform Data API offers a centralized way to retrieve auditing and usage data to monitor security, performance, and operational health. #### Benefits of Platform Data API The Platform Data API offers the following benefits: - **Unified observability:** Access all event data for the tenant and site from a single interface. - **Platform agnostic**: Pull data into your preferred tool or custom automation. - **Scalability:** Replace manual processes with RESTful API calls designed to handle large-scale Tableau Cloud deployments. - **Near real-time monitoring:** If licensed with Tableau+ or Tableau Enterprise edition, access high-frequency data so that you can respond to critical events. - **Extended retention:** If licensed with Tableau+ or Tableau Enterprise edition, keep event data for up to one year to meet compliance and auditing requirements. **Table of Contents** ## Understanding Platform Data The Platform Data API provides access to two complementary types of data: - **Event logs:** Historical event data that captures what happened in your Tableau Cloud deployment. Event logs record user actions, system events, and security-related activities at both the tenant and site levels. This data is stored in JSON format. - **Entity snapshots:** Point-in-time snapshots of Tableau Cloud content and its components, such as workbooks, data sources, published connections, users, and groups. Entity snapshots capture the current state of what exists on your sites. This data is stored in Parquet format. **Note:** You can test these methods using an open source tool available in GitHub, [Tableau Cloud Platform Data Loader](https://github.com/tableau/tabcloud_platform_data_loader). ### When to use each data type | **Goals** | **Questions to answer** | **Platform Data file type** | **Required license** | | --- | --- | --- | --- | | To understand events, user actions, or changes over time | Who accessed this workbook yesterday? What caused this authentication failure? Show me all failed sign-in attempts. | Event logs | See [Event Update and Data Retention](https://help.tableau.com/current/online/en-us/activity_log_overview.htm#event-update-frequency-and-data-retention) in the Tableau Cloud Help. | | To understand the current state or metadata of content | How many workbooks exist in the Sales project? Which data sources are certified? List all users with Creator licenses. | Entity snapshots | Enterprise or Tableau+ | | To relate events to content for comprehensive analysis | Show access events for workbooks that are now deleted. Which users modified high-priority data sources? What was the state of this workbook when the error occurred? | Event logs and entity snapshots | Enterprise or Tableau+ | ## Step 1: Authenticate to Tableau Cloud Manager REST API Before you can use the Platform Data API, you must authenticate to the Tableau Cloud Manager (TCM) REST API. How you authenticate to the TCM REST API depends on whether you’re signing in for the first time or have previously signed in before. - **First-time workflow:** If authenticating to the TCM REST API for the first time, follow the steps described in [Sign in to Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html#sign-in-to-tableau-cloud-manager-rest-api). - **Returning workflow:** If you’ve previously signed in to the TCM REST API, authenticate by using one of the following methods: - [Sign in with personal access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/personalAccessTokenLogin) - [Sign in with unified access token JWT](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/jwtLogin) **Notes:** - The sign in response returns the tenant ID that you’ll use in subsequent requests. - For site requests, you’ll need the site ID. To get site IDs of the sites on the tenant for subsequent requests, use the [List Tenant Sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSites) method. ## Step 2: List available files Retrieve a list of available files to download by calling the appropriate method based on the data type you need: **Event logs:** - [List Activity Logs for Tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getActivityLogFileListForTenant) returns tenant-level events - [List Activity Logs for Site](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getSiteActivityLogListForSite) returns site-level events **Entity snapshots:** - [List Entity Snapshots for Site](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getSiteEntitySnapshotListForSite) returns entity snapshots for a site You can filter the results by date range (`startTime` and `endTime`) and type (`eventType` for event logs, `entityType` for entity snapshots). If no parameters are included, the APIs return the last 24 hours of available data for all types. ### About dates and date ranges - Start time and end time parameters are in UTC format. We recommend always specifying the start time. However, if the start time isn’t specified, the default is 24 hours before the request. - Seven days is the maximum time span that you can specify between start and end times in a single request. A range that exceeds seven days causes the request to fail. - **Entity snapshots only:** Start time must not exceed 14 days in the past. **Best practices** Timestamps generally represent when the records became available, not necessarily when the events or snapshots occurred. Consider the following best practices: - You can use dates to capture incrementally new data as it becomes available. - When searching for data within a particular time window, specify a wider range to ensure you capture all relevant data in your request. For event logs, add at least one hour on each side to the time range. ### About data types **Event log types** There are two categories of event types: tenant events and site events. - **Tenant events:** Recorded activities that occur within the TCM platform - **Site events:** Recorded activities that occur within each site on the tenant For a list of event types and corresponding parameters, see: - [Activity Log Tenant Event Type Reference](https://help.tableau.com/current/online/en-us/activity_log_tenant_schema.htm) - [Activity Log Site Event Type Reference](https://help.tableau.com/current/online/en-us/activity_log_schema.htm) **Entity snapshot entity types** Entity snapshots provide information about site-level content and components. For a list of entity types and corresponding parameters, see: - [Entity Snapshot Site Entity Type Reference](https://help.tableau.com/current/api/cloud-manager/en-us/docs/TBD) **Best practices** - Because the `eventType` and `entityType` filters accept a single value per request, we recommend using these filters for ad hoc requests. For example, query no more than three types as separate requests. Making multiple requests for more types can cause a measurable impact on API call capacity and can cause API request limits to be reached quickly. For more information about these limits, see [API request limits](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods#api-request-limits). - If interested in multiple types, call all types without a filter. Then use the `GET` methods to retrieve specific types you’re interested in. ### Example requests To list files, you need the tenant ID, and for site-level files, both the tenant ID and site ID. The tenant ID is returned after authenticating to the TCM REST API. To get the site ID, you can call the [List Tenant Sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSites) method. **Event logs - tenant** This request returns all tenant events 24 hours before the time of the request. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog` This request returns events from January 1 to January 7. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00` This request returns site creation ([tcm\_activity\_log\_access](https://help.tableau.com/current/online/en-us/activity_log_tenant_schema.htm#tcmactivitylogaccess)) activity from January 1 to January 7. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00&eventType=tcm_activity_log_access` **Event logs - site** This request returns all site events 24 hours before the time of the request. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog` This request returns seven days of events from January 1 to January 7. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00` This request returns refresh token or personal access token redemption ([hist\_redeem\_refresh\_token](https://help.tableau.com/current/online/en-us/activity_log_schema.htm#histredeemrefreshtoken)) activity from January 1 to January 7. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00&eventType=hist_redeem_refresh_token` **Entity snapshots** This request returns all entity snapshots 24 hours before the time of the request. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots` This request returns entity snapshots from January 1 to January 7. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00` This request returns visualization entity snapshots from January 1 to January 7. `GET https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots?startTime=2026-01-01-T00:00:00&endTime=2026-01-07-T00:00:00&entityType=views` ### Example responses The response returns a list of file paths and their corresponding sizes (bytes), partitioned by tenant or site ID, date range, and type. What is returned is then filtered by the parameters you provide. **Note**: For event logs, because tenant IDs aren’t returned as part of the path for site-level data, consider creating a tenant folder when managing or storing these files. **Event logs - tenant** ``` { "files": [ { "path": "tenant-9cde722f-1edc-4cdd-b76f-42d87b51c785/y=2026/m=01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.text", "size": 2112 } ] } ``` **Event logs - site** ``` { "files": [ { "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.text", "size": 1292 } ] } ``` **Entity snapshots** ``` { "files": [ { "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet", "size": 8192 } ] } ``` ## Step 3: Generate download URLs To access the data, pick which file paths returned from the previous request to generate download URLs for. You’ll then use the paths in the request body of the appropriate `GET` method: **Event logs:** - [Get Activity Logs for Tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getActivityLogForTenant) - [Get Activity Logs for Site](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getActivityLogForSite) **Entity snapshots:** - [Get Entity Snapshot for Site](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getEntitySnapshotForSite) ### Example requests **Event logs - tenant URI** The request returns a download URL for the “ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt” log file. `POST https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog` **Event logs - tenant request body** ``` { "files": [ "tenant-9cde722f-1edc-4cdd-b76f-42d87b51c785/y=2026/m=01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt" ] } ``` **Event logs - site URI** The request returns download URLs for the specified event log files. `POST https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog` **Event logs - site request body** The request must include a comma-separated list of paths from the previous request. ``` { "files": [ "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt", "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=background_job/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.txt " ] } ``` **Entity snapshots - site URI** The request returns download URLs for the specified entity snapshot files. `POST https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots` **Entity snapshots - site request body** The request must include a comma-separated list of paths from the previous request. ``` { "files": [ "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet", "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=workbooks/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.parquet" ] } ``` ### Example responses The response produces the original file paths and corresponding download URLs to access the files. The URLs expire after 10 minutes. **Important:** Because the download URLs allow unauthenticated access to your data, treat these URLs as sensitive information and don’t share with anyone. **Event logs - tenant** ``` { "files": [ { "path": "tenant-9cde722f-1edc-4cdd-b76f-42d87b51c785/y=2026/m=01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt", "url": "https://m1jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/tenant%3D9cde722f-1edc-4cdd-b76f-42d87b51c785/y%3D2026/m%3D01/d=01/h=0/eventType=tcm_activity_log_access/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..." } ] } ``` **Event logs - site** ``` { "files": [ { "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt", "url": "https://activity-log-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=hist_redeem_refresh_token/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.txt?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..." }, { "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=background_job/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.txt", "url": "https://activity-log-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/eventType=background_job/ActivityLog-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.txt?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..." } ] } ``` **Entity snapshots - site** ``` { "files": [ { "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet", "url": "https://entity-snapshot-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=views/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-376429.parquet?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..." }, { "path": "pod=prod-ca-a/siteLuid=33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=workbooks/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.parquet", "url": "https://entity-snapshot-site-prod-ca-a.s3.ca-central-1.amazonaws.com/jb91y8k3mwh.mrap.accesspoint.s3-global.amazonaws.com/pod%3Dprod-ca-a/siteLuid%3D33d345e6-36bd-4411-91e2-1c9fc849564e/y=2026/m=01/d=01/h=0/entityType=workbooks/EntitySnapshot-0fb71a00-5645-44e3-ace6-aa37d66aa966-0-0-7.parquet?X-Amz-Algorithm=AWS4-ECDSA-P256-SHA256&..." } ] } ``` ## Step 4: Download and analyze data Programmatically open each URL returned from the previous request or copy and paste the URL in a browser to download each file. After you’ve downloaded the files, ingest them into your preferred analytics platform for analysis. ### File formats and tools **Event logs** are in JSON format. You can: - Open them in a text editor to view individual events - Import them into analytics platforms like Tableau, Splunk, Snowflake, or other tools that support JSON ingestion **Entity snapshots** are in Parquet format. You can: - Read them using tools like Apache Spark, Python (pandas, pyarrow), or DuckDB - Import them into analytics platforms like Tableau, Snowflake, or other tools that support Parquet files ### Using analytics tools You can ingest Platform Data into various analytics and monitoring platforms: - **Tableau:** Import JSON or Parquet files directly or publish them as data sources for visualization and analysis. - **Splunk:** Use Splunk’s data ingestion agents to monitor and index event log files. For detailed integration steps, refer to the [Splunk documentation](https://docs.splunk.com/Documentation). - **Snowflake:** Load event log and entity snapshot data into Snowflake for data warehousing and analytics. See the [Snowflake documentation](https://docs.snowflake.com/) for integration guidance. - **Other platforms:** Most analytics platforms support JSON and Parquet data ingestion. Consult your platform’s documentation for specific integration steps. For advanced use cases involving the integration of event logs with entity snapshots, see [Integrate event logs and entity snapshots](#integrate-activity-logs-and-entity-snapshots). ### Example data **Event logs - tenant** For example, an event log download URL might produce the following JSON data when opened in a text editor. ``` {"eventId":"bbce137f-12ce-4eaf-b4eb-fd0d42e521a0","tenantId":"9cde722f-1edc-4cdd-b76f-42d87b51c785","eventType":"tcm_activity_log_access","eventVersion":"0.1","eventProcessedTime":"2026-01-04T21:08:46.819Z","initiatingUserIPAddress":"155.000.00.00","eventProcessedTimeEnd":"2026-11-04T21:08:43.022551Z","siteName":null,"initiatingUserAgent":"PostmanRuntime/7.42.0","initiatingSessionId":"166a62f4-8bbc-4020-918e-a8b15dc36ff3","siteUri":null,"podUri":null,"eventProcessedTimeStart":"2026-01-13T21:08:43.022Z","initiatingUrl":"https://mytenant.manage.online.tableau.com/api/v1/tenants/9cde722f-1edc-4cdd-b76f-42d87b51c785/activitylog","tenantUri":"mytenant","initiatingUserEmail":"snguyen@example.com","tenantName":"mytenant","eventOutcome":"success","eventTime":"2026-01-14T21:08:43.028Z","siteId":null,"initiatingUserRole":"TCM_ADMIN","initiatingUserDisplayName":". snguyen@yourcompany.com","eventTypeAccessed":null,"eventOutcomeReason":null,"initiatingUserId":"33d345e6-a011-4992-8db0-94768451e54e"} {"eventId":"bbce137f-12ce-4eaf-b4eb-fd0d42e521a1","tenantId":"9cde722f-1edc-4cdd-b76f-42d87b51c785","eventType":"tcm_activity_log_access","eventVersion":"0.1","eventProcessedTime":"2026-11-04T21:10:37.123Z","initiatingUserIPAddress":"155.000.00.00","eventProcessedTimeEnd":"2026-01-04T21:08:43.022551Z","siteName":null,"initiatingUserAgent":"PostmanRuntime/7.42.0","initiatingSessionId":"166a62f4-8bbc-4020-918e-a8b15dc36ff3","siteUri":null,"podUri":null,"eventProcessedTimeStart":"2026-01-14T21:10:34.331Z","initiatingUrl":"https://mytenant.manage.online.tableau.com/api/v1/tenants/9cde722f-1edc-4cdd-b76f-42d87b51c785/activitylog","tenantUri":"mytenant","initiatingUserEmail":"snguyen@example.com","tenantName":"mytenant","eventOutcome":"success","eventTime":"2026-01-14T21:10:27.001Z","siteId":null,"initiatingUserRole":"TCM_ADMIN","initiatingUserDisplayName":". snguyen@example.com","eventTypeAccessed":null,"eventOutcomeReason":null,"initiatingUserId":"33d345e6-a011-4992-8db0-94768451e54e"} ``` **Event logs - site** For example, an event log download URL might produce the following JSON data when opened in a text editor. ``` {"eventId":"8102722e-3033-4112-8a48-8f5ce8e2411d","siteLuid":"33d345e6-36bd-4411-91e2-1c9fc849564e","eventType":"hist_redeem_refresh_token","eventVersion":"0.2","eventCategory":"security","eventTime":"2026-01-04T22:02:33.798536347Z","eventProcessedTime":"2026-01-04T22:02:45.38829Z","siteRoleId":11,"actorUserId":221648,"systemAdminLevel":0,"licensingRoleName":"Tier_Author","eventOutcome":null,"refreshTokenGuid":"76113549-ea79-4c74-8220-751af05af6da","siteName":"mysite","actorUserLuid":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","deviceName":"ws1-ltmjqxm","initiatingUserLuid":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","eventOutcomeReason":null,"initiatingUserId":221648} {"eventId":"6254977f-3033-4112-8a48-8f5ce8e2411d","siteLuid":"33d345e6-36bd-4411-91e2-1c9fc849564e","eventType":"hist_redeem_refresh_token","eventVersion":"0.2","eventCategory":"security","eventTime":"2026-01-010T11:05:35.51477Z","eventProcessedTime":"2026-01-010T11:05:59.352Z","siteRoleId":11,"actorUserId":224144,"systemAdminLevel":0,"licensingRoleName":"Tier_Author","eventOutcome":null,"refreshTokenGuid":"76164888-ea79-4c74-8220-751af05af6da","siteName":"mysite","actorUserLuid":"2ef2495f-99d1-434c-8ce2-6cebe5a73d44","deviceName":"ws2-qxltmmj","initiatingUserLuid":"2ef2495f-99d1-434c-8ce2-6cebe5a73d44","eventOutcomeReason":null,"initiatingUserId":224144} ``` **Entity snapshots** ``` {"view_id":"3a0c97cb-1fca-4c32-94a5-3849dc14cfa8","name":"Sales Performance Dashboard – Overview","content_url":"sales-performance-dashboard/overview","created_at":"2025-11-15T18:22:46.000","updated_at":"2026-01-03T18:22:46.000","workbook_id":"f5dc784b-56c0-42c0-a67e-a025e4a7c251","workbook_name":"Sales Performance Dashboard","project_id":"a1b2c3d4-0001-0001-0001-000000000001","project_name":"Sales","owner_id":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","owner_name":"jsmith","total_views":595,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} {"view_id":"4dd18aa6-915e-4fe2-a5d8-9a26e09d3a87","name":"Marketing KPIs – Overview","content_url":"marketing-kpis/overview","created_at":"2025-09-02T01:09:54.000","updated_at":"2025-09-21T01:09:54.000","workbook_id":"fd71654b-7402-4bb2-9553-f847f89ebdc8","workbook_name":"Marketing KPIs","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":635,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} {"view_id":"57912241-bd8b-426a-8829-5475d9c3e224","name":"Marketing KPIs – Detail","content_url":"marketing-kpis/detail","created_at":"2025-09-02T01:09:54.000","updated_at":"2025-09-21T01:09:54.000","workbook_id":"fd71654b-7402-4bb2-9553-f847f89ebdc8","workbook_name":"Marketing KPIs","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":696,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} {"view_id":"f74f8247-12b3-445e-a4c4-be5bcf367f32","name":"Marketing KPIs – Trend","content_url":"marketing-kpis/trend","created_at":"2025-09-02T01:09:54.000","updated_at":"2025-09-21T01:09:54.000","workbook_id":"fd71654b-7402-4bb2-9553-f847f89ebdc8","workbook_name":"Marketing KPIs","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":103,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} {"view_id":"070f981d-0f9f-4058-892f-9d573162fab0","name":"Ops Efficiency Report – Overview","content_url":"ops-efficiency-report/overview","created_at":"2025-08-29T22:38:34.000","updated_at":"2025-10-08T22:38:34.000","workbook_id":"aaaf29f2-2790-4fed-a376-5b9535f8b9bd","workbook_name":"Ops Efficiency Report","project_id":"a1b2c3d4-0001-0001-0001-000000000001","project_name":"Sales","owner_id":"2fe6101f-99d1-434c-8ce2-6cebe5a73d44","owner_name":"jsmith","total_views":693,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} {"view_id":"708ec15b-09d8-4c25-891b-7deaa5e4e8d6","name":"Pipeline Funnel – Overview","content_url":"pipeline-funnel/overview","created_at":"2025-09-26T06:51:51.000","updated_at":"2025-11-12T06:51:51.000","workbook_id":"71acab53-58ea-4299-b322-293a621e0240","workbook_name":"Pipeline Funnel","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":653,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} {"view_id":"cd9cd828-531d-4ee6-906b-759e78b09ed6","name":"Pipeline Funnel – Detail","content_url":"pipeline-funnel/detail","created_at":"2025-09-26T06:51:51.000","updated_at":"2025-11-12T06:51:51.000","workbook_id":"71acab53-58ea-4299-b322-293a621e0240","workbook_name":"Pipeline Funnel","project_id":"a1b2c3d4-0003-0001-0001-000000000003","project_name":"Finance","owner_id":"33d345e6-a011-4992-8db0-94768451e54e","owner_name":"snguyen","total_views":984,"site_id":"33d345e6-36bd-4411-91e2-1c9fc849564e","site_name":"mysite","snapshot_time":"2026-01-14T21:00:00.000"} ``` ## Step 5: Pair event logs and entity snapshots Event logs and entity snapshots are complementary data that, when combined, provide comprehensive observability of your Tableau Cloud deployment. Event logs capture historical events (what happened), while entity snapshots capture the current state of content and components (what exists). We recommend getting the latest entity snapshot of your site and collate various event logs created over time to create a single set of data that can be queried for your analysis. By pairing these data together, you can perform advanced analytics that relate events to their entities. ### Common use cases Integrating event logs and entity snapshots enables you to: - **Analyze deleted content:** Query activity related to workbooks, data sources, or users that no longer exist by joining historical events with past entity snapshots. - **Track content evolution:** Understand how entities have changed over time by correlating events with entity states. - **Audit and compliance:** Combine who did what (event logs) with what existed at the time (entity snapshots) for comprehensive audit trails. - **Usage and performance analysis:** Relate performance events to specific content characteristics captured in entity snapshots. - **Tenant-level analysis:** Enables you to combine data across all sites within a tenant for comprehensive reporting and analysis. ### Example - Tableau To pair event logs and entity snapshots in your analytics platform: 1. **Download both sets of data** using the methods described in the previous sections. - For event logs, collate the event logs for the site, multiple sites, or the tenant - For entity snapshots, get the latest data for the site or collate the latest data for multiple sites 2. **Load the data into Tableau** 3. **Use full outer joins** to relate event logs and entity snapshots. This allows you to query events and entities even when one side of the relationship may not exist (such as deleted workbooks). 4. **Join on common fields** such as: - Workbook ID (`workbook_id`, `workbookId`) - Data source ID (`datasource_id`, `datasourceId`) - User ID (`user_id`, `userId`) - Site ID (`site_id`, `siteId`) By joining on these fields, you can answer questions like: - “Show me all access events for workbooks in the Sales project” - “Which users accessed data sources that are now deleted?” - “What was the state of a workbook when a specific error occurred?” ### Best practices - **Specify appropriate time ranges:** When querying event logs, use time ranges that align with your entity snapshot collection schedule to ensure consistency. - **Account for deleted entities:** Use full outer joins to preserve events related to entities that might have been deleted since the snapshot was taken. - **Optimize for your use case:** If you’re only interested in current entities, use inner joins. If you need a complete audit including deleted content, use full outer joins. - **Use tenant-level data:** Take advantage of tenant-level access to analyze patterns across all sites or compare activity between sites. # Tableau Cloud Manager (TCM) Release Notes #### Table of Contents - [October 2026 updates](#october-2026) - [August 2026 updates](#august-2026-updates) - [July 2026 updates](#july-2026-updates) - [June 2026 updates](#june-2026-updates) - [May 2026 updates](#may-2026-updates) - [February 2026 updates](#february-2026-updates) - [December 2025 updates](#december-2025-updates) - [August 2025 updates](#august-2025-updates) - [March 2025 updates](#march-2025-updates) - [January 2025 updates](#january-2025-updates) - [December 2024 updates](#december-2024-updates) - [Fall 2024: TCM REST API release](#fall-2024-tcm-rest-api-release) ### October 2026 The following updates were made available in October 2026: - [Add user to tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/createUserWithMultiRole) and [Update user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/modifyUserWithMultiRole) - added language implications for site invitation email notifications. Also updated to include Dutch language (NL\_NL) support, which was added in February 2025 (Tableau Cloud 2025.1). ### August 2026 - [Unified Access Tokens](/current/api/cloud-manager/en-us/docs/unified_access_tokens.html) topic - updated prerequisites, step 2, and step 3 to improve usability. ### July 2026 updates The following methods and updates were made available in July 2026: #### Platform Data methods - [Platform Data](/current/api/cloud-manager/en-us/docs/platform_data.html) topic - updated the topic to include entity snapshots and examples. Added new methods: - [Get entity snapshots for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getEntitySnapshotForSite) - [List entity snapshots for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods/operation/getSiteEntitySnapshotListForSite) #### Capacity methods Added new capacity types (Visualizations and Pulse digests) for tenants licensed with the capacity-based model: - [List capacities](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getCapacities) - [Update capacities](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/updateCapacities) - [List capacity metrics for tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getPaginatedMetricsForTenant) - [List capacity metrics for sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getScrolledMetricsForSite) - [Get capacity metrics for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getMetricsForSite) ### June 2026 updates The following updates were made available in June 2026: - [List capacities](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getCapacities) and [Update capacities](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/updateCapacities) - Removed support for suspended sites. - [Update capacities](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/updateCapacities) - Added troubleshooting section for update capacity errors. - [List tenant sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSites) and [Get site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSite) - Added `disasterRecoveryStatus`, which displays cross-region continuity. This capability is currently in pilot. ### May 2026 updates The following methods were made available in May 2026: #### [Capacity methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods) - [List capacity metrics for tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getPaginatedMetricsForTenant) - [List capacity metrics for sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getScrolledMetricsForSite) - [Get capacity metrics for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/getMetricsForSite) - [Update capacities](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity-Methods/operation/updateCapacities) ### February 2026 updates The following updates were made available in February 2026: - [UATs with Tableau Bridge](/current/api/cloud-manager/en-us/docs/authentication.html#uats-with-tableau-bridge) section - About unified access token (UAT) support for Tableau Bridge (Linux) sign-in. - [Platform Data API](/current/api/cloud-manager/en-us/docs/platform_data.html) topic - An overview of the platform data API capabilities in TCM, the benefits, how to sign in, and example workflows to improve monitoring of your Tableau Cloud deployment. - Added Postman collection references to each method’s landing page. ### December 2025 updates The following methods and updates were made available in December 2025: - [Unified Access Tokens](/current/api/cloud-manager/en-us/docs/unified_access_tokens.html) topic - About JWT-based authorization using unified access tokens (UATs), which includes how to configure UATs for TCM REST API and Tableau REST API. - [Get tenant ID](/current/api/cloud-manager/en-us/docs/tenant.html#get-tenant-id) section - How to find the `tenantID`, a requirement for many TCM REST API calls. - [About configuring SAML authentication](/current/api/cloud-manager/en-us/docs/authentication.html#about-configuring-saml-authentication-in-tableau-cloud-manager) section - About configuring SAML authentication for TCM users and Tableau Cloud site users. - Added access scopes to methods that support authorization with UAT JWTs. This update is made in conjunction with access scope updates to the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_whats_new.htm). - Published [Tableau Cloud Manager REST API Postman](https://www.postman.com/salesforce-developers/salesforce-developers/folder/h3ksyyu/tableau-apis?action=share&creator=0&ctx=documentation) collection. #### [Authentication methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods) - [Create unified access token configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/createUatConfiguration) - [Get unified access token configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/getUatConfiguration) - [List unified access token configurations](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/getUatConfigurations) - [Delete unified access token configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/deleteUatConfiguration) - [Update unified access token configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/updateUatConfiguration) - [Sign in with unified access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/jwtLogin) - [Revoke unified access token JWT](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/createUatRevocationRecords) - [List revoked unified access token JWT](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/getUatRevocationRecords) - [Delete revoked unified access token JWT](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/deleteRevocationRecord) - [Sign Out](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/revokeSessionId) #### [Single sign-on methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods) - [Create SAML configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/createSamlConfiguration) - [Update SAML configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/updateSamlConfiguration) - [Get SAML configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/getSAMLConfiguration) - [Delete SAML configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/deleteSAMLConfiguration) - [Get SAML logs](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/getAdminLogs) ### October 2025 updates The following methods and updates were made available in October 2025: - [Get activity logs for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getActivityLogForSite) - Gives you site activity captured by activity log. - [List activity logs for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getSiteActivityLogListForSite) - Gives you a list of activity log files that contain site activity captured by activity log. ### August 2025 updates The following methods and updates were made available in August 2025: - [Update site name and content url](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/renameSite) - Enables administrators to change the name or content URL (subdomain name) of a site. ### March 2025 updates The following methods and updates were made available in March 2025: - [Create or update OIDC configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/createOrUpdateOIDCConfiguration) - Lets you configure OpenID Connect (OIDC) authentication for your Tableau Cloud Manager users, in addition to Google and Salesforce authentication. ### January 2025 updates The following methods and updates were made available in January 2025: - [List activity logs for tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getActivityLogFileListForTenant) - Gives you the paths to activity log files that can be used to generate download urls for those files. - [Get activity logs for tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getActivityLogForTenant) - Lets you specify the activity log paths to generate URLs you can use to download the logs. - Clarification: For methods that deleting users in cases where the user owns content within the tenant. See [Delete tenant user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/deleteUser) and [Batch delete tenant users](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/deleteUsers). ### December 2024 updates The following methods were made available in December 2024: - [List tenant location](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getLocations) - Get details of the Tableau pod instances and regions where a tenant can be hosted. - [Accept tenant terms and conditions](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/acceptTermsAndConditions) - Accept the terms and conditions for the specified tenant. ### Fall 2024: TCM REST API release The following methods were made available in the general availability release of TCM: #### [Administrative methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods) - [List regions](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getRegions) - [List user data for tenant sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getAllSitesAggregates) - [Get user data for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getSiteAggregate) - [Get user data for tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getTenantLicenseConsumption) - [Get session information](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getUserInfoForSelf) #### [Authentication methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods) - [Create personal access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/createPersonalAccessToken) - [List personal access tokens](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/listPersonalAccessToken) - [Revoke personal access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/revokePersonalAccessToken) - [Sign in](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/personalAccessTokenLogin) #### [Single sign-on methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-On-Methods) - [List authentication methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/getResourceAuthConfiguration) - [Create or update OIDC configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/createOrUpdateOIDCConfiguration) - [Delete OIDC configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/deleteOIDCConfiguration) - [Get OIDC configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods/operation/getOIDCConfiguration) #### [Site methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods) - [Create site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/createSite) - [List sites](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSites) - [Get site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSite) - [Suspend site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/deleteOrSuspendSite) - [Update license limit for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/updateLicenseQuotaForSite) - [Create project](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/createProjectOnSite) - [Reactivate suspended site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/reactivateSuspendedSite) #### [Tenant methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Tenant-Methods) - [Get tenant uniqueness](/current/api/cloud-manager/en-us/reference/index.html#tag/Tenant-Methods/operation/areTenantNameAndEncodeUriUnique) - [Get tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Tenant-Methods/operation/getTenant) #### [User methods](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods) - [Add tenant user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/createUserWithMultiRole) - [List tenant users](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/getUsers) - [Batch import users with .gzip](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/bulkUserImport) - [Batch delete tenant users](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/deleteUsers) - [Batch get tenant users](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/getUsersByUserIds) - [Delete user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/deleteUser) - [Get tenant user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/getUser) - [Update role and language for tenant user](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/modifyUserWithMultiRole) - [List status for user job](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/getBulkOperationDetails) - [Get user information](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/getUserResourcesByUsername) # Tableau Cloud Manager Operation Error Codes The following numbered error codes may be returned by a request to [List status for user job](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/getBulkOperationDetails) the Tableau Cloud Manager API when an operation fails. | Error Code | Message | Description | | --- | --- | --- | | `E_400_USR_SVC_2006` | USER\_SERVICE\_UNSUPPORTED\_SITE\_ROLE\_STATUS\_TRANSITION | Site role transition not allowed for user | | `E_400_USR_SVC_2009` | USER\_SERVICE\_UNSUPPORTED\_OPERATION | Unsupported operation requested | | `E_400_USR_SVC_2010` | USER\_SERVICE\_REQUEST\_HANDLING\_FAILED | Invalid arguments in request | | `E_400_USR_SVC_2012` | USER\_SERVICE\_TENANT\_STATUS\_NOT\_ALLOWED | Operation not allowed on inactive tenant | | `E_400_USR_SVC_2017` | USER\_SERVICE\_DEFAULT\_IDP\_HANDLING\_FAILED | Default identity provider is not supported for this site | | `E_403_USR_SVC_2016` | USER\_SERVICE\_REQUEST\_FORBIDDEN | Request forbidden | | `E_403_USR_SVC_2017` | USER\_SERVICE\_LICENSE\_LIMITS\_REACHED | Request forbidden: license limits reached | | `E_403_USR_SVC_2018` | USER\_SERVICE\_SITE\_SETTINGS\_LIMITS\_REACHED | Request forbidden: site settings limits reached | | `E_403_USR_SVC_2019` | USER\_SERVICE\_HEADER\_VALIDATION\_FAILED | Header validation failed | | `E_403_USR_SVC_2022` | INVALID\_CALLER\_TO\_ADD\_SUPPORT\_USER | Support user cannot be added | | `E_403_USR_SVC_2023` | UPDATE\_TO\_SUPPORT\_USER\_FORBIDDEN | Support user cannot be updated | | `E_404_USR_SVC_2020` | ENTITY\_NOT\_FOUND | Tenant, site, or user could not be found | | `E_404_USR_SVC_2022` | EXPIRED\_ENTITY\_FOUND | Expired tenant administrator role invitation | | `E_405_USR_SVC_2025` | USER\_SERVICE\_SELF\_DELETION\_NOT\_ALLOWED | Tenant administrator cannot delete themselves | | `E_405_USR_SVC_2024` | USER\_SERVICE\_METHOD\_NOT\_ALLOWED | Operation not allowed. | | `E_409_USR_SVC_2025` | CONFLICT\_IN\_OPERATION | Tenant, site, or user already in expected state | | `E_500_USR_SVC_3901` | DYNAMO\_DB\_OP\_FAILED | Tenant, site, or user changes could not be saved | | `E_500_USR_SVC_3902` | DYNAMO\_DB\_CONCURRENT\_MODIFICATION\_EXCEPTION | More than one process is trying to update the same tenant, site, or user | | `E_500_USR_SVC_4000` | UNKNOWN\_ERROR | Unknown error occurred | | `E_400_USR_SVC_4001` | USER\_SERVICE\_BULK\_OP\_REQUEST\_HANDLING\_FAILED | Job failed: request handling error | | `E_400_USR_SVC_4020` | USER\_SERVICE\_BULK\_OP\_FILE\_NOT\_FOUND | Job failed: file not found | | `E_400_USR_SVC_4022` | USER\_SERVICE\_BULK\_OP\_JOB\_NOT\_FOUND | Job failed: specified ID not found | | `E_400_USR_SVC_4016` | USER\_SERVICE\_BULK\_JOB\_IN\_INVALID\_STATE | Job failed: invalid state | | `E_400_USR_SVC_4024` | USER\_SERVICE\_BULK\_OP\_WORK\_AREA\_RECORD\_NOT\_FOUND | Job failed: work area record not found | | `E_400_USR_SVC_4025` | USER\_SERVICE\_BULK\_OP\_WORK\_AREA\_RECORD\_IN\_INVALID\_STATE | Job failed: work area record in invalid state | | `E_400_USR_SVC_4026` | USER\_SERVICE\_BULK\_OP\_STAGE\_NOT\_FOUND | Job failed: stage not found | | `E_400_USR_SVC_4027` | USER\_SERVICE\_BULK\_OP\_TYPE\_NOT\_FOUND | Job failed: type not found | | `E_404_USR_SVC_4601` | TENANT\_SERVICE\_ENTITY\_NOT\_FOUND | Tenant or site not found | | `E_400_USR_SVC_4602` | TENANT\_SERVICE\_VALIDATION\_FAILED | Invalid tenant request | | `E_500_USR_SVC_4603` | TENANT\_SERVICE\_ORCHESTRATION\_FAILED | Internal tenant error | | `E_404_USR_SVC_4604` | TENANT\_SERVICE\_RESPONSE\_NOT\_FOUND | Specified tenant not found | | `E_404_USR_SVC_4701` | URS\_RESPONSE\_NOT\_FOUND | User migration error: work flow ID not found | | `E_500_USR_SVC_4702` | URS\_ORCHESTRATION\_FAILED | User migration error: user synchronization failed | | `E_409_USR_SVC_4703` | USER\_SYNC\_ALREADY\_IN\_PROGRESS | User migration error: User synchronization to pod already in progress | | `E_500_USR_SVC_4801` | ENTITLEMENT\_SERVICE\_ORCHESTRATION\_FAILED | Entitlement service error | | `E_404_USR_SVC_4802` | ENTITLEMENT\_SERVICE\_RESPONSE\_NOT\_FOUND | Entitlement not found | | `E_500_USR_SVC_5101` | EXTERNAL\_SERVICE\_RESPONSE\_VALIDATION\_FAILED | Unknown error | # Tableau Cloud Manager REST API Overview Tableau Cloud Manager (TCM) REST API provides cloud administrators a programmatic way to oversee your organization’s Tableau Cloud sites. With TCM REST API, cloud administrators can create and edit sites, manage users, monitor license consumption across multiple sites, and monitor activity, all from a single location. Any changes made within TCM are applied at the top level element, also called a tenant, and then shared across all associated sites, ensuring streamlined administration and governance. - TCM is separate service from Tableau Cloud, with its own authentication and REST interface. - TCM enables you to centrally administer and configure multiple Tableau Cloud sites and their users in a “tenant” element. - TCM enables you to create new sites on a tenant. For more information about TCM, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). ### Tenants - A **tenant** is a grouping of Tableau Cloud sites that are hosted in a region. - A **cloud administrator** is a user with a role, added in TCM, that enables them to manage tenant configuration and content through the TCM UI and REST API. ### Sites on a tenant - A **site** on a tenant is a typical Tableau Cloud site. - The behavior of features like workbooks, data sources, users, roles, licenses, permissions, and more, operate in the same way as Tableau Cloud sites that are not on a tenant. - A site on a tenant can be accessed through the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api.htm). - Existing sites can be migrated to a tenant. ### Users on a tenant - A **user**, in the context of a site in a TCM tenant, is a typical Tableau Cloud user. - Once a user is added to a TCM tenant, that user identity can be added to any site within the tenant. An existing Tableau Cloud user can be migrated to a tenant by itself, in a batch, or in the context of migrating a site to a tenant. A tenant user can also be created directly. ### TCM REST API methods The TCM REST API provides methods for managing a tenant and its members in the following categories. Currently, cloud administrator permissions are required for all REST API requests. - **[Administrative methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods)** enable you to get information about: the current REST API session; a tenant’s status, region, and globally configured site capabilities; and metrics for the different types of users of a site or tenant. - **[Authentication methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods)** enable you to create, view, and revoke personal access tokens (PATs) that authenticate you in the service. Also enables you to configure, view, and delete universal access token (UAT) configurations and its associated JWTs that can authenticate you to TCM REST API and Tableau REST API. You can use the sign in methods to retrieve a session access token that enables REST API requests for the duration of the session. - **[Capacity Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Capacity--Methods)** enable you to manage and monitor certain capacity across the sites on the tenant. - **[Platform Data Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Platform-Data-Methods)** enable you to manage event logs and entity snapshots for the tenant and site. - **[Single Sign-on methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Single-Sign-on-Methods)** enable you to create, view and delete authentication configurations for the tenant and site. - **[Site Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods)** enable you to create sites and projects, and view, suspend, reactivate and delete sites on a tenant. - **[Tenant methods](/current/api/cloud-manager/en-us/reference/index.html#tag/Tenant-Methods)** enable you to get information about a tenant and to find out if a tenant name is unique. - **[User methods](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods)** enable you to create, import, delete users; view details of users and the resources related to users; update some of a user’s attributes. [![Tableau Cloud Manager (TCM) REST API Reference](https://help.tableau.com/current/api/rest_api/en-us/Resources/tableau-logo.png)](https://www.tableau.com/support/help) - Tableau Cloud Manager REST API Overview - Administrative Methods - getList regions - patchAccept tenant terms and conditions - getList tenant locations - getList user data for tenant sites - getGet user data for site - getGet user data for tenant - getGet session information - Authentication Methods - postCreate personal access token - getList personal access tokens - delRevoke personal access token - postSign in with personal access token - postCreate unified access token configuration - getList unified access token configurations - delDelete unified access token configuration - getGet unified access token configuration - putUpdate unified access token configuration - postSign in with unified access token JWT - delSign out - postRevoke unified access token JWT - delDelete revoked unified access token JWT - getList revoked unified access token JWTs - Capacity Methods - getList capacity metrics for tenant - postList capacity metrics for sites - getGet capacity metrics for site - getList capacities - patchUpdate capacities - Platform Data Methods - postGet activity logs for tenant - getList activity logs for tenant - postGet activity logs for site - getList activity logs for site - postGet entity snapshots for site - getList entity snapshots for site - Single Sign-on Methods - postCreate SAML configuration - delDelete SAML configuration - getGet SAML configuration - putUpdate SAML configuration - postList authentication configurations - putCreate or update OIDC configuration - delDelete OIDC configuration - getGet OIDC configuration - getList SAML logs - Site Methods - postCreate site - getList tenant sites - getGet site - delSuspend site - patchUpdate license limit for site - postCreate project - patchReactivate suspended site - patchUpdate site name and content url - Tenant Methods - getGet tenant - User Methods - postAdd user to tenant - getList tenant users - postBatch import users with .gzip - postBatch delete tenant users - postBatch get tenant users - delDelete tenant user - getGet tenant user - patchUpdate user on tenant - getList status for user job - getGet user information [API docs by Redocly](https://redocly.com/redoc/) # Tableau Cloud Manager REST API Reference (Current) URL: [https://cloudmanager.tableau.com](https://cloudmanager.tableau.com) The REST API methods for Tableau Cloud Manager (TCM) allow cloud administrators to manage tenants, sites, and users. TCM REST API methods include administrative, authentication, capacity management, platform data, single sign-on, site, tenant, and user methods. # [](#tag/Tableau-Cloud-Manager-REST-API-Overview)Tableau Cloud Manager REST API Overview Tableau Cloud Manager (TCM) REST API methods are available for Tableau Cloud October 2024 and later. For an overview, see **[Tableau Cloud Manager REST API Overview](https://help.tableau.com/current/api/cloud-manager/en-us/index.html)**. # [](#tag/Administrative-Methods)Administrative Methods TCM REST API Administrative methods allow cloud administrators to manage tenants, sites, and users in the following ways: - List the regions where tenants can be available. - Get the count of users categorized by role for each site in a tenant. - Get the count of users categorized by role for a specified site. - Get the count of users categorized by role for a tenant. - Get information about the current REST API session. **Postman:** [Administrative Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/cqu48vj/administrative-methods) ## [](#tag/Administrative-Methods/operation/getRegions)List regions List the regions where a site can be created in a tenant, filtered by the provided criteria. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_regions:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### query Parameters
pageNumber
integer <int32> >= 0
Default: 0

The number of the page to return values for. A value of 0 means do not page results.

pageSize
integer <int32> >= 0
Default: 100

The number of items returned per page.

latitude
number <double>
Example: latitude=37.7749

The latitude of the region, a value between -90 and +90.

longitude
number <double>
Example: longitude=-122.4194

The longitude of the region, a value between -180 and +180.

visibility
string
Enum: "INTERNAL" "PUBLIC"

If INTERNAL, the region is not visible to users. If PUBLIC the region is visible to users. Default is INTERNAL.

countryCode
string
Example: countryCode=US

The country code in the region definition.

### Responses **200** Success. **400** Invalid request. **500** Internal error. get/api/v1/regions https://cloudmanager.tableau.com/api/v1/regions ### Response samples - 200 - 400 - 500 Content type application/json Copy Expand all Collapse all `{ - "regions": [ - { - "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f", - "name": "string", - "location": { - "latitude": -90, - "longitude": -180 }, - "visibility": "INTERNAL", - "attributes": { - "property1": "string", - "property2": "string" } } ], - "data": [ - { - "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f", - "name": "string", - "location": { - "latitude": -90, - "longitude": -180 }, - "visibility": "INTERNAL", - "attributes": { - "property1": "string", - "property2": "string" } } ] }` ## [](#tag/Administrative-Methods/operation/acceptTermsAndConditions)Accept tenant terms and conditions Accepts the terms and conditions for the specified tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, October 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenants:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

### Responses **204** Success. **400** Invalid request. **404** A tenant with the tenant id does not exist. **500** Internal error. patch/api/v1/tenants/{tenantId}/acceptTermsAndConditions https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/acceptTermsAndConditions ### Response samples - 204 - 400 - 404 - 500 Content type application/json Copy `"string"` ## [](#tag/Administrative-Methods/operation/getLocations)List tenant locations Lists the Tableau pod locations or regions where a site for the specified tenant can be created. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenants:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

### Responses **200** Success. **400** Invalid request. **500** Internal error. get/api/v1/tenants/{tenantId}/locations https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/locations ### Response samples - 200 - 400 - 500 Content type application/json Copy Expand all Collapse all `{ - "podsData": { - "pods": [ - { - "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f", - "name": "string" } ] }, - "regionsData": { - "regions": [ - { - "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f", - "name": "string", - "tags": [ - "RELEASE_PREVIEW" ] } ] } }` ## [](#tag/Administrative-Methods/operation/getAllSitesAggregates)List user data for tenant sites For each site in the tenant, returns counts of users licensed for different roles. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

### Responses **200** Success. **403** The user does not have permissions. **404** The specified tenant could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/sites/users/role-consumption https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/users/role-consumption ### Response samples - 200 - 403 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "allSites": [ - { - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "userCount": 0, - "siteAdminCount": 0, - "creators": 0, - "explorers": 0, - "viewers": 0, - "unlicensed": 0 } ] }` ## [](#tag/Administrative-Methods/operation/getSiteAggregate)Get user data for site For the specified site, returns counts of users licensed for different roles. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

siteId
required
string <uuid>

The unique identifier of the site.

### Responses **200** Success. **403** The user does not have permissions. **404** The specified tenant or site could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/sites/{siteId}/users/role-consumption https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/users/role-consumption ### Response samples - 200 - 403 - 404 - 500 Content type application/json Copy `{ - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "userCount": 0, - "siteAdminCount": 0, - "creators": 0, - "explorers": 0, - "viewers": 0, - "unlicensed": 0 }` ## [](#tag/Administrative-Methods/operation/getTenantLicenseConsumption)Get user data for tenant For the specified tenant, returns counts of users licensed for different roles. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenants:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

### Responses **200** Success. **403** The user does not have permissions. **404** The specified tenant could not be not found. **500** Internal error. get/api/v1/tenants/{tenantId}/users/license-consumption https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/license-consumption ### Response samples - 200 - 403 - 404 - 500 Content type application/json Copy `{ - "creators": 0, - "explorers": 0, - "viewers": 0, - "unlicensed": 0 }` ## [](#tag/Administrative-Methods/operation/getUserInfoForSelf)Get session information Returns the user ID and tenant ID associated with the session. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager V2, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not required. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ### Responses **200** Success. **401** User could not be authenticated. **404** Active session not found. **500** Internal error. get/api/v2/userinfo https://cloudmanager.tableau.com/api/v2/userinfo ### Response samples - 200 - 401 - 404 - 500 Content type application/json Copy `{ - "sessionId": "123e4567-e89b-12d3-a456-426614174000", - "userId": "123e4567-e89b-12d3-a456-426614174000", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "sessionType": "USER" }` # [](#tag/Authentication-Methods)Authentication Methods Tableau Cloud Manager REST API Authentication methods allow cloud administrators to sign in to Tableau Cloud Manager REST API and manage personal access tokens (PATs) or unified access tokens (UATs) in the following ways: - Create a personal access token (PAT). Creating a PAT generates a PAT secret that you use in the request body of your sign-in request. - List all valid PATs. - Revoke a PAT. - Sign in to TCM REST API using a PAT and get a session access token, `x-tableau-session-token`, to use in the header of all subsequent REST API calls. - Configure a unified access token (UAT) for JSON Web Token (JWT)-based authentication. - Get a UAT configuration. - List all UAT configurations. - Delete a UAT configuration. - Sign in to TCM REST API using a UAT and get a session access token, `x-tableau-session-token`, to use in the header of all subsequent REST API calls. - Revoke a UAT JWT. - List all revoked UAT JWTs. - Delete a revoked UAT JWT. For more information, see the following: - [TCM REST API Authentication](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html) - [Unified Access Tokens](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html) - [Personal Access Tokens for Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_personal_access_tokens.htm) in the Tableau Cloud Help **Postman:** [Authentication Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/ocdkesg/authentication-methods) ## [](#tag/Authentication-Methods/operation/createPersonalAccessToken)Create personal access token Generates a personal access token (PAT) to enable REST API authentication for Tableau Cloud Manager (TCM). A PAT is required to sign in to Tableau Cloud Manager (TCM). **Notes:** - This PAT cannot be used to sign in to Tableau Cloud. - When signing in to Tableau Cloud Manager REST API for the first time, you must use the TCM UI to generate a PAT. For more information, see [TCM REST API Authentication](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html). > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not available. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### Request Body schema: application/json required
tokenName
required
string

Name of the personal access token (PAT). PAT name must be unique.

absoluteExpiryInDays
integer <int32>

Number of days the PAT is valid for. Default value is 180 days; maximum value is 365 days. For security purposes, we recommend setting a value that is no more than 180 days.

### Responses **200** Success. **400** Invalid request. **401** Personal access token not valid. **403** User is not authorized. **404** Tenant, user, or role with the specified ID could not be found. **415** Invalid request body. **500** Internal error. post/api/v1/pat https://cloudmanager.tableau.com/api/v1/pat ### Request samples - Payload Content type application/json Copy `{ - "tokenName": "MyTokenName", - "absoluteExpiryInDays": 180 }` ### Response samples - 200 - 400 - 403 - 404 - 415 - 500 Content type application/json Copy `{ - "tokenUUID": "123e4567-e89b-12d3-a456-426614174000", - "tokenName": "MyTokenName", - "userId": "123e4567-e89b-12d3-a456-426614174000", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "issueInUtc": "2024-07-01T00:00:00Z", - "expirationInUtc": "2024-07-31T00:00:00Z", - "secret": "string" }` ## [](#tag/Authentication-Methods/operation/listPersonalAccessToken)List personal access tokens Gets a list of all valid personal access tokens (PATs) you have generated for Tableau Cloud Manager (TCM). > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_pats:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ### Responses **200** Success. **401** Personal access token not valid. **403** User is not authorized to list personal access tokens. **404** Personal access token could not be found. **500** Internal error. get/api/v1/pat https://cloudmanager.tableau.com/api/v1/pat ### Response samples - 200 - 403 - 404 - 500 Content type application/json Copy Expand all Collapse all `[ - { - "tokenUUID": "123e4567-e89b-12d3-a456-426614174000", - "tokenName": "MyTokenName", - "userId": "123e4567-e89b-12d3-a456-426614174000", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "issueInUtc": "2024-07-01T00:00:00Z", - "expirationInUtc": "2024-07-31T00:00:00Z" } ]` ## [](#tag/Authentication-Methods/operation/revokePersonalAccessToken)Revoke personal access token Revokes a personal access token (PAT). > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_pats:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### header Parameters
tokenUUID
required
string

The token ID of the PAT.

### Responses **204** Success. **401** Personal access token not valid. **403** User not authorized. **404** PAT not found. **500** Internal error. delete/api/v1/pat https://cloudmanager.tableau.com/api/v1/pat ### Response samples - 403 - 404 - 500 Content type application/json Copy `{ - "message": "string", - "reason": "string", - "errorCode": "string" }` ## [](#tag/Authentication-Methods/operation/personalAccessTokenLogin)Sign in with personal access token Signs in to Tableau Cloud Manager (TCM) REST API using a personal access token (PAT). You must use a PAT to sign in to theTCM REST API using this method. To generate a PAT, go to your TCM My Account Settings or call the [Create Personal Access Token](#tag/Authentication-Methods/operation/createPersonalAccessToken) method. **Note:** When signing in to TCM REST API for the first time, you must use the TCM UI to generate a PAT. For more information, see [TCM REST API Authentication](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html#set-up-tcm-authentication-for-users). > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not required. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Request Body schema: application/json required
token
required
string

Token secret that is generated when you create a personal access token (PAT).

### Responses **200** Success. **400** Invalid request. **401** User is not authenticated. **403** User is not authorized. **404** PAT with the specified ID was not found. **500** Internal error. post/api/v1/pat/login https://cloudmanager.tableau.com/api/v1/pat/login ### Request samples - Payload Content type application/json Copy `{ - "token": "bSG+6ttrRgqMLzonp5j89w==:SUOF-rjwMZZKXg-T3GcpDVFrIKAO6VIbTyZyq39bWR0" }` ### Response samples - 200 - 400 - 401 - 403 - 404 - 500 Content type application/json Copy `{ - "sessionToken": "bSG+6ttrRgqMLzonp5j89w==:SUOF-rjwMZZKXg-T3GcpDVFrIKAO6VIbTyZyq39bWR0", - "userId": "123e4567-e89b-12d3-a456-426614174000", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "sessionExpiration": "2019-08-24T14:15:22Z" }` ## [](#tag/Authentication-Methods/operation/createUatConfiguration)Create unified access token configuration Creates a unified access token (UAT) configuration to enable Tableau Cloud Manager REST API authentication using a JSON Web Token (JWT). A UAT configuration must be associated with the JWT, through its public key or JWKS URI, used to sign in to Tableau Cloud Manager (TCM) REST API using the [Sign in with JSON Web Token](#tag/Authentication-Methods/operation/jwtLogin) method. Tableau Cloud Manager REST API authentication with a JWT enables users to perform administrative and content tasks both on the tenant and Tableau Cloud sites on the tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_configs:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### Request Body schema: application/json required
name
required
string

The name of the unified access token (UAT) configuration. UAT configuration name must be unique.

issuer
required
string

The issuer of the JSON Web Token (JWT).

publicKey
string

The public key used to verify the JSON Web Token (JWT). Use this value or jwksUri, but not both.

jwksUri
string

The URI of the JWKS endpoint. Use this value or publicKey, but not both.

usernameClaim
string

The username claim that maps to the Tableau username. Default value is email.

resourceIds
required
Array of strings <uuid> unique [ items <uuid > ]

The tenant ID, the tenant ID and site IDs associated with the tenant, or site IDs associated with the same tenant. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

scopes
Array of strings <scope> unique [ items <scope > ]

The access scopes defined in the JSON Web Token (JWT) associated with the unified access token (UAT) configuration. Scopes in the UAT are optional and allow you to further restrict the operations available to the JWT.

enabled
boolean

If true, the unified access token (UAT) configuration is enabled. Default value is true.

### Responses **201** Success. **400** Invalid request. **500** Internal error. post/api/v1/uat-configurations https://cloudmanager.tableau.com/api/v1/uat-configurations ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "name": "JWT - Employees", - "issuer": "[https://myidp.okta.com/app1](https://myidp.okta.com/app1)", - "publicKey": "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...", - "jwksUri": "[https://myidp.okta.com/oauth2/default/v1/keys](https://myidp.okta.com/oauth2/default/v1/keys)", - "usernameClaim": "string", - "resourceIds": [ - "123e4567-e89b-12d3-a456-426614174000", - "123e4567-e89b-12d3-a456-426614174002", - "123e4567-e89b-12d3-a456-426614174003" ], - "scopes": [ - "tableau:tcm_sites:read", - "tableau:tcm_sites:update", - "tableau:sites:read", - "tableau:sites:update" ], - "enabled": true }` ### Response samples - 201 - 400 - 500 Content type application/json Copy Expand all Collapse all `{ - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "configId": "46ff6d11-d8b2-40d8-9197-dfa33c61cd6c", - "name": "string", - "issuer": "string", - "publicKeyActive": "string", - "publicKey": "string", - "jwksUri": "string", - "usernameClaim": "string", - "resourceIds": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], - "scopes": [ - "tableau:tcm_sites:read", - "tableau:tcm_sites:update", - "tableau:sites:read", - "tableau:sites:update" ], - "enabled": true }` ## [](#tag/Authentication-Methods/operation/getUatConfigurations)List unified access token configurations Gets a list of all unified access token (UAT) configurations. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_configs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ### Responses **200** Success. **500** Internal error. get/api/v1/uat-configurations https://cloudmanager.tableau.com/api/v1/uat-configurations ### Response samples - 200 - 500 Content type application/json Copy Expand all Collapse all `{ - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "configId": "46ff6d11-d8b2-40d8-9197-dfa33c61cd6c", - "name": "string", - "issuer": "string", - "publicKeyActive": "string", - "publicKey": "string", - "jwksUri": "string", - "usernameClaim": "string", - "resourceIds": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], - "scopes": [ - "tableau:tcm_sites:read", - "tableau:tcm_sites:update", - "tableau:sites:read", - "tableau:sites:update" ], - "enabled": true }` ## [](#tag/Authentication-Methods/operation/deleteUatConfiguration)Delete unified access token configuration Deletes the specified unified access token (UAT) configuration. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_configs:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
configId
required
string <uuid>
Example: lafb0f7e-2962-40d5-bfc9-e95141bcb68f

The unique identifier of the unified access token (UAT) configuration. You can get the configId by calling the List unified access token configurations method.

### Responses **204** Success. **500** Internal error. delete/api/v1/uat-configurations/{configId} https://cloudmanager.tableau.com/api/v1/uat-configurations/{configId} ### Response samples - 204 - 500 Content type application/json Copy `{ }` ## [](#tag/Authentication-Methods/operation/getUatConfiguration)Get unified access token configuration Gets the specified unified access token (UAT) configuration. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_configs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
configId
required
string <uuid>
Example: lafb0f7e-2962-40d5-bfc9-e95141bcb68f

The unique identifier of the unified access token (UAT) configuration. You can get the configId by calling the List unified access token configurations method.

### Responses **200** Success. **404** Unified access token (UAT) configuration not found. **500** Internal error. get/api/v1/uat-configurations/{configId} https://cloudmanager.tableau.com/api/v1/uat-configurations/{configId} ### Response samples - 200 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "configId": "46ff6d11-d8b2-40d8-9197-dfa33c61cd6c", - "name": "string", - "issuer": "string", - "publicKeyActive": "string", - "publicKey": "string", - "jwksUri": "string", - "usernameClaim": "string", - "resourceIds": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], - "scopes": [ - "tableau:tcm_sites:read", - "tableau:tcm_sites:update", - "tableau:sites:read", - "tableau:sites:update" ], - "enabled": true }` ## [](#tag/Authentication-Methods/operation/updateUatConfiguration)Update unified access token configuration Updates the specified unified access token (UAT) configuration. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_configs:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
configId
required
string <uuid>
Example: lafb0f7e-2962-40d5-bfc9-e95141bcb68f

The unique identifier of the unified access token (UAT) configuration. You can get the configId by calling the List unified access token configurations method.

##### Request Body schema: application/json required
name
required
string

The name of the unified access token (UAT) configuration. UAT configuration name must be unique.

issuer
required
string

The issuer of the JSON Web Token (JWT).

publicKey
string

The public key used to verify the JSON Web Token (JWT). Use this value or jwksUri, but not both.

jwksUri
string

The URI of the JWKS endpoint. Use this value or publicKey, but not both.

usernameClaim
string

The username claim that maps to the Tableau username. Default value is email.

resourceIds
required
Array of strings <uuid> unique [ items <uuid > ]

The tenant ID, the tenant ID and site IDs associated with the tenant, or site IDs associated with the same tenant. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

scopes
Array of strings <scope> unique [ items <scope > ]

The access scopes defined in the JSON Web Token (JWT) associated with the unified access token (UAT) configuration. Scopes in the UAT are optional and allow you to further restrict the operations available to the JWT.

enabled
boolean

If true, the unified access token (UAT) configuration is enabled. Default value is true.

### Responses **200** Success. **400** Invalid request. **404** Unified access token (UAT) configuration not found. **500** Internal error. put/api/v1/uat-configurations/{configId} https://cloudmanager.tableau.com/api/v1/uat-configurations/{configId} ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "name": "JWT - Employees", - "issuer": "[https://myidp.okta.com/app1](https://myidp.okta.com/app1)", - "publicKey": "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...", - "jwksUri": "[https://myidp.okta.com/oauth2/default/v1/keys](https://myidp.okta.com/oauth2/default/v1/keys)", - "usernameClaim": "string", - "resourceIds": [ - "123e4567-e89b-12d3-a456-426614174000", - "123e4567-e89b-12d3-a456-426614174002", - "123e4567-e89b-12d3-a456-426614174003" ], - "scopes": [ - "tableau:tcm_sites:read", - "tableau:tcm_sites:update", - "tableau:sites:read", - "tableau:sites:update" ], - "enabled": true }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "configId": "46ff6d11-d8b2-40d8-9197-dfa33c61cd6c", - "name": "string", - "issuer": "string", - "publicKeyActive": "string", - "publicKey": "string", - "jwksUri": "string", - "usernameClaim": "string", - "resourceIds": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], - "scopes": [ - "tableau:tcm_sites:read", - "tableau:tcm_sites:update", - "tableau:sites:read", - "tableau:sites:update" ], - "enabled": true }` ## [](#tag/Authentication-Methods/operation/jwtLogin)Sign in with unified access token JWT Signs in to Tableau Cloud Manager (TCM) REST API using a JSON Web Token (JWT). You must have a unified access token (UAT) configuration associated with the JWT to successfully sign in to the TCM REST API using this method. To generate a UAT, you can call the [Create unified access token configuration](#tag/Authentication-Methods/operation/createJwtConfiguration) method. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not available. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Request Body schema: application/json required
token
required
string

The JSON Web Token (JWT) associated with a unified access token (UAT) configuration. Ensure you have first configured and generated a UAT by calling the Create unified access token configuration method.

### Responses **200** Success. **400** Invalid request. **401** User not authorized. **403** JSON Web Token (JWT) not valid. **404** Unified access token (UAT) configuration not found. **500** Internal error. post/api/v1/jwt/login https://cloudmanager.tableau.com/api/v1/jwt/login ### Request samples - Payload Content type application/json Copy `{ - "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" }` ### Response samples - 200 - 400 - 401 - 403 - 404 - 500 Content type application/json Copy `{ - "sessionToken": "bSG+6ttrRgqMLzonp5j89w==:SUOF-rjwMZZKXg-T3GcpDVFrIKAO6VIbTyZyq39bWR0", - "userId": "123e4567-e89b-12d3-a456-426614174000", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "sessionExpiration": "2019-08-24T14:15:22Z" }` ## [](#tag/Authentication-Methods/operation/revokeSessionId)Sign out Signs out of Tableau Cloud Manager (TCM) REST API. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager V2, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not required. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ### Responses **200** Success. **401** User not authorized to revoke session and sign out. **404** Session not found. **500** Internal error. delete/api/v2/sessions https://cloudmanager.tableau.com/api/v2/sessions ### Response samples - 401 - 404 - 500 Content type application/json Copy `{ - "message": "string", - "reason": "string", - "errorCode": "string" }` ## [](#tag/Authentication-Methods/operation/createUatRevocationRecords)Revoke unified access token JWT Revokes the JSON Web token (JWT) associated with a unified access token (UAT) configuration by generating a revocation record. The revoked JWT can't be used to sign in to Tableau Cloud Manager (TCM) REST API or Tableau REST API. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_revocations:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### Request Body schema: application/json required Array
jti
required
string

The JWT ID of the JSON Web Token (JWT) associated with the unified access token (UAT) configuration.

exp
required
integer <int64>

The expiration timestamp of the JSON Web Token (JWT) in seconds from Epoch (Unix epoch time).

### Responses **201** Success. **400** Invalid request. **500** Internal error. post/api/v1/uat-revocations https://cloudmanager.tableau.com/api/v1/uat-revocations ### Request samples - Payload Content type application/json Copy Expand all Collapse all `[ - { - "jti": "[https://myidp.okta.com:17568488555555](https://myidp.okta.com:17568488555555)", - "exp": 1788384000 } ]` ### Response samples - 201 - 400 - 500 Content type application/json Copy Expand all Collapse all `[ - { - "jti": "[https://myidp.okta.com:17568488555555](https://myidp.okta.com:17568488555555)", - "exp": 1788384000 } ]` ## [](#tag/Authentication-Methods/operation/deleteRevocationRecord)Delete revoked unified access token JWT Deletes the record of a revoked unified access token (UAT) JSON Web Token (JWT). > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_revocations:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### query Parameters
jti
string

The JWT ID of the JSON Web Token (JWT) associated with the unified access token (UAT) configuration. You can get the jti from the revoked unified access token (UAT) JSON Web Token (JWT) record by calling the List revoked unified access token JWTs method.

### Responses **204** Success. **500** Internal error. delete/api/v1/uat-revocations https://cloudmanager.tableau.com/api/v1/uat-revocations ### Response samples - 204 - 500 Content type application/json Copy `{ }` ## [](#tag/Authentication-Methods/operation/getUatRevocationRecords)List revoked unified access token JWTs Gets a list of records for all revoked unified access token (UAT) JSON Web Tokens (JWTs). > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_uat_revocations:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### query Parameters
jti
string

The JWT ID of the JSON Web Token (JWT) associated with the unified access token (UAT) configuration. You can get the jti from the revoked unified access token (UAT) JSON Web Token (JWT) record by calling the List revoked unified access token JWTs method.

pageToken
string
Example: pageToken=fDIwMjQtMDktMDlUMDU6MDA=

The token to provide to request the next page of records.

pageSize
integer <int32>
Default: 100

The maximum number of records on a page. Default is 100 records.

### Responses **200** Success. **500** Internal error. get/api/v1/uat-revocations https://cloudmanager.tableau.com/api/v1/uat-revocations ### Response samples - 200 - 500 Content type application/json Copy `{ - "records": "97df110-f4de-492e-8849-4a6af68026b0:https://myidp.okta.com:17568488555555", - "pageToken": "fDIwMjQtMDktMDlUMDU6MDA=" }` # [](#tag/Capacity-Methods)Capacity Methods Capacity management is a collection of capabilities available to you from the **Capacities** page in Tableau Cloud Manager (TCM). These capabilities enable you to view and manage capacity across the sites on the tenant. Starting in May 2026, you can manage the following capacities in TCM: - Subscription concurrency - Extract APIs - Flow concurrency - Publish APIs - VizQL Data Service (VDS) APIs Starting in July 2026, you can manage the following capacities in TCM if Tableau Cloud is licensed with the capacity-based model: - Visualizations - Pulse digests For more information, see one of the following topics in the Tableau Cloud Help: - [Capacity Managed in Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_capacity.htm) for capacities configurable in TCM - [Capacity Set at the Site](https://help.tableau.com/current/online/en-us/cloud_manager_capacity_site.htm) for capacities that remain fixed at the site level and not configurable in TCM - [Capacity-based license model](https://help.tableau.com/current/online/en-us/license_product_keys.htm#capacity) for information about capacity-based license model **Postman:** [Capacity Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/t1dwlo3/tableau-apis?action=share&creator=0) ## [](#tag/Capacity-Methods/operation/getPaginatedMetricsForTenant)List capacity metrics for tenant Gets a list of capacity metrics data for all sites on the tenant. > Version: Available in Tableau Cloud Manager v1, May 2026, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenant_metrics:read`. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). To use this method, you must specify how much capacity metrics data you want to return. Use the `window` parameter to specify the number of days (1 or 2 days) before the `endTime`parameter to include in the request. Use the `pageSize` parameter to limit the number of sites returned per page (up to 50 sites). **Example** For example, the following request returns the last two days of capacity metrics data, April 1-3, 2026, across 50 sites on the tenant. ``` curl -X GET "http://mytenant.cloudmanager.tableau.com/api/v1/tenants/123e4567-e89b-12d3-a456-426614174000/metrics?endTime=2026-04-03T23:59:59.000Z&window=2&pageSize=50" -H "accept: application/json" ``` ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

##### query Parameters
endTime
string
Example: endTime=2026-10-18T23:56:20.145Z

The end date and time in UTC.

window
string

The number of days before endTime. Value must be 1 or 2 days. If endTime is not specified, the window is calculated from the current date and time.

aggregationType
string
Enum: "peak" "average" "median" "all"
Example: aggregationType=median

The aggregation type of the capacity metric:peak, average, median,or all.

pageSize
string
Example: pageSize=20

The maximum number of sites returned on a page. Value must be less than or equal to (<=) 50 sites.

pageToken
string
Example: pageToken=fDIwMjQtMDktMDlUMDU6MDA=

The token string used to request the next page of results. If not specified, the first page is returned.

### Responses **200** Success. **202** Partial success. Some sites returned capacity metrics; some sites failed to return capacity metrics. **400** Invalid request. **404** The specified tenant could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/metrics https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/metrics ### Response samples - 200 - 202 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "nextPageToken": "123e4567-e89b-12d3-a456-426614174000", - "sites": [ - { - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "startTime": "2019-08-24T14:15:22Z", - "endTime": "2019-08-24T14:15:22Z", - "metrics": [ - { - "metricType": "backgrounder_refresh_concurrency_limit", - "aggregations": { - "peak": { - "property1": 0.1, - "property2": 0.1 }, - "median": { - "property1": 0.1, - "property2": 0.1 }, - "average": { - "property1": 0.1, - "property2": 0.1 } } } ] } ] }` ## [](#tag/Capacity-Methods/operation/getScrolledMetricsForSite)List capacity metrics for sites Gets a list of capacity metrics data for the specified sites on the tenant. > Version: Available in Tableau Cloud Manager v1, May 2026, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_site_metrics:read`. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). To use this method, you must specify how much capacity metrics data you want to return. Use the required `window` parameter to specify the number of days (1 or 2 days) before the optional `endTime` to include in the request. **Example** For example, the following request returns the last two days of capacity metrics data, April 1-3, 2026, for two sites on the tenant. ``` curl -X POST "https://mytenant.cloudmanager.tableau.com/api/v1/tenants/123e4567-e89b-12d3-a456-426614174000/metrics?endTime=2026-04-03T23:59:59.000Z&window=2" -H "Content-Type: application/json" -d '{"siteIds": ["1489a6a4-89a8-4d17-9180-64c34dd07b86", "2589b7b5-90b9-5e28-0291-75d45ee18c97"]}' ``` ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

##### query Parameters
endTime
string
Example: endTime=2026-10-18T23:56:20.145Z

The end date and time in UTC.

window
string

The number of days before endTime. Value must be 1 or 2 days. If endTime is not specified, the window is calculated from the current date and time.

aggregationType
string
Example: aggregationType=median

The aggregation type of the capacity metric:peak, average, median, or all.

##### Request Body schema: application/json required
siteIds
Array of strings <uuid> [ items <uuid > ]

The unique identifiers of the sites.

### Responses **200** Success. **202** Partial success. Some sites returned capacity metrics; some sites failed to return capacity metrics. **400** Invalid request. **404** The specified tenant or site could not be found. **500** Internal error. post/api/v1/tenants/{tenantId}/metrics https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/metrics ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "siteIds": [ - "123e4567-e89b-12d3-a456-426614174000", - "123e4567-e89b-12d3-a456-426614174001" ] }` ### Response samples - 200 - 202 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "nextPageToken": "123e4567-e89b-12d3-a456-426614174000", - "sites": [ - { - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "startTime": "2019-08-24T14:15:22Z", - "endTime": "2019-08-24T14:15:22Z", - "metrics": [ - { - "metricType": "backgrounder_refresh_concurrency_limit", - "aggregations": { - "peak": { - "property1": 0.1, - "property2": 0.1 }, - "median": { - "property1": 0.1, - "property2": 0.1 }, - "average": { - "property1": 0.1, - "property2": 0.1 } } } ] } ] }` ## [](#tag/Capacity-Methods/operation/getMetricsForSite)Get capacity metrics for site Gets the capacity metrics data for the specified site. > Version: Available in Tableau Cloud Manager v1, May 2026, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_site_metrics:read`. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

siteId
required
string
Example: 1489a6a4-89a8-4d17-9180-64c34dd07b86

The unique identifier of the site. To get the site ID, call the List sites for tenant method.

##### query Parameters
endTime
string
Example: endTime=2026-01-05T23:56:20.145Z

The end date and time in UTC.

window
string

The number of days before endTime. Value must be 1 or 2 days. If endTime is not specified, the window is calculated from the current date and time.

aggregationType
string
Enum: "peak" "average" "median" "all"
Example: aggregationType=median

The aggregation type of the capacity metric:peak, average, median, or all.

### Responses **200** Success. **400** Invalid request. **404** The specified tenant or site could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/sites/{siteId}/metrics https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/metrics ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "startTime": "2019-08-24T14:15:22Z", - "endTime": "2019-08-24T14:15:22Z", - "metrics": [ - { - "metricType": "backgrounder_refresh_concurrency_limit", - "aggregations": { - "peak": { - "property1": 0.1, - "property2": 0.1 }, - "median": { - "property1": 0.1, - "property2": 0.1 }, - "average": { - "property1": 0.1, - "property2": 0.1 } } } ] }` ## [](#tag/Capacity-Methods/operation/getCapacities)List capacities Gets a list of capacity information for all active sites on the tenant. > Version: Available in Tableau Cloud Manager v1, May 2026, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_capacities:read`. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

### Responses **200** Success. **404** The specified tenant could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/capacities https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/capacities ### Response samples - 200 - 404 - 500 Content type application/json Copy `{ - "resultCode": "Success", - "timestamp": "2026-04-01T10:30Z", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "capacities": "[{capacityName=backgrounder_subscription_concurrency_limit.tenant, cloudLimit=6000, defaultSiteLimit=150, minSiteLimit=25, maxSiteLimit=1200, unit=jobs, sites=[{siteLuid=123e4567-e89b-12d3-a456-426614174000, limit=300}, {siteLuid=55555567-e89b-12d3-a456-426614174000, limit=600}]}, {capacityName=api.rest.refresh_extracts.tenant, cloudLimit=15360, defaultSiteLimit=1024, minSiteLimit=128, maxSiteLimit=3072, unit=calls, sites=[{siteLuid=123e4567-e89b-12d3-a456-426614174000, limit=1536}, {siteLuid=55555567-e89b-12d3-a456-426614174000, limit=2048}]}]" }` ## [](#tag/Capacity-Methods/operation/updateCapacities)Update capacities Updates the following capacity limits: - **Cloud limits:** Maximum capacity available to the active sites on the tenant. - **Default site limits:** Default capacity allocated to all new and existing active sites whose capacities have not been customized. For more information, see [Capacity Managed in Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_capacity.htm) in the Tableau Cloud Help. **Troubleshoot errors** When updating capacities, you might encounter the following 207 or 400 errors: - `errorCode: "POLICY_STORE_INVALID_SITE_LIMIT"`, `message: "Site limit for is below minimum "` - `errorCode: "POLICY_STORE_SITES_LIMIT_OVERFLOW"`, `message: "Total site limits () exceeds cloud limit () for capacity: "` - `errorCode: "VALIDATION_ERROR"`, `message: "The following site IDs are suspended and cannot be updated: , , ..."` To help resolve these errors, see [Update capacity API errors](https://help.tableau.com/current/online/en-us/cloud_manager_capacity_errors.htm#troubleshoot_api_update_capacitites) in the Tableau Cloud Help. > Version: Available in Tableau Cloud Manager v1, May 2026, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_capacities:update`. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

##### Request Body schema: application/json required
required
Array of objects (CapacityPolicyUpdate) [ 1 .. 2147483647 ] items

List of capacity limits to update.

### Responses **200** Success. **207** Partial success. Some capacity updates were successful; some capacity updates failed. **400** Invalid request. **404** The specified tenant could not be found. **500** Internal error. patch/api/v1/tenants/{tenantId}/capacities https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/capacities ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "capacities": [ - { - "capacityName": "backgrounder_refresh_concurrency_limit.tenant", - "defaultSiteLimit": 0, - "sites": [ - { - "siteLuid": "123e4567-e89b-12d3-a456-426614174000", - "limit": 10 } ] } ] }` ### Response samples - 200 - 207 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "resultCode": "Success", - "timestamp": "string", - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "summary": { - "totalUpdated": 2 }, - "succeeded": [ - { - "capacityName": "backgrounder_refresh_concurrency_limit.tenant", - "cloudLimit": 0, - "defaultSiteLimit": 0, - "minSiteLimit": 0, - "maxSiteLimit": 0, - "unit": "calls", - "sites": [ - { - "siteLuid": "123e4567-e89b-12d3-a456-426614174000", - "limit": 10 } ] } ], - "failed": [ - { - "errorCode": "NOT_FOUND", - "errorMessage": "Invalid request parameters", - "timestamp": "2026-04-01T10:30:00Z", - "capacityName": "backgrounder_refresh_concurrency_limit.tenant" } ] }` # [](#tag/Platform-Data-Methods)Platform Data Methods Tableau Cloud Manager REST API Platform Data methods allow cloud administrators to manage event data (activity logs) for the tenant or site in the following ways: - Get event logs for tenant. - List event logs for tenant. - Get event logs for site. - List event logs for site. - Get entity snapshots for site. - List entity snapshots for site. Platform data methods provide a central, unified way to retrieve event data from your Tableau Cloud deployment. For example, see who signed in to TCM to create a new site, see who made permission changes to their workbook, and monitor extract refreshes. You can use these methods to download data to store, integrate, and analyze using your preferred tools. For more information about the Platform data methods and an example workflow, see [Platform Data API](https://help.tableau.com/current/api/cloud-manager/en-us/docs/platform_data.html). **Postman:** [Platform Data Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/12721794-25e429a5-01a8-4028-a526-ff13d7e8ad01) **API request limits** To ensure optimal performance while supporting more usage data, Tableau uses API request limits for event log and entity snapshot methods. These limits are designed to exceed the needs of both typical and special use cases such as daily downloads or bulk historical event retrievals. API requests to the platform data methods have the following limits: - 100 calls per minute for tenant logs - 100 calls per minute for each site's logs The API request limits apply only to `GET` and `POST` calls to the `/activitylog` or `/snapshots` endpoints and don't include calls to sign in (`/pat/login` or `/jwt/login`) endpoints or when retrieving log files from the download URLs. ## [](#tag/Platform-Data-Methods/operation/getActivityLogForTenant)Get activity logs for tenant Gets the download URLs for tenant event logs. Use [List activity logs for tenant](#tag/Administrative-Methods/operation/getActivityLogFileListForTenant) to find the log file paths you provide. Without an additional license, activity generally takes 2 hours to become available in logs. For more information see, [Activity Log](https://help.tableau.com/current/online/en-us/activity_log_overview.htm) in the Tableau Cloud Help. The response for each event log URL includes the following: - `expiresAt` which shows the length of time after the response that a returned URL will remain valid - `eTag` that is an [MD5 hash](https://en.wikipedia.org/wiki/MD5) of the event log content that can be used for tamper proofing and other verification needs > Version: Available in Tableau Cloud Manager v1, January 2025, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenants_logs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

##### Request Body schema: application/json required
files
required
Array of strings

Event log or entity snapshot file paths. You can get the event log file paths for the tenant by calling the List activity logs for tenant method or for the site by calling the List activity logs for site method. You can get the entity snapshot file paths for the site by calling the List entity snapshots for site method.

### Responses **200** Success. **400** Invalid request. **404** The tenant could not be found. **500** Internal error. post/api/v1/tenants/{tenantId}/activitylog https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "files": [ - "string" ] }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "files": [ - { - "path": "string", - "url": "string", - "expiresAt": "2019-08-24T14:15:22Z", - "etag": "string" } ] }` ## [](#tag/Platform-Data-Methods/operation/getActivityLogFileListForTenant)List activity logs for tenant Gets a list of file paths to the tenant's event logs for the specified time period and event type. Use the returned paths from this method in a request to the [Get activity logs for tenant](#tag/Administrative-Methods/operation/getActivityLogForTenant) method to download the event logs. **About event log timestamps** Event log timestamps generally represent when the record for a particular event became available, which might be later than when the event occurred. To avoid missing any relevant event logs data, consider expanding your query's time range to account for the potential differences. > Version: Available in Tableau Cloud Manager v1, January 2025, and later. > Permissions: Only cloud administrators can call this method. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenants_logs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

##### query Parameters
startTime
string <date-time>
Example: startTime=2025-01-01T00:00:00

The start time in UTC (ISO-8601) of the returned event log records. Default is 24 hours prior to the time of the request.

endTime
string <date-time>
Example: endTime=2025-01-01T00:00:00

The end time in UTC (ISO-8601) of the returned event log records. Default is the time of the request. The endTime must not exceed 7 days from the startTime. The request will fail if your end time exceeds that.

eventType
string
Example: eventType=update_user_site_role

The type of event to filter returned event logs by. Default value is all types. Refer to Activity Log Tenant Event Type Reference in the Tableau Cloud Help for a list of available event types to filter on.

pageSize
integer <int32>
Example: pageSize=100

The number of log file paths to return in a response. Default is 100.

pageToken
string
Example: pageToken=fDIwMjQtMDktMDlUMDU6MDA=

The token to request the next page of file paths.

### Responses **200** Success. **400** Invalid request. **404** The tenant specified could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/activitylog https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/activitylog ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "files": [ - { - "path": "string", - "size": 0 } ], - "pageToken": "string" }` ## [](#tag/Platform-Data-Methods/operation/getActivityLogForSite)Get activity logs for site Gets download URLs for event log files for the site. The response returns file paths. File paths include: `expiresAt` which shows the length of time after the response that the returned URL will remain valid; and an `eTag` that is an [MD5 hash](https://en.wikipedia.org/wiki/MD5) of the log content that can be used for tamper proofing and other verification needs. For more information about site activity captured by event logs, see [Activity Log Site Events](https://help.tableau.com/current/online/en-us/activity_log_overview.htm#site-events) in the Tableau Cloud Help. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, October 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites_logs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

siteId
required
string
Example: 567f1234-e89b-71e5-a456-428814174111

The unique identifier of the site.

##### Request Body schema: application/json required
files
required
Array of strings

Event log or entity snapshot file paths. You can get the event log file paths for the tenant by calling the List activity logs for tenant method or for the site by calling the List activity logs for site method. You can get the entity snapshot file paths for the site by calling the List entity snapshots for site method.

### Responses **200** Success. **400** Invalid request. **404** Tenant or site not found. **500** Internal error. post/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "files": [ - "string" ] }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "files": [ - { - "path": "string", - "url": "string", - "expiresAt": "2019-08-24T14:15:22Z", - "etag": "string" } ] }` ## [](#tag/Platform-Data-Methods/operation/getSiteActivityLogListForSite)List activity logs for site Gets a list of event log files for the site. The response returns a list of file paths to entity snapshot files. Use the returned paths in a request with the [Get activity logs for site](#tag/Platform-Data-Methods/operation/getActivityLogForSite) method to download the event logs. **About event log timestamps** Event log timestamps generally show when the record for a particular event became available, which might be later than when the event occurred. To avoid missing any relevant event logs data, consider expanding your query's time range to account for the potential differences. **Known issues** - **Unexpected log data for us-east-1 and us-west-2 regions:** For Tableau Cloud sites in pods located in the **us-east-1** and **us-west-2** regions, log data returned from this query might be incomplete or contain data for a time period that is different from what is expected. For more information, see the [Log files returned by the Platform Data API from the Tableau Cloud Manger "List Activity Logs for Site" Method Return Unexpected Results](https://help.salesforce.com/s/issue?id=a02Ka00000ildTn) knowledge article. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, October 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites_logs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

siteId
required
string
Example: 567f1234-e89b-71e5-a456-428814174111

The unique identifier of the site.

##### query Parameters
startTime
string <date-time>
Example: startTime=2025-01-01T00:00:00

The start time in UTC (ISO-8601) of the returned event log records. Default value is 24 hours prior to the time of the request.

endTime
string <date-time>
Example: endTime=2025-01-01T00:00:00

The end time in UTC (ISO-8601) of the returned event log records. Default value is the time of the request.

eventType
string
Example: eventType=hist_access_view

The type of event to filter returned logs by. Default value is all types. Refer to Activity Log Site Event Type Reference in the Tableau Cloud Help for a list of available event types to filter on.

pageSize
integer <int32>
Example: pageSize=100

The number of event log files to return in the response. Default value is 100.

pageToken
string
Example: pageToken=fDIwMjQtMDktMDlUMDU6MDA=

The token to request the next page of event log files.

### Responses **200** Success. **400** Invalid request. **404** Tenant or site not found. **500** Internal error. get/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/activitylog ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "files": [ - { - "path": "string", - "size": 0 } ], - "pageToken": "string" }` ## [](#tag/Platform-Data-Methods/operation/getEntitySnapshotForSite)Get entity snapshots for site Gets download URLs for entity snapshot files for the site. The response returns files paths and URLs. Files are in Parquet format and paths are partitioned by tenant ID, site ID, date range, and entity type. For more information about entity snapshots, see [Use Entity Snapshots](https://help.tableau.com/current/online/en-us/activity_log_entity_snapshots.htm) and [Entity Snapshots Reference](https://help.tableau.com/current/online/en-us/activity_log_entity_snapshots_reference.htm) in the Tableau Cloud Help. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, July 2026, and later. > License: Enterprise or Tableau+ is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not available. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### path Parameters
tenantId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

siteId
required
string <uuid>
Example: 567f1234-e89b-71e5-a456-428814174111

The unique identifier of the site.

##### Request Body schema: application/json required
files
required
Array of strings

Event log or entity snapshot file paths. You can get the event log file paths for the tenant by calling the List activity logs for tenant method or for the site by calling the List activity logs for site method. You can get the entity snapshot file paths for the site by calling the List entity snapshots for site method.

### Responses **200** Success. **400** Invalid request. Request body is missing the `files` parameter. **404** Tenant or site not found. **500** Internal error. post/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "files": [ - "string" ] }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "files": [ - { - "path": "string", - "url": "string", - "expiresAt": "2019-08-24T14:15:22Z", - "etag": "string" } ] }` ## [](#tag/Platform-Data-Methods/operation/getSiteEntitySnapshotListForSite)List entity snapshots for site Gets a list of entity snapshot files for the site. The response returns a list of file paths to entity snapshot files for the specified time period and entity type. Use the returned paths in a request with the [Get entity snapshot for site](#tag/Platform-Data-Methods/operation/getEntitySnapshotForSite) method to download the entity snapshots. **About entity snapshots** Entity snapshots provide site-level observability into Tableau Cloud content and components, like workbooks, data sources, published connections, users, groups and more. You can use entity snapshots to answer questions about what currently exists on your site, paired with event logs, which describe what's happening on your site. **About entity snapshot timestamps** Entity snapshot timestamps generally show when the record for a particular entity became available, which might be later than when the entity snapshot occurred. To avoid missing any relevant entity snapshot data, consider expanding your query's time range to account for the potential differences. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, July 2026, and later. > License: Enterprise or Tableau+ is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: Not available. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### path Parameters
tenantId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

siteId
required
string <uuid>
Example: 567f1234-e89b-71e5-a456-428814174111

The unique identifier of the site.

##### query Parameters
startTime
string <date-time>
Example: startTime=2026-10-27T00:00:00

The start time in UTC (ISO-8601) of the returned entity snapshot records. Default value is 24 hours prior to the time of the request. Value must not exceed 14 days in the past. The request will fail if the startTime exceeds that.

endTime
string <date-time>
Example: endTime=2026-10-28T00:00:00

The end time in UTC (ISO-8601) of the returned entity snapshot records. Default value is the time of the request. The endTime must not exceed 7 days from startTime. The request will fail if the endTime exceeds that.

entityType
string
Example: entityType=view

The type of entity to filter snapshots by. Default value is all types. Refer to Entity Snapshots Reference in the Tableau Cloud Help for a list of available entity types to filter on.

pageSize
any
Example: pageSize=100

The number of entity snapshot files to return in the response.

pageToken
string
Example: pageToken=fDIwMjQtMDktMDlUMDU6MDA=

The token to provide in order to request the next page of entity snapshot files.

### Responses **200** Success. **400** Invalid request. Date range is not valid, `endTime` exceeds 7 days from `startTime`, or `startTime` exceeds 14 days in the past. **404** Tenant or site not found. **500** Internal error. get/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/snapshots ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "files": [ - { - "path": "string", - "size": 0 } ], - "pageToken": "string" }` # [](#tag/Single-Sign-on-Methods)Single Sign-on Methods Tableau Cloud Manager REST API Single Sign-on methods allow cloud administrators to: - Get a list of authentication configurations for the specified tenants, sites, or users. - Create or update a Google, OpenID Connect (OIDC), Salesforce, or Security Assertion Markup Language (SAML) authentication configuration for the specified resource ID. - Delete a Google, OIDC, Salesforce, or SAML authentication configuration for the specified resource ID. - Get the Google, OIDC, Salesforce, or SAML configuration for the specified resource ID. - Get the SAML logs for the specified resource ID. For more information, see [TCM REST API Authentication](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html#set-up-tcm-authentication-for-users). **Postman:** [Single Sign-on Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/ofwwode/single-sign-on-methods) ## [](#tag/Single-Sign-on-Methods/operation/createSamlConfiguration)Create SAML configuration Creates a new SAML configuration for Tableau Cloud Manager (TCM) authentication or Tableau Cloud site authentication using the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_saml_configs:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ### About configuring SAML authentication for TCM To configure SAML authentication for TCM, make sure to include the attributes and assertions in your request to correctly map user account attributes from the IdP to TCM. The following attributes are required when configuring SAML authentication for TCM: - `entityDescriptor` or `idpMetadataUrl` is specified **Note:** If both attributes are passed, the `entityDescriptor` attribute will take precedence. - `emailMapping` is specified **Example** ``` curl -X POST "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration" -H "accept: application/json" -D '{ "enabled": true, "idpMetadataUrl": "https://myidp.okta.com/app/123456789/sso/saml/metadata", "attributeMapping": { "emailMapping": "NameID", "firstNameMapping": "FirstName", "lastNameMapping": "LastName", "emailAddressMapping": "Email" } }' ``` ### About configuring SAML authentication for Tableau Cloud sites To configure SAML authentication for a site, make sure to include the attributes and assertions in your request to correctly map user account attributes from the IdP to the site. The following attributes are required when configuring SAML authentication for Tableau Cloud sites: - `enabled` is `true` - `entityDescriptor` or `idpMetadataUrl` is specified **Note:** If both attributes are passed, the `entityDescriptor` attribute will take precedence. - `idpConfigurationName` is specified - `emailMapping` is specified **Example** ``` curl -X POST "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration" -H "accept: application/json" -D '{ "enabled": true, "entityDescriptor": "https://myidp.okta.com/app/123456789/sso/saml/metadata", idpConfigurationName: "SAML - Contractors", allowEmbeddedAuthentication: false, "attributeMapping": { "emailMapping": "NameID", "firstNameMapping": "FirstName", "lastNameMapping": "LastName", "emailAddressMapping": "Email" } }' ``` ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

ID of the tenant or site whose SAML configuration is being created. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

##### Request Body schema: application/json required
enabled
boolean

If true, the authentication configuration is enabled. Default value is true.

entityDescriptor
string

IdP's metadata (.xml) file. Specify this value or idpMetadataUrl, but not both.

allowEmbeddedAuthentication
boolean

(Site-specific) How users authenticate to the Tableau Cloud site when accessing embedded views. If false, users authenticate in a separate pop-up window. If true, users authenticate using an inline frame (IFrame), which is less secure. Default value is false.

idpConfigurationName
string

(Site-specific) Name of the authentication configuration.

idpConfigurationId
string

(Site-specific) ID of the authentication configuration. Do not pass this attribute if you are creating a new authentication configuration.

idpMetadataUrl
string

URL endpoint of the IdP's metadata. Specify this value or entityDescriptor, but not both.

object (SiteAttributeMapping)
### Responses **201** Success. **400** Invalid request. **409** SAML configuration already exists for the specified resource ID. **500** Internal error. post/api/v1/resources/{resourceId}/samlconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "entityDescriptor": "string", - "allowEmbeddedAuthentication": false, - "idpConfigurationName": "SAML - Contractors", - "idpConfigurationId": "b2207590-024c-4a6e-ac4a-eca6eefabb2e", - "idpMetadataUrl": "[https://myidp.okta.com/app/123456789/sso/saml/metadata](https://myidp.okta.com/app/123456789/sso/saml/metadata)", - "attributeMapping": { - "emailMapping": "NameID", - "firstNameMapping": "FirstName", - "lastNameMapping": "LastName", - "fullNameMapping": "FullName", - "useFullName": false, - "emailAddressMapping": "Email" } }` ### Response samples - 201 - 400 - 409 - 500 Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "serviceProviderEntityId": "string", - "authenticationTypeForEmbedded": "DEFAULT", - "idpCertificates": [ - "string" ], - "certificateUrl": "string", - "testLoginUrl": "string", - "ssoServiceURL": "string", - "acsUrl": "string", - "entityDescriptorValidationResult": { - "validationMessages": [ - { - "message": "string", - "kind": "GENERIC" } ], - "identityProviderEntityId": "string", - "authenticatedBy": "string" } }` ## [](#tag/Single-Sign-on-Methods/operation/deleteSAMLConfiguration)Delete SAML configuration Deletes the SAML configuration for the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_saml_configs:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). To delete a SAML configuration on a site, specify the `idpConfigurationName` or `idpConfigurationId` query parameter. **Examples** ``` curl -X DELETE "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration?idpConfigurationName={idpConfigurationName}" ``` ``` curl -X DELETE "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration?idpConfigurationId={idpConfigurationId}" ``` ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-4266141740000

The ID of the tenant or site whose SAML configuration is being deleted. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

##### query Parameters
idpConfigurationName
string

(Site-specific) Name of the site-level authentication configuration. You can get the idpConfigurationName by calling the List authentication configurations method.

idpConfigurationId
string

(Site-specific) ID of the site-level authentication configuration. You can get the idpConfigurationId by calling the List authentication configurations method.

### Responses **200** Success. **500** Internal error. delete/api/v1/resources/{resourceId}/samlconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration ### Response samples - 200 - 500 Content type application/json Copy `"string"` ## [](#tag/Single-Sign-on-Methods/operation/getSAMLConfiguration)Get SAML configuration Gets the SAML configuration for the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_saml_configs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). To get a specific SAML authentication configuration on a site, specify the `idpConfigurationName` or `idpConfigurationId` query parameter. **Examples** ``` curl -X GET "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration?idpConfigurationName={idpConfigurationName}. ``` ``` curl -X GET "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration?idpConfigurationId={idpConfigurationId}. ``` ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

The ID of the tenant or site whose SAML configuration is being retrieved. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

##### query Parameters
idpConfigurationName
string

(Site-specific) Name of the site-level authentication configuration. You can get the idpConfigurationName by calling the List authentication configurations method.

idpConfigurationId
string

(Site-specific) ID of the site-level authentication configuration. You can get the idpConfigurationId by calling the List authentication configurations method.

### Responses **200** Success. **404** SAML configuration could not be found. **500** Internal error. get/api/v1/resources/{resourceId}/samlconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration ### Response samples - 200 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "serviceProviderEntityId": "string", - "authenticationTypeForEmbedded": "DEFAULT", - "idpCertificates": [ - "string" ], - "certificateUrl": "string", - "testLoginUrl": "string", - "ssoServiceURL": "string", - "acsUrl": "string", - "entityDescriptorValidationResult": { - "validationMessages": [ - { - "message": "string", - "kind": "GENERIC" } ], - "identityProviderEntityId": "string", - "authenticatedBy": "string" } }` ## [](#tag/Single-Sign-on-Methods/operation/updateSamlConfiguration)Update SAML configuration Updates a SAML configuration for the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: Tableau Cloud Manager license required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_saml_configs:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string <uuid>
Example: 123e4567-e89b-12d3-a456-426614174000

The ID of the tenant or site whose SAML configuration is being updated. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

##### Request Body schema: application/json required
enabled
boolean

If true, the authentication configuration is enabled. Default value is true.

entityDescriptor
string

IdP's metadata (.xml) file. Specify this value or idpMetadataUrl, but not both.

allowEmbeddedAuthentication
boolean

(Site-specific) How users authenticate to the Tableau Cloud site when accessing embedded views. If false, users authenticate in a separate pop-up window. If true, users authenticate using an inline frame (IFrame), which is less secure. Default value is false.

idpConfigurationName
string

(Site-specific) Name of the authentication configuration.

idpConfigurationId
string

(Site-specific) ID of the authentication configuration. Do not pass this attribute if you are creating a new authentication configuration.

idpMetadataUrl
string

URL endpoint of the IdP's metadata. Specify this value or entityDescriptor, but not both.

object (SiteAttributeMapping)
### Responses **200** Success. **400** Invalid request. **404** SAML configuration could not be found. **500** Internal error. put/api/v1/resources/{resourceId}/samlconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "entityDescriptor": "string", - "allowEmbeddedAuthentication": false, - "idpConfigurationName": "SAML - Contractors", - "idpConfigurationId": "b2207590-024c-4a6e-ac4a-eca6eefabb2e", - "idpMetadataUrl": "[https://myidp.okta.com/app/123456789/sso/saml/metadata](https://myidp.okta.com/app/123456789/sso/saml/metadata)", - "attributeMapping": { - "emailMapping": "NameID", - "firstNameMapping": "FirstName", - "lastNameMapping": "LastName", - "fullNameMapping": "FullName", - "useFullName": false, - "emailAddressMapping": "Email" } }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "serviceProviderEntityId": "string", - "authenticationTypeForEmbedded": "DEFAULT", - "idpCertificates": [ - "string" ], - "certificateUrl": "string", - "testLoginUrl": "string", - "ssoServiceURL": "string", - "acsUrl": "string", - "entityDescriptorValidationResult": { - "validationMessages": [ - { - "message": "string", - "kind": "GENERIC" } ], - "identityProviderEntityId": "string", - "authenticatedBy": "string" } }` ## [](#tag/Single-Sign-on-Methods/operation/getResourceAuthConfiguration)List authentication configurations Gets list of authentication configurations for the specified resource IDs. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_auth_configs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### Request Body schema: application/json required
resourceIds
required
Array of strings

A comma separated list of IDs of a single tenant, multiple site IDs within a tenant and that tenant ID, or multiple sites within the same tenant with no tenant ID. You can get a tenant ID or site ID by calling the Get tenant or List tenant sites method.

Important: Providing multiple tenant IDs or site IDs that belong to different tenants can produce unexpected results.

requireMultipleIDPs
boolean

(Site-specific) If true, returns the authentication configurations when the capability for multiple authentication methods is enabled.

### Responses **200** Success. **400** Invalid request. **404** The specified tenant or site could not be found. **500** Internal error. post/api/v1/resources/authconfiguration https://cloudmanager.tableau.com/api/v1/resources/authconfiguration ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "resourceIds": [ - "123e4567-e89b-12d3-a456-426614174000", - "123e4567-e89b-12d3-a456-426614174002", - "123e4567-e89b-12d3-a456-426614174003" ], - "requireMultipleIDPs": true }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `[ - { - "resourceId": "123e4567-e89b-12d3-a456-426614174000", - "authenticationType": "OIDC", - "knownProviderAlias": "Salesforce", - "idpConfigurationName": "Initial Salesforce", - "idpConfigurationId": "TBD", - "enabled": true } ]` ## [](#tag/Single-Sign-on-Methods/operation/createOrUpdateOIDCConfiguration)Create or update OIDC configuration Creates a new Google, OpenID Connect (OIDC), or Salesforce configuration for Tableau Cloud Manager (TCM) authentication using the specified resource ID. If a configuration already exists, this method updates the configuration for the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_oidc_configs:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ### About configuring Google or Salesforce authentication To configure Google authentication, make sure to include the required `enabled` and `knownProviderAlias` attributes in your request. ``` curl -X POST "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/oidcconfiguration" -H "accept: application/json" -D '{ "enabled": true, "knownProviderAlias: "Google" }' ``` To configure Salesforce authentication, make sure to include the required `enabled` and `knownProviderAlias`, and optionally the `salesforceDomain` attributes in your request. ``` curl -X POST "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/oidcconfiguration" -H "accept: application/json" -D '{ "enabled": true, "knownProviderAlias: "Salesforce" }' ``` ### About configuring OIDC authentication To configure OpenID Connect (OIDC) authentication, be sure to include the attributes and claims in your request to correctly map user account attributes from the IdP to TCM. ``` curl -X POST "http://mytenant.cloudmanager.tableau.com/api/v1/resources/{resourceId}/oidcconfiguration" -H "accept: application/json" -D '{ "enabled": true, "testLoginUri": "string", "clientId": "string", "clientSecret": "string", "discoveryEndpoint": "string", "authorizationEndpoint": "string", "tokenEndpoint": "string", "userinfoEndpoint": "string", "jwksUri": "string", "endSessionEndpoint": "string", "customScope": "string", "prompt": "string", "clientAuthentication": "string", "essentialAcrValues": "string", "voluntaryAcrValues": "string", "attributeMapping": { "emailMapping": "string", "firstNameMapping": "string", "lastNameMapping": "string", "fullNameMapping": "string", "useFullName": true, "emailAddressMapping": "string" }, }' ``` The following attribute and claims are required when configuring OIDC authentication: - `enabled` is `true` - `clientId` is the client ID from the IdP (for example, `0oa111usf1gpUkVUt0h1`) - `clientSecret` is the client secret from the IdP - `authorizationEndpoint` is the authorization endpoint (`authorization_endpoint`) from the IdP (for example, `https://myidp.com/oauth2/v1/authorize`) - `tokenEndpoint` is the token endpoint (`token_endpoint`) from the IdP (for example, `https://myidp.com/oauth2/v1/token`) - `userinfoEndpoint` is the user information endpoint (`userinfo_endpoint`) from the IdP (for example, `https://myidp.com/oauth2/v1/userinfo`) - `jwksUri` is the JWK set URI endpoint (`jwks_uri`) from the IdP (for example, `https://myidp.com/oauth2/v1/keys`) ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The ID of the tenant whose configuration is being created or updated. You can get a tenant ID by calling the Get Tenant method.

##### Request Body schema: application/json required
enabled
required
boolean

If true, the authentication configuration is enabled. Default is true.

testLoginUri
string

URL to validate the OIDC authentication configuration.

knownProviderAlias
required
string

Authentication type. For example, Google or Salesforce. For OpenID Connect (OIDC), do not use or is null.

salesforceDomain
string

Salesforce authentication only. URL of the Salesforce domain.

allowEmbeddedAuthentication
boolean

(Site-specific) How users authenticate to the Tableau Cloud site when accessing embedded views. If false, users authenticate in a separate pop-up window. If true, users authenticate using an inline frame (IFrame), which is less secure. Default value is false.

clientId
required
string

OpenID Connect (OIDC) authentication only. Client ID from the identity provider (IdP).

clientSecret
required
string

OpenID Connect (OIDC) authentication only. Client secret from the identity provider (IdP).

discoveryEndpoint
string

OpenID Connect (OIDC) authentication only. Location of the configuration discovery document for the identity provider (IdP) metadata.

authorizationEndpoint
required
string

OpenID Connect (OIDC) authentication only. Authorization endpoint from the identity provider (IdP).

tokenEndpoint
required
string

OpenID Connect (OIDC) authentication only. Token endpoint from the identity provider (IdP).

userinfoEndpoint
required
string

OpenID Connect (OIDC) authentication only. User information endpoint from the identity provider (IdP).

jwksUri
required
string

OpenID Connect (OIDC) authentication only. JWK set URI from the identity provider (IdP).

endSessionEndpoint
string

(Site-specific) OpenID Connect (OIDC) authentication only. If single logout (SLO) is enabled for the site, which is done through Tableau Cloud site UI, the configuration URL or the end session endpoint from the identity provider (IdP).

customScope
string

OpenID Connect (OIDC) authentication only. Specifies a custom scope user-related value to query the identity provider (IdP).

prompt
string

OpenID Connect (OIDC) authentication only. If users are prompted for re-authentication and consent.

clientAuthentication
string

OpenID Connect (OIDC) authentication only. Token endpoint authentication method. Default value is client_secret_basic.

essentialAcrValues
string

OpenID Connect (OIDC) authentication only. List of essential Authentication Context Reference Class values used for authentication.

voluntaryAcrValues
string

OpenID Connect (OIDC) authentication only. List of voluntary Authentication Context Reference Class values used for authentication.

object (SiteAttributeMapping)
idpConfigurationName
string

(Site-specific) Name of the authentication configuration.

idpConfigurationId
string

(Site-specific) ID of the authentication configuration.

### Responses **201** Success. **500** Internal error. put/api/v1/resources/{resourceId}/oidcconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/oidcconfiguration ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "testLoginUri": "[https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC](https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC)", - "knownProviderAlias": "Salesforce", - "salesforceDomain": "login.salesforce.com", - "allowEmbeddedAuthentication": true, - "clientId": "0oa111usf1gpUkVUt0h1", - "clientSecret": "string", - "discoveryEndpoint": "string", - "authorizationEndpoint": "[https://myidp.com/oauth2/v1/authorize](https://myidp.com/oauth2/v1/authorize)", - "tokenEndpoint": "[https://myidp.com/oauth2/v1/token](https://myidp.com/oauth2/v1/token)", - "userinfoEndpoint": "[https://myidp.com/oauth2/v1/userinfo](https://myidp.com/oauth2/v1/userinfo)", - "jwksUri": "[https://myidp.com/oauth2/v1/keys](https://myidp.com/oauth2/v1/keys)", - "endSessionEndpoint": "[https://myidp.com/oauth2/v1/logout](https://myidp.com/oauth2/v1/logout)", - "customScope": "openid, email, profile", - "prompt": "login, consent", - "clientAuthentication": "client_secret_basic, client_secret_post", - "essentialAcrValues": "phr", - "voluntaryAcrValues": "string", - "attributeMapping": { - "emailMapping": "NameID", - "firstNameMapping": "FirstName", - "lastNameMapping": "LastName", - "fullNameMapping": "FullName", - "useFullName": false, - "emailAddressMapping": "Email" }, - "idpConfigurationName": "Initial SAML", - "idpConfigurationId": "b2207590-024c-4a6e-ac4a-eca6eefabb2e" }` ### Response samples - 201 - 500 Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "testLoginUri": "[https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC](https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC)", - "knownProviderAlias": "Salesforce", - "salesforceDomain": "login.salesforce.com", - "allowEmbeddedAuthentication": true, - "clientId": "0oa111usf1gpUkVUt0h1", - "clientSecret": "string", - "discoveryEndpoint": "string", - "authorizationEndpoint": "[https://myidp.com/oauth2/v1/authorize](https://myidp.com/oauth2/v1/authorize)", - "tokenEndpoint": "[https://myidp.com/oauth2/v1/token](https://myidp.com/oauth2/v1/token)", - "userinfoEndpoint": "[https://myidp.com/oauth2/v1/userinfo](https://myidp.com/oauth2/v1/userinfo)", - "jwksUri": "[https://myidp.com/oauth2/v1/keys](https://myidp.com/oauth2/v1/keys)", - "endSessionEndpoint": "[https://myidp.com/oauth2/v1/logout](https://myidp.com/oauth2/v1/logout)", - "customScope": "openid, email, profile", - "prompt": "login, consent", - "clientAuthentication": "client_secret_basic, client_secret_post", - "essentialAcrValues": "phr", - "voluntaryAcrValues": "string", - "attributeMapping": { - "emailMapping": "NameID", - "firstNameMapping": "FirstName", - "lastNameMapping": "LastName", - "fullNameMapping": "FullName", - "useFullName": false, - "emailAddressMapping": "Email" }, - "idpConfigurationName": "Initial SAML", - "idpConfigurationId": "b2207590-024c-4a6e-ac4a-eca6eefabb2e" }` ## [](#tag/Single-Sign-on-Methods/operation/deleteOIDCConfiguration)Delete OIDC configuration Deletes the Google, OpenID Connect (OIDC), or Salesforce configuration for the provided resource ID. If the configuration doesn't exist, it fails silently. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_oidc_configs:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The ID of the tenant whose configuration is being deleted. You can get a tenant ID by calling the Get Tenant method.

### Responses **200** Success. **500** Internal error. delete/api/v1/resources/{resourceId}/oidcconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/oidcconfiguration ### Response samples - 200 - 500 Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "testLoginUri": "[https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC](https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC)", - "knownProviderAlias": "Salesforce", - "salesforceDomain": "login.salesforce.com", - "allowEmbeddedAuthentication": true, - "clientId": "0oa111usf1gpUkVUt0h1", - "clientSecret": "string", - "discoveryEndpoint": "string", - "authorizationEndpoint": "[https://myidp.com/oauth2/v1/authorize](https://myidp.com/oauth2/v1/authorize)", - "tokenEndpoint": "[https://myidp.com/oauth2/v1/token](https://myidp.com/oauth2/v1/token)", - "userinfoEndpoint": "[https://myidp.com/oauth2/v1/userinfo](https://myidp.com/oauth2/v1/userinfo)", - "jwksUri": "[https://myidp.com/oauth2/v1/keys](https://myidp.com/oauth2/v1/keys)", - "endSessionEndpoint": "[https://myidp.com/oauth2/v1/logout](https://myidp.com/oauth2/v1/logout)", - "customScope": "openid, email, profile", - "prompt": "login, consent", - "clientAuthentication": "client_secret_basic, client_secret_post", - "essentialAcrValues": "phr", - "voluntaryAcrValues": "string", - "attributeMapping": { - "emailMapping": "NameID", - "firstNameMapping": "FirstName", - "lastNameMapping": "LastName", - "fullNameMapping": "FullName", - "useFullName": false, - "emailAddressMapping": "Email" }, - "idpConfigurationName": "Initial SAML", - "idpConfigurationId": "b2207590-024c-4a6e-ac4a-eca6eefabb2e" }` ## [](#tag/Single-Sign-on-Methods/operation/getOIDCConfiguration)Get OIDC configuration Gets the Google, OpenID Connect (OIDC), or Salesforce configuration for the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_oidc_configs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The ID of the tenant whose configuration is being retrieved. You can get a tenant ID by calling the Get Tenant method.

### Responses **200** Success. **404** A configuration for the provided tenant or site could not be found. **500** Internal error. get/api/v1/resources/{resourceId}/oidcconfiguration https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/oidcconfiguration ### Response samples - 200 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "enabled": true, - "testLoginUri": "[https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC](https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC)", - "knownProviderAlias": "Salesforce", - "salesforceDomain": "login.salesforce.com", - "allowEmbeddedAuthentication": true, - "clientId": "0oa111usf1gpUkVUt0h1", - "clientSecret": "string", - "discoveryEndpoint": "string", - "authorizationEndpoint": "[https://myidp.com/oauth2/v1/authorize](https://myidp.com/oauth2/v1/authorize)", - "tokenEndpoint": "[https://myidp.com/oauth2/v1/token](https://myidp.com/oauth2/v1/token)", - "userinfoEndpoint": "[https://myidp.com/oauth2/v1/userinfo](https://myidp.com/oauth2/v1/userinfo)", - "jwksUri": "[https://myidp.com/oauth2/v1/keys](https://myidp.com/oauth2/v1/keys)", - "endSessionEndpoint": "[https://myidp.com/oauth2/v1/logout](https://myidp.com/oauth2/v1/logout)", - "customScope": "openid, email, profile", - "prompt": "login, consent", - "clientAuthentication": "client_secret_basic, client_secret_post", - "essentialAcrValues": "phr", - "voluntaryAcrValues": "string", - "attributeMapping": { - "emailMapping": "NameID", - "firstNameMapping": "FirstName", - "lastNameMapping": "LastName", - "fullNameMapping": "FullName", - "useFullName": false, - "emailAddressMapping": "Email" }, - "idpConfigurationName": "Initial SAML", - "idpConfigurationId": "b2207590-024c-4a6e-ac4a-eca6eefabb2e" }` ## [](#tag/Single-Sign-on-Methods/operation/getAdminLogs)List SAML logs Gets a list of SAML log entries for the specified resource ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, December 2025, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_saml_configs:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
resourceId
required
string <uuid>

The ID of the tenant or site whose SAML logs are being retrieved. You can get the resourceId by calling the Get Tenant or List Tenant Sites method.

### Responses **200** Success. **500** Internal error. get/api/v1/resources/{resourceId}/samlconfiguration/adminlogs https://cloudmanager.tableau.com/api/v1/resources/{resourceId}/samlconfiguration/adminlogs ### Response samples - 200 - 500 Content type application/json Copy Expand all Collapse all `[ - { - "message": "string", - "timestamp": 0, - "logLevel": "string", - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1" } ]` # [](#tag/Site-Methods)Site Methods Tableau Cloud Manager REST API Site methods allow cloud administrators to manage sites in the following ways: - Create a site in a tenant. - List sites in a tenant. - Get site details. - Suspend a site in a tenant. - Update license limit for a site in a tenant. - Create a project in a tenant. - Reactivate a suspended site in a tenant. **Postman:** [Site Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/ujql7pj/site-methods) ## [](#tag/Site-Methods/operation/createSite)Create site Creates a new site under the given tenant. The site name must be unique within the tenant. Note: To describe the site location, specify one of either a `regionUUID` or a `podUUID`. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier of the tenant where the site is created.

##### Request Body schema: application/json required
name
required
string

The name of the site.

The site name must be between 1 and 80 characters long. The site name only contain Unicode letters and numbers, white spaces, and the characters !, @, $, %, *, ., ?, -, _, ,, ’, (, ), &, /, :, #. The site name must not start or end with a space. The site name must not contain the following reserved words: 'default', 'system', 'admin', 'administrator', 'all', 'guest', 'public', 'internal', private', 'protected', 'root', 'service', 'services', 'tableau', 'user', 'users', 'web', 'www'.

contentUrl
required
string

The subdomain name of the site's URL.

This value is globally unique and can contain only characters that are upper or lower case alphabetic characters, numbers, hyphens (-), or underscores (_). If you provide unsupported special characters, Tableau creates the site content URL by omitting those characters from the string. For example, if you provide the site URL as "test.site", Tableau converts it to "testsite" and returns this new URL in the response.

regionUUID
string <uuid>

(Required if no podUUID is specified.)

The Unique ID of Tableau region where the site should be created.

Provide this or the podUUID. Use the List Locations or List regions method to get the region IDs.

podUUID
string <uuid>

(Required if no regionUUID is specified.)

The Unique ID of Tableau pod where the site should be created.

Provide this or the regionUUID. Use the List Locations method to get the pod IDs.

### Responses **201** Success. **400** Invalid request. **409** The specified site already exists. **500** Internal error. post/api/v1/tenants/{tenantId}/sites https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites ### Request samples - Payload Content type application/json Copy `{ - "name": "string", - "contentUrl": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "podUUID": "e2e568b4-35a7-4aa5-8686-107bbf9f050c" }` ### Response samples - 201 - 400 - 409 - 500 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteUUID": "c9e56a0f-ad64-4cef-a0e8-cd7f1d44ab67", - "name": "string", - "contentUrl": "string", - "instance": { - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "baseUrl": "string", - "serverInstanceId": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "cloudProvider": { - "name": "string", - "region": "string" } }, - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0, - "creatorCapacityIsDefaultCloudLimit": true, - "explorerCapacityIsDefaultCloudLimit": true, - "viewerCapacityIsDefaultCloudLimit": true, - "location": "string", - "migrationStatus": "NotStarted", - "storageQuota": 100000000, - "storageUsed": 100000000, - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "suspendedDateTime": "2019-08-24T14:15:22Z", - "fromPodSiteAttributes": { - "userQuotaPolicy": { - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0 } } }` ## [](#tag/Site-Methods/operation/getSites)List tenant sites Gets details for all sites under a tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

##### query Parameters
location
string

The unique identifier for the Tableau region of the site.

maxResults
integer <int32>

The maximum number of sites to include in the response. Default is no maximum.

pageToken
string

The next page of results to return, typically the pageToken field of the response body from your previous call to the List sites method.

### Responses **200** Success. **400** Invalid request. **500** Internal error. get/api/v1/tenants/{tenantId}/sites https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites ### Response samples - 200 - 400 Content type application/json Copy Expand all Collapse all `{ - "sites": [ - { - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteUUID": "c9e56a0f-ad64-4cef-a0e8-cd7f1d44ab67", - "name": "string", - "contentUrl": "string", - "instance": { - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "baseUrl": "string", - "serverInstanceId": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "cloudProvider": { - "name": "string", - "region": "string" } }, - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0, - "creatorCapacityIsDefaultCloudLimit": true, - "explorerCapacityIsDefaultCloudLimit": true, - "viewerCapacityIsDefaultCloudLimit": true, - "location": "string", - "migrationStatus": "NotStarted", - "storageQuota": 100000000, - "storageUsed": 100000000, - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "suspendedDateTime": "2019-08-24T14:15:22Z", - "disasterRecoveryStatus": "Enabled" } ], - "pageToken": "string" }` ## [](#tag/Site-Methods/operation/getSite)Get site Returns site details for the specified site. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

siteId
required
string

The LUID for the site.

### Responses **200** Success. **400** Invalid request. **404** The specified site could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/sites/{siteId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId} ### Response samples - 200 - 400 - 404 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteUUID": "c9e56a0f-ad64-4cef-a0e8-cd7f1d44ab67", - "name": "string", - "contentUrl": "string", - "instance": { - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "baseUrl": "string", - "serverInstanceId": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "cloudProvider": { - "name": "string", - "region": "string" } }, - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0, - "creatorCapacityIsDefaultCloudLimit": true, - "explorerCapacityIsDefaultCloudLimit": true, - "viewerCapacityIsDefaultCloudLimit": true, - "location": "string", - "migrationStatus": "NotStarted", - "storageQuota": 100000000, - "storageUsed": 100000000, - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "suspendedDateTime": "2019-08-24T14:15:22Z", - "disasterRecoveryStatus": "Enabled" }` ## [](#tag/Site-Methods/operation/deleteOrSuspendSite)Suspend site Suspends a site. Suspended sites are not accessible to users. Suspended sites can be reactivated. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

siteId
required
string

The LUID for the site.

### Responses **204** Success. **400** Invalid request. **404** The specified site could not be found. **500** Internal error. delete/api/v1/tenants/{tenantId}/sites/{siteId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId} ### Response samples - 204 - 400 - 404 Content type application/json Copy `"string"` ## [](#tag/Site-Methods/operation/updateLicenseQuotaForSite)Update license limit for site Updates license/role limit for a site. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

siteId
required
string

The LUID for the site.

##### Request Body schema: application/json required
object (UserQuota)

The limit of number of users with licenses for the viewer role for the site.

object (UserQuota)

The limit of number of users with licenses for the viewer role for the site.

object (UserQuota)

The limit of number of users with licenses for the viewer role for the site.

### Responses **200** Success. **400** Invalid request. **404** The specified site could not be found. **500** Internal error. patch/api/v1/tenants/{tenantId}/sites/{siteId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId} ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "creatorCapacity": { - "isDefaultCloudLimit": true, - "capacity": 0 }, - "explorerCapacity": { - "isDefaultCloudLimit": true, - "capacity": 0 }, - "viewerCapacity": { - "isDefaultCloudLimit": true, - "capacity": 0 } }` ### Response samples - 200 - 400 - 404 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteUUID": "c9e56a0f-ad64-4cef-a0e8-cd7f1d44ab67", - "name": "string", - "contentUrl": "string", - "instance": { - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "baseUrl": "string", - "serverInstanceId": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "cloudProvider": { - "name": "string", - "region": "string" } }, - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0, - "creatorCapacityIsDefaultCloudLimit": true, - "explorerCapacityIsDefaultCloudLimit": true, - "viewerCapacityIsDefaultCloudLimit": true, - "location": "string", - "migrationStatus": "NotStarted", - "storageQuota": 100000000, - "storageUsed": 100000000, - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "suspendedDateTime": "2019-08-24T14:15:22Z" }` ## [](#tag/Site-Methods/operation/createProjectOnSite)Create project Creates a new project on a site in a tenant. A project is a container for workbooks, data sources, and other Tableau content that all inherit the permissions set for the Project. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

siteId
required
string

The LUID for the site.

##### Request Body schema: application/json required
ownerId
required
string

The LUID of the user that owns the project.

### Responses **201** Success. **400** Invalid request. **404** The owner of the tenant or site was not found. **409** The specified project already exists. **500** Internal error. post/api/v1/tenants/{tenantId}/sites/{siteId}/project https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/project ### Request samples - Payload Content type application/json Copy `{ - "ownerId": "string" }` ### Response samples - 201 - 400 - 404 - 409 - 500 Content type application/json Copy Expand all Collapse all `{ - "project": { - "name": "string", - "id": "string", - "description": "string", - "parentProjectId": "string", - "contentPermissions": "string", - "owner": { - "id": "string" } } }` ## [](#tag/Site-Methods/operation/reactivateSuspendedSite)Reactivate suspended site Reactivates a suspended site. Reactivated sites are accessible to users > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string

The unique identifier for the tenant.

siteId
required
string

The LUID for the site.

### Responses **200** Success. **400** Invalid request. **404** The specified site could not be found. **409** Conflicts with the site state **500** Internal error. patch/api/v1/tenants/{tenantId}/sites/{siteId}/reactivate https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/reactivate ### Response samples - 200 - 400 - 404 - 409 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteUUID": "c9e56a0f-ad64-4cef-a0e8-cd7f1d44ab67", - "name": "string", - "contentUrl": "string", - "instance": { - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "baseUrl": "string", - "serverInstanceId": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "cloudProvider": { - "name": "string", - "region": "string" } }, - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0, - "creatorCapacityIsDefaultCloudLimit": true, - "explorerCapacityIsDefaultCloudLimit": true, - "viewerCapacityIsDefaultCloudLimit": true, - "location": "string", - "migrationStatus": "NotStarted", - "storageQuota": 100000000, - "storageUsed": 100000000, - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "suspendedDateTime": "2019-08-24T14:15:22Z" }` ## [](#tag/Site-Methods/operation/renameSite)Update site name and content url Updates site name and/or content url for a given site in a tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_sites:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier for the tenant.

siteId
required
string <uuid>

The LUID for the site.

##### Request Body schema: application/json required
name
string

The name of the site.

The site name must be between 1 and 80 characters long. The site name only contain Unicode letters and numbers, white spaces, and the characters !, @, $, %, *, ., ?, -, _, ,, ’, (, ), &, /, :, #. The site name must not start or end with a space. The site name must not contain the following reserved words: 'default', 'system', 'admin', 'administrator', 'all', 'guest', 'public', 'internal', private', 'protected', 'root', 'service', 'services', 'tableau', 'user', 'users', 'web', 'www'.

contentUrl
string

The subdomain name of the site's URL. This value can contain only characters that are upper or lower case alphabetic characters, numbers, hyphens (-), or underscores (_).

### Responses **200** Success. **400** Invalid request. **404** Tenant or site not found. **500** Internal error. patch/api/v1/tenants/{tenantId}/sites/{siteId}/rename https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/sites/{siteId}/rename ### Request samples - Payload Content type application/json Copy `{ - "name": "string", - "contentUrl": "string" }` ### Response samples - 200 - 400 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "siteUUID": "c9e56a0f-ad64-4cef-a0e8-cd7f1d44ab67", - "name": "string", - "contentUrl": "string", - "instance": { - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "baseUrl": "string", - "serverInstanceId": "string", - "regionUUID": "8cc23c52-0d6e-468d-9156-952d9b566d86", - "cloudProvider": { - "name": "string", - "region": "string" } }, - "creatorCapacity": 0, - "explorerCapacity": 0, - "viewerCapacity": 0, - "creatorCapacityIsDefaultCloudLimit": true, - "explorerCapacityIsDefaultCloudLimit": true, - "viewerCapacityIsDefaultCloudLimit": true, - "location": "string", - "migrationStatus": "NotStarted", - "storageQuota": 100000000, - "storageUsed": 100000000, - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "suspendedDateTime": "2019-08-24T14:15:22Z" }` # [](#tag/Tenant-Methods)Tenant Methods Tableau Cloud Manager REST API Tenant methods allow cloud administrators to manage tenants in the following ways: - Get the details of a specified tenant. **Postman:** [Tenant Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/jfea4oj/tenant-methods) ## [](#tag/Tenant-Methods/operation/getTenant)Get tenant Returns the tenant record for the specified tenant ID. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_tenants:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string
Example: 123e4567-e89b-12d3-a456-426614174000

The unique identifier of the tenant.

### Responses **200** Success. **404** A tenant with the specified identifier could not be found. **500** Internal error. get/api/v1/tenants/{tenantId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId} ### Response samples - 200 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "tenantId": "123e4567-e89b-12d3-a456-426614174000", - "tenantName": "Abc", - "encodeUri": "string", - "status": "Unknown", - "createDateTime": "2019-08-24T14:15:22Z", - "lastUpdateDateTime": "2019-08-24T14:15:22Z", - "lastDestinationMergedDateTime": "2019-08-24T14:15:22Z", - "termsAndConditions": { - "acceptedTandC": true, - "acceptedBy": "c9d21af9-656c-4e21-b4ec-9f2224daf95d", - "acceptedAt": "2019-08-24T14:15:22Z" } }` # [](#tag/User-Methods)User Methods Tableau Cloud Manager REST API User methods allow cloud administrators to manage users in the following ways: - Get the details of a specified user. - Add a user to a tenant. - List all users in a tenant, or get the details of a specified batch. - Import a batch of users specified in a .gzip file. - Delete a user or a specified batch of users from a tenant. - Update the role and language preference for a user in a tenant. - Get the sites and tenants that a user is a member of. **Postman:** [User Methods](https://www.postman.com/salesforce-developers/salesforce-developers/folder/ij1viux/user-methods) ## [](#tag/User-Methods/operation/createUserWithMultiRole)Add user to tenant Creates a new user in the tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

##### Request Body schema: application/json required
userName
required
string

The unique username of the user.

email
string

The email address of the user.

language
string
Enum: "DE_DE" "EN_GB" "EN_US" "ES_ES" "FR_CA" "FR_FR" "IT_IT" "JA_JP" "KO_KR" "NL_NL" "PT_BR" "SV_SE" "TH_TH" "ZH_CN" "ZH_TW"

The language of the user. If adding a TCM user (cloud administrator), the language set using this attribute determines the language that Tableau Cloud Manager (TCM) displays in for the user and tenant-level invitation email notifications. If adding a Tableau Cloud user, the language set using this attribute determines the language that Tableau Cloud displays for the user and site invitation email notifications. This setting takes precedence over the default site-wide invitation email language that the site admin can set.

locale
string
Enum: "ar_AE" "ar_BH" "ar_DZ" "ar_EG" "ar_IQ" "ar_JO" "ar_KW" "ar_LB" "ar_LY" "ar_MA" "ar_OM" "ar_QA" "ar_SA" "ar_SD" "ar_SY" "ar_TN" "ar_YE" "be_BY" "bg_BG" "ca_ES" "cs_CZ" "da_DK" "de_AT" "de_CH" "de_DE" "de_LU" "el_CY" "el_GR" "en_AU" "en_CA" "en_GB" "en_IE" "en_IN" "en_MT" "en_NZ" "en_PH" "en_SG" "en_US" "en_ZA" "es_AR" "es_BO" "es_CL" "es_CO" "es_CR" "es_DO" "es_EC" "es_ES" "es_GT" "es_HN" "es_MX" "es_NI" "es_PA" "es_PE" "es_PR" "es_PY" "es_SV" "es_US" "es_UY" "es_VE" "et_EE" "fi_FI" "fr_BE" "fr_CA" "fr_CH" "fr_FR" "fr_LU" "hi_IN" "hr_HR" "hu_HU" "in_ID" "is_IS" "it_CH" "it_IT" "iw_IL" "ja_JP" "ko_KR" "lt_LT" "lv_LV" "mk_MK" "ms_MY" "mt_MT" "nl_BE" "nl_NL" "no_NO" "pl_PL" "pt_BR" "pt_PT" "ro_RO" "ru_RU" "sk_SK" "sl_SI" "sq_AL" "sr_BA" "sr_ME" "sr_RS" "sv_SE" "th_TH" "tr_TR" "uk_UA" "vi_VN" "zh_CN" "zh_HK" "zh_SG" "zh_TW"

The locale of the user.

Array of objects (UserLinkRoleDTO)

The tenant roles for the user.

Array of objects (UserSiteRoleDTO)

The site roles of the user.

### Responses **202** Success. **400** Invalid request. **401** The user could not be authenticated. **403** The user does not have permissions. **405** The requested method is not supported. **409** The user already exists in the tenant. **500** Internal error. post/api/v1/tenants/{tenantId}/users https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "userName": "string", - "email": "string", - "language": "DE_DE", - "locale": "ar_AE", - "linkRoles": [ - { - "linkId": "009f739c-6620-43b0-978e-b245e723c57a", - "linkRole": "LINK_ADMIN", - "notifyUser": true, - "idp": "OpenID, TableauIDWithMFA" } ], - "siteRoles": [ - { - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "siteRole": "SiteAdministratorExplorer", - "idp": "OpenID", - "notifyUser": true } ] }` ### Response samples - 202 - 400 - 401 - 403 - 405 - 409 - 500 Content type application/json Copy `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39", - "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b", - "transactionId": "string", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0" }` ## [](#tag/User-Methods/operation/getUsers)List tenant users Gets a list of tenant users and their details. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). Responses can be filtered by `email`, `userId`, `tcmRoleName`, `maxSiteRole`, `userName` and paginated using `pageToken`, and `maxResults`. Multiple filters can be applied with ampersand-separated expressions, for example: ``` {{tcmBaseUrl}}/api/v1/tenants/:tenantId/users?maxSiteRole=SiteAdministratorCreator&excludeRoles=true ``` If `excludeRoles=true` is set, the curtailed responses will be faster. ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant used to filter the response.

##### query Parameters
email
string
Example: email=xyz@tableau.com

The email address of a user used to filter the response.

userId
string <uuid>
Example: userId=83e34e72-5c71-4858-93b5-945a144e6e70

The unique identifier of a user used to filter responses.

tcmRoleName
string
Enum: "TCM_ADMIN" "NULL"

The tenant role used to filter the response.

maxSiteRole
string
Enum: "SiteAdministratorExplorer" "SupportUser" "ExplorerCanPublish" "Explorer" "Unlicensed" "Viewer" "Creator" "SiteAdministratorCreator"

The site role with the highest permissions used to filter the response.

userName
string

The name of a user used to filter the response.

pageToken
string [ 0 .. 1000 ] characters

The token used to get the next page of results.

maxResults
integer <int32>
Example: maxResults=100

The maximum number of results per page. Default maximum is 100.

excludeRoles
boolean

If true, site and tenant role information is not returned, only return user details. Default is false.

### Responses **200** Success. **400** Invalid request. **401** The user could not be authenticated. **403** The user does not have permissions. **500** Internal error. get/api/v1/tenants/{tenantId}/users https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users ### Response samples - 200 - 400 - 401 - 403 - 500 Content type application/json Copy `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39", - "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b", - "transactionId": "string", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0" }` ## [](#tag/User-Methods/operation/bulkUserImport)Batch import users with .gzip Import users in bulk using a `.gzip` (compressed CSV) file. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users_bulk_operation:create`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). If no siteId is provided, users are imported as tenant users. An example of a multipart form data request is as follows: ``` curl -X POST "http://mytenant.cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/bulk-import" -H "accept: application/json" -H "Content-Type: multipart/form-data" -F "file=@/path/to/file.csv.gz" -F "siteId="d9103a00-d7e5-433f-a0c3-debb7d4f7741" -F "idp="TableauIDWithMFA" ``` ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

##### query Parameters
siteId
string <uuid>

The unique identifier of the site.

idp
string
Enum: "OpenID" "SAML" "TableauIDWithMFA"

The authentication type configured for the tenant.

##### Request Body schema: multipart/form-data required
file
required
string <binary>

A .gzip (compressed CSV) file containing data of users to be imported. A correctly formatted file has no header row.

Note: When importing, make sure your CSV file is in UTF-8 format without a byte order mark (BOM).

The expected columns, in the required order, are:

  1. URI (for the tenant or site)

  2. Username

  3. Password

  4. Display Name

  5. License Level (Explorer, Creator, Viewer, or Unlicensed)

  6. Administrator Level (Cloud, Site, or None)

  7. Can Publish (TRUE or FALSE)

  8. Authentication (OpenID, SAML, TableauIDWithMFA, or DEFAULT. Note: DEFAULT is only allowed at the site-level if your site supports it.)

### Responses **202** Success. **400** Invalid request. **403** User does not have permissions. **404** Site or tenant specified could not be found. **405** Method not allowed. **409** Bulk operation already in progress. **500** Internal error. post/api/v1/tenants/{tenantId}/users/bulk-import https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/bulk-import ### Response samples - 202 - 400 - 403 - 404 - 405 - 409 - 500 Content type application/json Copy `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39" }` ## [](#tag/User-Methods/operation/deleteUsers)Batch delete tenant users Starts a job to delete the specified batch of users from the specified tenant. To see progress and results, use the returned `jobId` in a request to the [List status for job](#tag/User-Methods/operation/getBulkOperationDetails) method. _Note:_ If the user owns content in a tenant site, the user will become unlicensed but will not be removed from the tenant or from any sites where they own content. To remove the user from a tenant and shift ownership of their content to another user, you can take the following steps: 1. Make a request to the TCM [List tenant sites](#tag/Site-Methods/operation/getSites) method, which returns the LUIDs of all sites on a tenant. 2. [Sign in](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) to the Tableau REST API then, for each of the site LUIDs returned for the tenant, use [Remove User from site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#remove_user_from_site) with the `mapAssetsTo` query parameter set to use the LUID of the new owner for each site. 3. Use this tenant method (Delete tenant users) to remove the user from the tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). This method returns an identifier for an asynchronous job. To see progress and results, use [List status for job](#tag/User-Methods/operation/getBulkOperationDetails). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

##### Request Body schema: application/json required
userIds
required
Array of strings <uuid> unique [ items <uuid > ]

A comma separated list of user LUIDs to delete.

### Responses **202** Success. **400** Invalid request. **403** The user does not have permissions. **404** The tenant specified could not be found. **405** The method requested is not supported. **500** Internal error. post/api/v1/tenants/{tenantId}/users/delete https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/delete ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "userIds": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" ] }` ### Response samples - 202 - 400 - 403 - 404 - 405 Content type application/json Copy `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39" }` ## [](#tag/User-Methods/operation/getUsersByUserIds)Batch get tenant users Lists the details of a batch of users specified in a comma separated list of user IDs. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

##### Request Body schema: application/json required
userIds
required
Array of strings <uuid> unique [ items <uuid > ]

Comma separated list of user LUIDs to get details about.

### Responses **200** Success. **400** Invalid request. **401** User could not be authenticated. **403** User does not have permissions **500** Internal error. post/api/v1/tenants/{tenantId}/users/fetch-by-ids https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/fetch-by-ids ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "userIds": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" ] }` ### Response samples - 200 - 400 - 401 - 403 - 500 Content type application/json Copy Expand all Collapse all `{ - "users": [ - { - "linkRoles": [ - { - "linkId": "009f739c-6620-43b0-978e-b245e723c57a", - "linkRole": "LINK_ADMIN", - "linkRoleStatus": "INVITED", - "idpType": "string" } ], - "siteRoles": [ - { - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "siteRole": "SiteAdministratorExplorer", - "idpType": "OpenID" } ], - "email": "string", - "userName": "string", - "displayName": "string", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b", - "userStatus": "ACTIVE", - "maxSiteRole": "SiteAdministratorExplorer", - "tcmRoleName": "string", - "numberOfSiteRoles": 0, - "lastLoginTime": "2019-08-24T14:15:22Z", - "language": "DE_DE", - "locale": "ar_AE" } ] }` ## [](#tag/User-Methods/operation/deleteUser)Delete tenant user Starts a job to delete the specified user from the specified tenant. To see progress and results, use the returned `jobId` in a request to the [Get batch user job status](#tag/User-Methods/operation/getBulkOperationDetails) method. Without an additional license, log files take 2 hours to become available. For more information see, [Activity Log](https://help.tableau.com/current/online/en-us/activity_log_overview.htm). _Note:_ If the user owns content in a tenant site, the user will become unlicensed but will not be removed from the tenant or from any sites where they own content. To remove the user from a tenant and shift ownership of their content to another user, you can take the following steps: 1. Make a request to the TCM [List tenant sites](#tag/Site-Methods/operation/getSites) method, which returns the LUIDs of all sites on a tenant. 2. [Sign in](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) to the Tableau REST API then, for each of the site LUIDs returned for the tenant, use [Remove User from site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#remove_user_from_site) with the `mapAssetsTo` query parameter set to use the LUID of the new owner for each site. 3. Use this tenant method (Delete tenant users) to remove the user from the tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:delete`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

userId
required
string <uuid>

The unique identifier of the user.

### Responses **202** Success. **400** Invalid request. **403** The user does not have permissions. **404** The tenant or user specified could not be found. **405** The method requested is not supported. **500** Internal error. delete/api/v1/tenants/{tenantId}/users/{userId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/{userId} ### Response samples - 202 - 400 - 403 - 404 - 405 Content type application/json Copy `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39" }` ## [](#tag/User-Methods/operation/getUser)Get tenant user Gets the details of a tenant user. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

userId
required
string <uuid>

The unique identifier of the user.

### Responses **200** Success. **400** Invalid request. **401** The user could not be authenticated. **403** The user does not have permissions. **404** The specified user could not be found. **500** Internal error. get/api/v1/tenants/{tenantId}/users/{userId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/{userId} ### Response samples - 200 - 400 - 401 - 403 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "user": { - "linkRoles": [ - { - "linkId": "009f739c-6620-43b0-978e-b245e723c57a", - "linkRole": "LINK_ADMIN", - "linkRoleStatus": "INVITED", - "idpType": "string" } ], - "siteRoles": [ - { - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "siteRole": "SiteAdministratorExplorer", - "idpType": "OpenID" } ], - "email": "string", - "userName": "string", - "displayName": "string", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b", - "userStatus": "ACTIVE", - "maxSiteRole": "SiteAdministratorExplorer", - "tcmRoleName": "string", - "numberOfSiteRoles": 0, - "lastLoginTime": "2019-08-24T14:15:22Z", - "language": "DE_DE", - "locale": "ar_AE" } }` ## [](#tag/User-Methods/operation/modifyUserWithMultiRole)Update user on tenant Updates the tenant role, site role, language, and locale for the specified user on the tenant. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users:update`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
tenantId
required
string <uuid>

The unique identifier of the tenant.

userId
required
string <uuid>

The unique identifier of the user.

##### Request Body schema: application/json required
language
string
Enum: "DE_DE" "EN_GB" "EN_US" "ES_ES" "FR_CA" "FR_FR" "IT_IT" "JA_JP" "KO_KR" "NL_NL" "PT_BR" "SV_SE" "TH_TH" "ZH_CN" "ZH_TW"

The language to apply to the user.

locale
string
Enum: "ar_AE" "ar_BH" "ar_DZ" "ar_EG" "ar_IQ" "ar_JO" "ar_KW" "ar_LB" "ar_LY" "ar_MA" "ar_OM" "ar_QA" "ar_SA" "ar_SD" "ar_SY" "ar_TN" "ar_YE" "be_BY" "bg_BG" "ca_ES" "cs_CZ" "da_DK" "de_AT" "de_CH" "de_DE" "de_LU" "el_CY" "el_GR" "en_AU" "en_CA" "en_GB" "en_IE" "en_IN" "en_MT" "en_NZ" "en_PH" "en_SG" "en_US" "en_ZA" "es_AR" "es_BO" "es_CL" "es_CO" "es_CR" "es_DO" "es_EC" "es_ES" "es_GT" "es_HN" "es_MX" "es_NI" "es_PA" "es_PE" "es_PR" "es_PY" "es_SV" "es_US" "es_UY" "es_VE" "et_EE" "fi_FI" "fr_BE" "fr_CA" "fr_CH" "fr_FR" "fr_LU" "hi_IN" "hr_HR" "hu_HU" "in_ID" "is_IS" "it_CH" "it_IT" "iw_IL" "ja_JP" "ko_KR" "lt_LT" "lv_LV" "mk_MK" "ms_MY" "mt_MT" "nl_BE" "nl_NL" "no_NO" "pl_PL" "pt_BR" "pt_PT" "ro_RO" "ru_RU" "sk_SK" "sl_SI" "sq_AL" "sr_BA" "sr_ME" "sr_RS" "sv_SE" "th_TH" "tr_TR" "uk_UA" "vi_VN" "zh_CN" "zh_HK" "zh_SG" "zh_TW"

The new locale to apply to the user.

email
string

Email address of the user to be updated.

Array of objects (PatchUserLinkRoleDTO)

The tenant roles of the user.

Array of objects (PatchUserSiteRoleDTO)

Site role of the user

### Responses **202** Success. **400** Invalid request. **403** The user does not have permissions. **404** The tenant or user specified could not be found. **405** The method requested is not supported. **500** Internal error. patch/api/v1/tenants/{tenantId}/users/{userId} https://cloudmanager.tableau.com/api/v1/tenants/{tenantId}/users/{userId} ### Request samples - Payload Content type application/json Copy Expand all Collapse all `{ - "language": "DE_DE", - "locale": "ar_AE", - "email": "string", - "linkRoles": [ - { - "linkId": "009f739c-6620-43b0-978e-b245e723c57a", - "linkRole": "LINK_ADMIN", - "notifyUser": true, - "idp": "OpenID, TableauIDWithMFA", - "linkOp": "ADD_LINK_ROLE" } ], - "siteRoles": [ - { - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "siteRole": "SiteAdministratorExplorer", - "idp": "OpenID", - "notifyUser": true, - "siteOp": "ADD_SITE_ROLE" } ] }` ### Response samples - 202 - 400 - 403 - 404 - 405 Content type application/json Copy `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39" }` ## [](#tag/User-Methods/operation/getBulkOperationDetails)List status for user job Get the status of a batch user job. > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users_bulk_operation:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
jobId
required
string <uuid>

The unique identifier of the job whose details are to be retrieved.

##### query Parameters
showDetailed
boolean
Example: showDetailed=true

If true, show the detailed status of each user operation in paginated format. Default is false.

pageToken
string [ 0 .. 1000 ] characters

The pageToken used for getting next set of records. Only valid if showDetailed = true.

### Responses **200** Success. **400** Invalid request. **403** User does not have permissions. **404** The job specified could not be found. **405** Method not allowed. **500** Internal error. get/api/v1/users/jobs/{jobId} https://cloudmanager.tableau.com/api/v1/users/jobs/{jobId} ### Response samples - 200 - 400 - 403 - 404 - 405 - 500 Content type application/json Copy Expand all Collapse all `{ - "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "operation": "BULK_USER_IMPORT", - "ownerId": "4d206909-730f-409a-88f6-dcfaa8fc28cc", - "ownerRole": "UNAUTHENTICATED", - "siteId": "60189e9c-7d12-438c-b9ca-6998d9c364b1", - "triggerSource": "string", - "bulkOpAttributes": { - "property1": "string", - "property2": "string" }, - "status": "NEW", - "expectedOpsCount": 0, - "successfulOpsCount": 0, - "failedOpsCount": 0, - "skippedLinesCount": 0, - "submitTime": "2019-08-24T14:15:22Z", - "lastUpdateTime": "2019-08-24T14:15:22Z", - "createdTime": "2019-08-24T14:15:22Z", - "statusChangeHistory": [ - { - "jobStatus": "NEW", - "time": "2019-08-24T14:15:22Z" } ], - "items": [ - { - "lineNumber": "string", - "userName": "string", - "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b", - "siteId": "string", - "opType": "CREATE_USER_SITE_ROLE", - "status": "NEW", - "opCode": "USER_CREATED_WITH_ASSIGNED_ROLE", - "serverSiteUserId": "string", - "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", - "linkRole": "LINK_ADMIN", - "siteRole": "SiteAdministratorExplorer", - "idp": "OpenID" } ], - "nextPageToken": "string" }` ## [](#tag/User-Methods/operation/getUserResourcesByUsername)Get user information Gets information about the user > Permissions: Only cloud administrators can call this method. > Version: Available in Tableau Cloud Manager v1, June 2024, and later. > License: No additional Tableau license is required. For more information, see [About Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). > Access scope: `tableau:tcm_users_resources:read`. Added in December 2025. For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes). ##### Authorizations: _x-tableau-session-token_ ##### path Parameters
userName
required
string

The username of the user to get resource details for.

##### query Parameters
resourceId
string <uuid>

The unique identifier of a site or tenant optionally used to filter results.

resourceType
string
Enum: "SITE" "TENANT"

The type of resource optionally used to filter results.

authType
string
Enum: "OpenID" "SAML" "TableauIDWithMFA" "DEFAULT"

The type of user authentication optionally used to filter results.

authUserId
string

The unique identifier of the user optionally used to filter results.

### Responses **200** Success. **400** Invalid request. **401** The user can not be authenticated. **403** The user does not have permissions. **404** The specified user can not be found **500** Internal error. get/api/v1/users/{userName} https://cloudmanager.tableau.com/api/v1/users/{userName} ### Response samples - 200 - 400 - 401 - 403 - 404 - 500 Content type application/json Copy Expand all Collapse all `{ - "resources": [ - { - "name": "string", - "state": "string", - "migrationStatus": "NotStarted", - "uri": "string", - "email": "string", - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "resourceType": "SITE", - "instanceDomain": "string", - "parent": { - "name": "string", - "uri": "string", - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08" } } ], - "userName": "string" }` # Unified Access Tokens Unified access tokens are configurations that enable JSON Web Token (JWT)-based authentication for both Tableau Cloud Manager (TCM) REST API and Tableau REST API. Starting in December 2025, UATs provide an enterprise-level token solution for managing Tableau Cloud at scale. #### Benefits of UATs UATs offer the following benefits: - **Unified authentication:** UATs enable JWT-based authentication for cloud administrators with the TCM REST API; and for users with both the TCM REST API and Tableau REST API. - **Concurrent sessions:** UATs support multiple concurrent sessions. - **Least privileged access:** Using access scopes, the JWT that is passed during sign-in and can offer the minimum permissions required to perform a task. - **Centralized control and management of tokens:** Through centralization of sites under a tenant, cloud administrators gain control over the management and revocation of UATs. - **Improved auditing:** You can see logs associated with a UAT to monitor activity, investigate issues, and meet compliance requirements. **Note:** JWT authentication using UATs and JWT authentication using Tableau connected apps are distinct authentication and authorization capabilities. Tableau connected apps are not supported in TCM. #### UATs with Tableau Bridge Starting in February 2026, you can use UATs to authenticate Tableau Bridge (on Linux) to Tableau Cloud. This enables secure, JWT-based authentication for Bridge connections, allowing you to manage Bridge authentication alongside your other Tableau Cloud access management workflows. Using UATs with Tableau Bridge provides the same benefits as using UATs with the TCM and Tableau REST APIs, including least-privileged access through scopes, centralized token management, and improved auditing capabilities for Bridge connections. When configuring the UAT, ensure the `scope` or `scp` claim specifies the following: - `tableau:remote_agents:*` - `tableau:jobs:read` - `tableau:file_uploads:*` - `tableau:datasources:*` For more information about configuring Tableau Bridge to use UATs, see [Step 4: Run the Bridge container](https://help.tableau.com/current/online/en-us/to_bridge_linux_install.htm#step-4-run-the-bridge-container) in the Tableau Cloud Help. **Table of Contents** ### About least privileged access and access scopes Using UATs, you can access both the TCM REST API and Tableau REST API. Access to these APIs are enabled by a JSON Web Token (JWT) as part of the initial sign in request. To enable least-privileged access, the JWT must contain **access scopes** that define the API methods that are available to the UAT. You can also specify a subset of those scopes in the UAT configuration itself to further restrict the access available to the JWT. #### Access scopes Scopes for UATs grant access to TCM REST API and Tableau REST API capabilities. Scopes are declared in the JWT (or in both the JWT and UAT configuration). A scope is a colon-separated string with the following format: `tableau::`. The scope starts with the Tableau namespace, `tableau`, followed by the resource, such as `tcm_sites` or `sites`, and ends with an action allowed on the resource, such as `read`. You can find the required scope for a JWT-supported method in its properties block in the [TCM REST API](https://help.tableau.com/current/api/cloud-manager/en-us/reference/index.htm) Help and [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm) Help. If a scope is not listed in the method’s properties block, access to that method can’t be controlled by a JWT. **Note:** Access scopes listed in the Tableau REST API are shared and also used to grant access to REST API capabilities using Tableau connected apps. **Examples:** - A scope that allows you to call the [Get site](/current/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSite) method in the TCM REST API is `tableau:tcm_sites:read`. - A scope that allows you to call the [Query site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#query_site) method in the Tableau REST API is `tableau:sites:read`. #### Wildcard access scopes Instead of using the named access scope, you can replace the action in the scope string with the wildcard character (\*). Doing this can enable multiple supported actions for the given resource. **Examples:** - A wildcard scope that allows you to call certain [Users Methods](/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods) in the TCM REST API is `tableau:tcm_users:*`. - A wildcard scope that allows you to call get/list, add, delete, and update users methods in [Users and Groups Methods](https://help.tableau.com/current/api/rest_api) in the Tableau REST API is `tableau:users:*`. ## JWT authentication using unified access tokens This section outlines the required steps for authenticating with both the TCM REST API and Tableau REST API using unified access tokens (UAT) JWT. **Prerequisite - obtain a signing keypair**: Generate an RSA keypair or use an existing identity provider (IdP) that exposes a public key via JWKS. 1. **Sign in to TCM REST API**: Start an initial session to configure the UAT (using a personal access token). 2. **Create a UAT configuration**: Use the TCM REST API to create a UAT configuration, providing the JWKS URI or public key, from your IdP or keypair respectively. 3. **Generate and sign a JWT**: Create a JWT with the required claims and sign it with your private key. 4. **Sign in with the UAT JWT**: Make a sign-in request to either the TCM REST API or Tableau REST API using the signed JWT. 5. **Use the credentials token in subsequent requests**: Use the returned credentials token in the header of all subsequent API requests. ### Prerequisite: Obtain a signing keypair Before you can create a unified access token (UAT) configuration, you must have a signing keypair (private key + public key). The public key will be registered in the UAT configuration, and the private key will be used to sign JWTs during authentication. This enables cloud administrators to interact with the tenant and its resources; and users to interact with the site and its resources. - **Recommended option - use an existing identity provider:** We recommend you use your IdP such as Okta, Auth0, or another OIDC-compliant provider. Most IdPs already expose a JWKS (JSON Web Key Set) endpoint that serves public keys. This approach provides automatic key rotation and centralized key management. When creating the UAT configuration, you’ll provide the `jwksUri` that points to your IdP’s JWKS endpoint. - **Alternative option - generate your own RSA keypair:** If you don’t have an existing IdP or prefer to manage your own keys, you can generate an RSA keypair (RS256 algorithm recommended). When creating the UAT configuration, you’ll provide the `publicKey` inline. **Important:** This approach requires manual key rotation. ### Step 1: Sign in to Tableau Cloud Manager REST API To create your first unified access token (UAT) configuration, you must authenticate to the Tableau Cloud Manager (TCM) REST API. This initial authentication can’t be done with a UAT. - **First time workflow:** If authenticating to the TCM REST API for the first time, follow the steps described in [Sign in to Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html#sign-in-to-tableau-cloud-manager-rest-api). - **Returning workflow:** If you’ve previously signed in to the TCM REST API, authenticate using the [Sign in with personal access token](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/personalAccessTokenLogin) method. ### Step 2: Create a unified access token configuration Use the [Create unified access token configuration](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/createUatConfiguration) method to configure a UAT in the TCM REST API. This step registers the JWKS URI or public key that Tableau will use to verify JWTs signed with your private key. #### Example URI `POST https://cloudmanager.tableau.com/api/v1/uat-configurations` #### Example request body The request body must contain the following: - **Issuer:** The `issuer` value that will be matched against the `iss` claim in your JWTs. - **JWKS URI or public key:** - **Recommended option:** `jwksUri` pointing to your IdP’s JWKS endpoint (e.g., `https://myidp.okta.com/.well-known/jwks.json`) - **Alternative option:** `publicKey` containing the public key portion of your RSA keypair in PEM format - **Resource IDs:** An array of IDs. This can include the tenant ID, the tenant ID and the site IDs associated with the tenant, or one or more site IDs on the same tenant. **Note:** Specifying the tenant ID alone does not enable the UAT for all sites in the tenant. You must specify the site ID for each site you want to enable. **Example with JWKS URI (recommended)** ``` { "name": "UAT for FTE Admins", "issuer": "https://myidp.okta.com", "jwksUri": "https://myidp.okta.com/.well-known/jwks.json", "usernameClaim": "email", "resourceIds": [ "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], "scopes": [ "tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update" ], "enabled": true } ``` **Example with public key (alternative)** ``` { "name": "UAT for FTE Admins", "issuer": "https://myidp.okta.com", "publicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7...\n-----END PUBLIC KEY-----", "usernameClaim": "email", "resourceIds": [ "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], "scopes": [ "tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update" ], "enabled": true } ``` #### Example response body The request produces the following response body. ``` { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", "configId": "46ff6d11-d8b2-40d8-9197-dfa33c61cd6c", "name": "UAT for FTE Admins", "issuer": "https://myidp.okta.com", "publicKeyActive": "...", "publicKey": "...", "jwksUri": "https://myidp.okta.com/keys", "usernameClaim": "email", "resourceIds": [ "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], "scopes": [ "tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update" ] "enabled": true } ``` ### Step 3: Generate and sign a JWT After the UAT configuration is created, you generate a JWT with the required claims and sign it with your private key. How you generate and sign the JWT depends on the option you chose in the prerequisite: - **Using an identity provider (IdP):** Your IdP typically generates and signs the JWT for you through its token endpoint or SDK, so you don’t handle the private key directly. Include a `kid` header that matches a key ID published in your IdP’s JWKS so Tableau can select the correct public key to verify the signature. - **Using your own RSA keypair:** You build the JWT and sign it yourself with the private key portion of your keypair, as shown in the example below. Tableau verifies the signature using the inline `publicKey` you provided in the UAT configuration. The JWT has required and optional claims. **Required claims** | Claim | Name | Description | | --- | --- | --- | | `alg` | Algorithm | (In header) JWT signing algorithm. For example, RS256. | | `iss` | Issuer | Unique issuer URI. Must match the `issuer` in the UAT configuration. | | `exp` | Expiration time | Expiration time in seconds from Epoch (Unix epoch time). | | `https://tableau.com/tenantId` | Tenant ID | Unique identifier of the tenant. Must match a resource ID in the UAT configuration. | | `iat` | Issue at | JWT creation time in seconds from Epoch (Unix epoch time). | | `` | Username | Username claim that maps to the Tableau user. For tenant, the user must map to the TCM user. For site, the user must map to the Tableau Cloud site user. If the claim is not specified, `email` is used as default. | **Optional claims** | Claim | Name | Description | | --- | --- | --- | | `kid` | Secret ID | (In header, if supplied by the Idp) Secret key identifier. Required if `jwksUri` is used in the UAT configuration. | | `typ` | Type | (In header, if supplied by the IdP) Type of JWT. Value must be `jwt`. | | `jti` | JWT ID | Required for JWT revoke capabilities. | | `scp`, `scope` | Scope | Access scopes. Defines the allowed operations. If using “scp”, values must be an array of strings. If using “scope”, values must be space delimited strings. | | `https://tableau.com/issuerOverride` | Issuer override | Enables a UAT configuration to use the same `tenantId` and `iss` combination. If used, the `iss` value in the second UAT configuration must be set to `https://tableau.com/issuerOverride`. | | `https://tableau.com/siteId` | Site ID | (Site-specific) Unique identifier of the site. Enables the UAT for the specified site only. Any other resource IDs specified in the UAT configuration will be ignored. | | `sub` | Subject | (Site-specific) User name (in email address format) that maps to the Tableau Cloud site user in embedding workflows. | | `https://tableau.com/oda` | On-demand access - capability | (Site-specific) Enables on-demand access in embedding workflows. Value must be `true`. | | `https://tableau.com/groups` | On-demand access - groups | (Site-specific) Name of one or more groups where access permissions are enabled for on-demand access. | | `https://tableau.com/groups` | Dynamic group membership | (Site-specific) Name of one or more groups on the Tableau Cloud site enabled for dynamic group membership. | | `` | (User attribute values) | (Site-specific) Enables user attributes in user attribute functions (UAF) in embedding workflows. | #### Example JWT Here is an example JWT in Python that demonstrates required and optional claims. The Python example uses the PyJWT library to sign the JWT with the private key from your keypair. ``` import jwt import datetime # Private key used to sign the JWT. The corresponding public key is referenced by the UAT configuration, either the JWKS endpoint (jwksUri) or inline (publicKey). private_key = """-----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7... -----END PRIVATE KEY-----""" payload = { "iss": "https://myidp.okta.com", "exp": 1788384855, "https://tableau.com/tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", "iat": 1756848855, "jti": "https://myidp.okta.com:1756848855123", "username": "user@myidp.com", "scp": ["tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update"], "https://tableau.com/oda": "true", "https://tableau.com/groups": ["Contractors", "Team C", "Group1", "Group2"], # Example groups "Region": "East" # Example user attribute } headers = { "kid": "kid", "typ": "JWT" } # Encode and sign the token with the private key token = jwt.encode( payload, key=private_key, alg="RS256", headers=headers ) ``` ### Step 4: Make a sign in request with unified access token JWT After the UAT is configured, you can use the JWT (generated in Step 3) to sign in to either the Tableau Cloud Manager (TCM) REST API or Tableau REST API. #### Sign in to TCM REST API Use the [Sign in with unified access token JWT](/current/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/jwtLogin) method to generate a TCM credentials token. **Example URI** `POST https://cloudmanager.tableau.com/api/v1/jwt/login` **Example request body** The request body must contain the JWT (as the `token` value) associated with the UAT configuration you created in **Step 2**. ``` { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30" } ``` **Example response body** The request produces the following response body. The response includes the TCM credentials token, `sessionToken`. ``` { "sessionToken": "bSG+6ttrRgqMLzonp5j89w==:SUOF-rjwMZZKXg-T3GcpDVFrIKAO6VIbTyZyq39bWR0", "userId": "306982a2-4bb0-b858-b82eeI24b857", "tenantId": "56978815-59b6-4a61-b9e8-ede126e23bab", "sessionExpiration": "2025-0706T84:53:13.688541Z" } ``` #### Sign in to Tableau REST API You can use the same UAT configuration to sign in to the Tableau REST API using the [Sign in with JWT](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#jwt) method to generate a Tableau credentials token for Tableau Cloud. **Example URI** `POST https://mypod.online.tableau.com/api/3.27/auth/signin` **Note:** The URI requires you to include the Tableau Cloud pod name, such as prod-ca-a, eu-west-1a, or pro-apsoutheast-a. If you don’t know the pod name, see [About the pod name](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#pod) in the Tableau REST API Help. **Example request body** The request body must contain the following: 1. **JWT:** JSON Web Token (JWT) associated with the UAT configuration you created in **Step 2**. 2. **`isUAT`:** Must be set to `true`. This attribute is required to sign in with UAT JWT. Ignore this attribute to sign in with a Tableau connected apps JWT. 3. **`contentUrl`:** A required attribute for Tableau Cloud sign-in. For more information, see [About the Site Attribute](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#about-the-site-attribute) in the Tableau REST API Help. ``` { "credentials": { "jwt": "eyJpc3MiOiI1NmUwZGZhYi0zNDA3LTRlNWMtYWY5Ni04YzI1ZmY0NWI3ODMiLCJhbGciOiJIUzI1NiIsImtpZCI6ImJlNzFkNDc0LWMxOTctNDljNS04ZWIzLTM5YWU4MWVjNDNhYyJ9.eyJhdWQiOiJ0YWJsZWF1Iiwic3ViIjoidGVzdDEyMyIsInNjcCI6WyJ0YWJsZWF1OmNvbnRlbnQ6cmVhZCJdLCJpc3MiOiI1NmUwZGZhYi0zNDA3LTRlNWMtYWY5Ni04YzI1ZmY0NWI3ODMiLCJleHAiOjE2NDc2MjM1NzUsImp0aSI6ImY0MzdkNDFmLWM1MmMtNGE5Mi1hYTA1LWFjYTYyMGViZTgzMSJ9.pntsSpHmrxTT5XmiJi1Ls2qQdu4qMRQ5vgRuN7gtS_U", "isUat": true, "site": { "contentUrl": "" } } } ``` **Example response body** The request produces the following response body. The response includes the Tableau credentials token, `token`. ``` { "credentials": { "site": { "id": "9a8b7c6d5-e4f3-a2b1-c0d9-e8f7a6b5c4d", "contentUrl": "" }, "user": { "id": "9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" }, "token": "HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3" } } ``` ### Step 5: Include the session header in subsequent requests Use the credentials token you generated in **Step 4** to make subsequent requests. #### For Tableau Cloud Manager REST API Add the `sessionToken` to the `x-tableau-session-token` header for all subsequent TCM REST API requests. **Example header** `x-tableau-session-token:+iUzQx+s:E9T43sqund-xDGle-9trR7WPLkqCkT_7zks3_dVsV0By_Jji` The TCM credentials token is short-lived. It expires after 4 hours or when the session is idle for 30 continuous minutes with no requests. When the TCM credentials token expires, you need to sign in to Tableau Cloud Manager REST API again to get a new TCM credentials token. #### For Tableau REST API Add the `token` to the `X-Tableau-Auth` header for all subsequent Tableau REST API requests. **Example header** `X-Tableau-Auth:HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3` The Tableau credentials token is short-lived. It expires after 120 minutes (2 hours) or when the session is idle for 30 continuous minutes with no requests. When the Tableau credentials token expires, you need to sign in to Tableau REST API again to get a new Tableau credentials token. ## Monitor unified access token activity You can monitor unified access token (UAT) activity through the event log methods. The methods can retrieve up to 14 days of activity data or additional days of data if you have Enterprise or the Advanced Management add-on. ### Tenant-level monitoring You can use the **Get activity logs for tenant** and **List activity logs for tenant** to monitor UAT configuration changes and TCM REST API sign-in with a UAT JWT. For example, you can query the following event types (`eventType`) in the [List activity logs for tenant](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getActivityLogFileListForTenant) method: - `create_or_update_uat_configuration` - `delete_uat_configuration` - `create_uat_revocation` - `delete_uat_revocation` - `validate_uat_jwt` For more information about each event, see [Activity Log Tenant Event Type Reference](https://help.tableau.com/current/online/en-us/activity_log_tenant_schema.htm) in the Tableau Cloud Help. ### Site-level monitoring You can use the **Get activity logs for site** and **List activity logs for site** to monitor Tableau REST API sign-in with a UAT JWT. For example, you can query the following event type (`eventType`) using the [List activity logs for site](/current/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getSiteActivityLogListForSite) method: - `login_with_jwt` For more information about the event, see [Activity Log Site Event Type Reference](https://help.tableau.com/current/online/en-us/activity_log_schema.htm) in the Tableau Cloud Help.