---
schema_version: "1"
id: 134155c3b4b421307c7c6660efe75255a057af46082b8b7530ecd2a79dd99535
title: Authentication Methods
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/api/rest_api/REST/rest_api_ref_authentication.md
canonical_url: https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 4096bfb2880c2384e4b0acf9031cb13bb77bbd5054f85b9bcdada9775c6c61ab
description: "Using the authentication methods of the Tableau REST API you can:"
---
[Skip to main content](#main-content)

# Authentication Methods

Using the authentication methods of the Tableau REST API you can:

- Sign in a user to Tableau Server or Tableau Cloud
    - Authenticate with a [personal access token](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) (PAT) for improved security with granular monitoring and revocation
        - If you're any Tableau Cloud user, you can list and revoke PATs
        - If you're a Tableau Cloud site admin, you can list and revoke users' PATs
    - Authenticate with username and password for quick manual sign in for all users and user impersonation for administrators
    - Authorize access using a Tableau connected app and a JSON Web Token (JWT)
    - Authorize access using a unified access token and a JSON Web Token (JWT)
    - Impersonate a user if you are a Tableau Server administrator, using username and password or PAT
- Sign out a user from a Tableau server
- Switch the from the current site you are signed into, to another on the server without authenticating again

This functionality relates to the UI elements and concepts described at: [Sign in to Tableau Server or Online](https://help.tableau.com/current/pro/desktop/en-us/sign_in_server.htm).

  

The [Tableau Server Client library](https://tableau.github.io/server-client-python/), a Python wrapper for the REST API, offers the following related items: [Auth Methods](https://tableau.github.io/server-client-python/docs/api-ref#authentication); and [Sign In and Out](https://tableau.github.io/server-client-python/docs/sign-in-out).

## Use Postman

Our Postman collection of requests enables you to construct, send, and examine HTTP requests to the Tableau Server or Tableau Cloud API without writing initial code. Postman is a free online app used by many developers for prototyping API calls, investigating issues, and generating request code in a variety of languages.

[Postman: Authenticate](https://www.postman.com/salesforce-developers/salesforce-developers/folder/2b4ttqa/authenticate)

## List Personal Access Tokens

List all personal access tokens (PATs). If you're a site admin, list PATs of a user when you are the site admin on all sites that the PAT owner is a member of.

This method is not available for Tableau Server.

**Version:** Available in API 3.21 (Tableau Cloud October 2023) and later._[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Any Tableau Cloud user. If you're a Tableau Cloud site admin, you can list the PATs of a user when you are the site admin on all sites that the PAT owner is a member of. _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** Not available.

#### URI

GET /api/api-version/sites/site-luid/users/user-luid/personal-access-tokens

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">user-luid</span></td><td>The LUID of the user. The user LUID is returned after you successfully authenticate to the Tableau REST&nbsp;API.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "http://myco/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/d5704762-603a-42b2-a9a7-f9cd2b2c4253/personal-access-tokens" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Code

200

#### Response Body

Copy

```
<tsResponse>    <personalAccessTokens>        <personalAccessToken tokenName="user_pat1" tokenGuid="011b6267-a067-473a-9d16-b34cc58f90df" lastUsedAt="2023-06-13T16:55:46Z" expiresAt="2024-06-12T16:55:46Z"/>        <personalAccessToken tokenName="user_pat4" tokenGuid="0fb30637-b638-4ce2-bbac-ac6611104ed9" lastUsedAt="2023-06-13T16:55:51Z" expiresAt="2024-06-12T16:55:51Z"/>        <personalAccessToken tokenName="user_pat5" tokenGuid="db8c0b5d-5946-4f7c-a966-af334a3d10a5" lastUsedAt="2023-06-13T16:55:56Z" expiresAt="2024-06-12T16:55:56Z"/>    </personalAccessTokens></tsResponse>
```

Copy

```
{  "personalAccessTokens": [    {      "tokenName": "user_pat1",      "tokenGuid": "011b6267-a067-473a-9d16-b34cc58f90df",      "lastUsedAt": "2023-06-13T16:55:46Z",      "expiresAt": "2024-06-12T16:55:46Z"    },    {      "tokenName": "user_pat4",      "tokenGuid": "0fb30637-b638-4ce2-bbac-ac6611104ed9",      "lastUsedAt": "2023-06-13T16:55:51Z",      "expiresAt": "2024-06-12T16:55:51Z"    },    {      "tokenName": "user_pat5",      "tokenGuid": "db8c0b5d-5946-4f7c-a966-af334a3d10a5",      "lastUsedAt": "2023-06-13T16:55:56Z",      "expiresAt": "2024-06-12T16:55:56Z"    }  ]}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header was invalid or has expired.</td></tr><tr><td>403</td><td>403004</td><td>Forbidden</td><td>You can only list PATs that are yours.</td></tr><tr><td>403</td><td>403010</td><td>Cross-site access is forbidden</td><td>You're a site admin and can't list PATs when you're not the site admin for all sites the PAT&nbsp;owner is a member of.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Revoke Administrator Personal Access Tokens

Revokes all [personal access tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) (PATs) created by server administrators. This method is not available for Tableau Cloud.

#### URI

DELETE /api/api-version/auth/serverAdminAccessTokens

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Only Tableau Server users with server administrator permissions can use this method.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:server_admin_tokens:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 3.11 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>403</td><td>403004</td><td>Revoke server admin tokens forbidden,</td><td>The user does not have the server administrator permissions required to call this method.</td></tr><tr><td>404</td><td>404000</td><td>Server not found</td><td>The Tableau Server in the URI doesn't correspond to an existing server.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Revoke Personal Access Token

Revoke a personal access token (PAT). If you're a site admin, you can revoke a users PAT owhen you are the site admin on all sites that the PAT owner is a member of.

This method is not available for Tableau Server.

**Version:** Available in API 3.21 (Tableau Cloud October 2023) and later._[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Any Tableau Cloud user. If you're a Tableau Cloud site admin, you can revoke the PAT of a user when you are the site admin on all sites that the PAT owner is a member of. _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** Not available.

#### URI

DELETE /api/api-version/sites/site-luid/users/user-luid/personal-access-tokens/pat-name

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">user-luid</span></td><td>The LUID of the user. The user LUID is returned after you successfully authenticate to the Tableau REST&nbsp;API.</td></tr><tr><td><span class="api-placeholder">pat-name</span></td><td>The name of the PAT you want to revoke.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "http://myco/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/d5704762-603a-42b2-a9a7-f9cd2b2c4253/personal-access-tokens/my_pat" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Code

204

#### Response Body

None

#### Errors

<table class="api-error-table">
                            <colgroup>
                                <col class="api-error-table-col-1">
                                <col class="api-error-table-col-2">
                                <col class="api-error-table-col-3">
                                <col>
                            </colgroup>
                            <tbody>
                                <tr>
                                    <th>HTTP status</th>
                                    <th><code>error</code> Code</th>
                                    <th>Condition</th>
                                    <th>Details</th>
                                </tr>
                                <tr>
                                    <td>401</td>
                                    <td>401002</td>
                                    <td>Unauthorized Access</td>
                                    <td>The credentials token provided in the request header was invalid or has expired.</td>
                                </tr>
                                <tr>
                                    <td>403</td>
                                    <td>403004</td>
                                    <td>Forbidden</td>
                                    <td>You can only revoke PATs that are yours.</td>
                                </tr>
                                <tr>
                                    <td>403</td>
                                    <td>403010</td>
                                    <td>Cross-site access is forbidden</td>
                                    <td>You're a site admin and can't revoke a PAT when you're not the site admin for all sites the PAT&nbsp;owner is a member of.</td>
                                </tr>
                                <tr>
                                    <td>404</td>
                                    <td>404051</td>
                                    <td>Personal access token not found</td>
                                    <td>The PAT couldn't be revoked because it does not exist.</td>
                                </tr>
                                <tr>
                                    <td>405</td>
                                    <td>405000</td>
                                    <td>Not supported</td>
                                    <td>This error can occur for the following reasons:
                            <ul><li>The URI&nbsp;contains an incorrect PAT&nbsp;name or  the PAT&nbsp;name is missing</li><li>The request type is not <span class="api-command-ref">DELETE</span></li></ul></td>
                                </tr>
                            </tbody>
                        </table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Sign In

Signs you in as a user on the specified site on Tableau Server or Tableau Cloud.

This call returns a credentials token that you use in subsequent calls to Tableau Server or Tableau Cloud. For more information about authentication, see [Signing In and Signing Out (Authentication)](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm).

**Notes:**

- [SAML single sign on](https://help.tableau.com/current/server/en-us/saml_requ.htm) (SSO) authentication does not validate REST API requests. For a scenario where you want to integrate Tableau authentication into a SSO environment you will need to incorporate a REST sign in request, and then use the credentials token from its response in the header of subsequent requests.
- The credentials token is valid for REST API calls and Tableau Metadata API (GraphQL) queries. You cannot use the credentials token as authentication for other operations with Tableau Server. In addition, the credentials token is good only for operations in the site that you're signed in to. You cannot sign in to one site and then use the credentials token you get back to send requests to a different site. If you do, the server returns an HTTP 403 (Forbidden) error.
- (Tableau Cloud only) If multi-factor authentication (MFA) is enabled with Tableau authentication, PATs are required. You must use a PAT, instead of user name and password, to make a REST API sign in request to Tableau Cloud. Alternatively, you can use a unified access token (UAT) to sign in to Tableau Cloud.

**Tableau Server**

Typically, a credentials token is valid for 240 minutes. With administrator permissions on Tableau Server, you can change this timeout by using the [tsm configuration set](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) command and setting the wgserver.session.idle\_limit option.

In addition, if you are a Tableau Server administrator, you can use your username and password to sign in and impersonate a specific user. You might use impersonation in order to double check or troubleshoot the impact of permissions settings for that user.

**Tableau Cloud**

A credentials token is valid for 120 minutes on Tableau Cloud.

#### URI

POST /api/api-version/auth/signin

**Note:** For Tableau Cloud, the server address in the URI must contain the pod name, such as prod-ca-a or us-east-1. For example, the URI to sign in to a site in the 10ay pod would be:https://prod-ca-a.online.tableau.com/api/api-version/auth/signin. For more information, see [About the pod name](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#pod).

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr></tbody></table>

#### Request Body

### PAT

Signing in with a user's personal access token (PAT): 

- For Tableau Server, see [personal access token](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm).
- For Tableau Cloud, see [personal access token](https://help.tableau.com/current/online/en-us/security_personal_access_tokens.htm).

```
<tsRequest>
  <credentials personalAccessTokenName="personal-access-token-name"
    personalAccessTokenSecret="personal-access-token-secret" >
      <site contentUrl="content-url" />
  </credentials>
</tsRequest>
```

### User name and password

Signing in with a user's user name and password:

```
<tsRequest>
  <credentials name="username" password="password" >
    <site contentUrl="content-url" />
  </credentials>
</tsRequest>
```

### Impersonating user using username and password

Signing in with server administrator's username and password to impersonate a user (Tableau Server only):

```
<tsRequest>
  <credentials name="username" password="password" >
	<site contentUrl="content-url" />
	<user id="user-to-impersonate" />
  </credentials>
</tsRequest>
```

### Impersonating user using PAT

Signing in with server administrator's [personal access token](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) (PAT) to impersonate a user (Tableau Server only):

```
<tsRequest>
  <credentials personalAccessTokenName="personal-access-token-name"
    personalAccessTokenSecret="personal-access-token-secret" >
	  <site contentUrl="content-url" />
	  <user id="user-to-impersonate" />
  </credentials>
</tsRequest>
```

### Connected apps JWT

Signing in with a JSON Web Token (JWT), from a [connected app](https://help.tableau.com/current/online/en-us/connected_apps.htm) (added in Tableau Cloud June 2022 (API 3.16); Tableau Server 2022.3 (API 3.17)):

```
<tsRequest>
  <credentials jwt="json-web-token"
  <site contentUrl="content-url" />
  </credentials>
</tsRequest>
```

When a JWT sign-in is used, the JWT must be configured with the scopes of the REST API methods the connected app can access. You can find the scope for a JWT-supported method in a method's properties block or references details under the **Access scope** section. These sections show the scope declaration to use in the JWT that calls that method.

**Note:** Beginning in API 3.20 (June 2023) for Tableau Cloud and API 3.21 (Tableau 2023.3) for Tableau Server, the Sign In (and Sign Out) method is supported by JWT authorization using connected apps but does not require a scope to use.

**About connected app errors**

If you encounter issues with signing in with a JWT, the response body is appended with an additional error code that you can reference in [Troubleshoot scopes](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm#signin) (Tableau Cloud Help) or [Troubleshoot scopes](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm#signin) (Tableau Server Help). For example, in the following response body, you can reference “10084” to help troubleshoot issues with signing in to Tableau Cloud or Tableau Server using a JWT for REST API authorization.

<error code="401001">
  "summary": "Signin Error",
  "detail": "Error signing in to Tableau Cloud (10084)"
</error>

### Unified access tokens JWT

Signing in with a JSON Web Token (JWT) using a unified access token (added in Tableau Cloud December 2025 (API 3.27)):

XML

```
<tsRequest>
  <credentials jwt="json-web-token"
	isUat="true"
  <site contentUrl="content-url" />
  </credentials>
</tsRequest>
```

JSON

```
{
	"credentials": {
	"jwt": "json-web-token",
	"isUat": is-uat,
	"site": {
	"contentUrl": ""
			}
	}
}
```

When JWT sign-in is used, the JWT must be configured with the scopes for the REST API capabilities that should be available to the unified access token (UAT). You can find the scope for a JWT-supported method in a method's properties block. The properties block shows the scope declaration to use in the JWT that calls that method. If a scope is not listed in the method's properties block, access to that method can't be limited by a JWT.

For more information about UATs, see [Unified Access Tokens](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html) in the Tableau Cloud Manager REST API Help.

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">personal-access-token-name</span>
                                        </td>
                                        <td>
                                            <p>The name of the personal access token when signing in with a personal access token. The token name is available on a user’s account page on Tableau server or online.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">personal-access-token-secret</span>
                                        </td>
                                        <td>
                                            <p>The secret value of the personal access token when signing in with a personal access token. The value of the secret is available only in the dialog that appears when a user <a href="https://help.tableau.com/current/pro/desktop/en-us/useracct.htm#pat" ref="noreferrer" target="_blank">creates a personal access token</a> as described in the Tableau Help.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">username</span>
                                        </td>
                                        <td>
                                    The name of the user when signing in with username and password. The name and password in the <span class="api-command-ref">&lt;credentials&gt;</span> element can represent any user
                                    in the specified site. If the user is not an administrator, they might have limited permissions to perform subsequent operations.
                                    <p class="note"><strong>Note</strong>: If the server is configured to use Active Directory authentication, and if the user name is not unique across domains,
                                        you must include the domain as part of the user name (for example, <span class="uicontrol">domain_name\Adam</span>).
                                    </p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">password</span>
                                        </td>
                                        <td>The password when signing in with username and password.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">json-web-token</span>
                                        </td>
                                        <td>A JSON&nbsp;Web Token (JWT) associated with a Tableau connected app or unified access token (Tableau Cloud only).
                                <p> <b>Tableau connected apps JWT:</b> If using Tableau connected apps, the JWT&nbsp;uses a shared secret provided by the Tableau <a href="https://help.tableau.com/current/online/en-us/connected_apps.htm" target="_blank" rel="noreferrer">connected app</a> and signed by your external application. Depending on the method used to create the connected app, a JWT can be generated by the connected app as part of the external app's call to sign in to Tableau. The JWT must include
			<a href="https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm" target="_blank" rel="noreferrer">access scopes</a>
								that determine which REST methods the external app can call.
</p><p><b>Unified access tokens:</b> Starting in December 2025, if using unified access tokens (UATs), the JWT uses a shared secret as part of the UAT configuration. Added in API 3.27, Tableau Cloud only.</p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">is-uat</span>
                                        </td>
                                        <td>Enables JWT authorization using a unified access token (UAT) when set to <b>true</b>. Added in API 3.27, Tableau Cloud only.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">content-url</span>
                                        </td>
                                        <td>
                                            <p>The permanent name of the site to sign in to. The content URL appears in the URL path of Tableau content in your browser address bar after the Tableau Server URL.</p>
                                            <p><code>mySite</code> is the content URL in the following example:</p>
                                            <p><code>http://&lt;server or cloud URL&gt;/#/site/<strong>mySite</strong>/explore</code>
                                            </p>
                                            <p>
									For Tableau Server, to specify the default site, omit <code>contentUrl</code> from the <code>site</code> element,
								or make the <code>contentUrl</code> value an empty string (<code>contentUrl=""</code>).</p>
                                            <p>
									For Tableau Cloud, a sign-in request must have a <code>site</code> element containing a <code>contentUrl</code> with
								the value of an existing site. If these are missing, the sign-in request will fail.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-to-impersonate</span>
                                        </td>
                                        <td>
								The LUID of a user to sign in as. For impersonation when a system administrator signs in with user name and password.
							</td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Any Tableau user can sign in through the REST API. A user that does not have administrator permissions will have limited permissions to perform subsequent operations. Only server administrators can sign in with username and password in order to impersonate other Tableau Server users.

#### Response Code

200

#### Response Body

```
<tsResponse>
  <credentials token="authentication-token"
	  estimatedTimeToExpiration="time-to-expiration" >
	    <site id="site-id" contentUrl="content-url" />
	    <user id="user-id-of-signed-in-user"
  </credentials>
</tsResponse>
```

An `estimatedTimeToExpiration` value is returned when you sign in using a PAT. The value represents the approximate time until the PAT will expire and need to be refreshed. The estimated time is based on regular usage of the token for authenticating calls, but actual time may be shorter if the token is unused for an extended length of time.

The `estimatedTimeToExpiration` value uses the format `DAYS:HH:MM`, where:

- The first segment represents **days**
- The second segment represents **hours**
- The third segment represents **minutes**

For example, a value of `2:12:30` indicates 2 days, 12 hours, and 30 minutes until expiration. This format does _not_ represent hours:minutes:seconds.

For more information, see the following:

- Tableau Cloud - [About PAT expiration](https://help.tableau.com/current/online/en-us/security_personal_access_tokens.htm#about-pat-expiration)
- Tableau Server - [Change personal access tokens expiry](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm#change-personal-access-tokens-expiry)

#### Version

Version 1.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"><col class="api-error-table-col-2"><col class="api-error-table-col-3"><col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains both username/password and a personal access token, or contains malformed XML.</td></tr><tr><td>401</td><td>401001</td><td>Login error</td><td>The credentials (name or password, or personal access token name or secret) are invalid for the specified site, or the site contentURL is invalid.</td></tr><tr><td>401</td><td>401001</td><td>Login error</td><td>Login is blocked because several requests with invalid credentials were made.</td></tr><tr><td>401</td><td>401001</td><td>Login error</td><td>The Administrator requires the user to update their password.</td></tr><tr><td>401</td><td>401001</td><td>Login error</td><td>The password has expired.</td></tr><tr><td>401</td><td>401009</td><td>Login error</td><td>The request body is missing or empty.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">POST</span>.
							<p>If you are signing in to a Tableau Cloud site, this error may be caused by leaving the pod name out of the server address in the URI.</p><p>The error can also be caused by attempting to make a request to a SSL-protected server using HTTP, rather than HTTPS.</p></td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "https://MY-SERVER/api/3.29/auth/signin" -X POST -d @signin.xml`

**Content of signin.xml:**

```
<tsRequest>
  <credentials personalAccessTokenName="MY_PAT_NAME"
	personalAccessTokenSecret="vFel4qtGTZ2+Po0ZWT7YWg==:nMmSHnQ5kJBP17ZtsBgPtuVWdYJFAbBG"  >
      <site contentUrl="MarketingSite" />
  </credentials>
</tsRequest>
```

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <credentials token="HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3">
    <site id="9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
          contentUrl="MarketingSite"/>
  </credentials>
</tsResponse>
```

## Sign Out

Signs you out of the current session. This call invalidates the authentication token that is created by a call to [Sign In](#sign_in).

**Notes:**

- Beginning in API 3.20 (June 2023) for Tableau Cloud and API 3.21 (Tableau 2023.3) for Tableau Server, the Sign Out (and Sign In) method is supported by JWT authorization but does not require a scope to use. For more information, see [JWT](#jwt).

#### URI

POST /api/api-version/auth/signout

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Any user can call this method.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:*:*
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 1.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">POST</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Examples

`curl "http://MY-SERVER/api/3.29/auth/signout" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

## Switch Site

Switches you onto another site without having to provide a user name and password again.

This method allows an authenticated user to switch sites that they have access to. When you call this method, you must provide the current authorization token as the value of the X-Tableau-Auth header. Using the current authentication token, the method signs you in as a user on the site specified in the request payload. The method returns a new authentication token and invalidates the old one. You have the permissions of the user associated with the authorization token. By default, the token is good for 240 minutes. (You can specify a different timeout value for the token by calling the `tsm configuration set` command to change the wgserver.session.idle\_limit setting.)

**Note** This method is not available on Tableau Cloud.

#### URI

POST /api/api-version/auth/switchSite

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
   <site contentUrl="content-url" />
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">content-url</span>
                                        </td>
                                        <td>
                                            <p>The permanent name of the site to sign in to. The content URL appears in the URL path of Tableau content in your browser address bar after the Tableau Server URL.</p>
                                            <p><code>mySite</code> is the content URL in the following example:</p>
                                            <p><code>http://&lt;server or cloud URL&gt;/#/site/<strong>mySite</strong>/explore</code>
                                            </p>
                                            <p>
									For Tableau Server, to specify the default site, omit <code>contentUrl</code> from the <code>site</code> element,
								or make the <code>contentUrl</code> value an empty string (<code>contentUrl=""</code>).</p>
                                            <p>
									For Tableau Cloud, a sign-in request must have a <code>site</code> element containing a <code>contentUrl</code> with
								the value of an existing site. If these are missing, the sign-in request will fail.</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Tableau Server users who are not server administrators can switch sites, provided that they have access to the destination site.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:sites:switch
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
  <credentials token="authentication-token" >
    <site id="site-id" contentUrl="content-url" />
    <user id="user-id-of-signed-in-user" />
  </credentials>
</tsResponse>
```

#### Version

Version 2.6 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401000</td><td>Unauthorized access</td><td>No authentication credentials were provided.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized access</td><td>Invalid authentication credentials were provided.</td></tr><tr><td>401</td><td>401003</td><td>Switch site error</td><td>There was a problem switching sites. The site might be unavailable or is not found.</td></tr><tr><td>403</td><td>403070</td><td>Cannot switch to the same site</td><td>The site specified as the destination site is also the current site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">POST</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "https://MY-SERVER/api/3.29/auth/switchSite" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"-d @switch_site.xml`

**Content of switch\_site.xml:**

```
<tsRequest>
   <site contentUrl="MarketingSite" />
</tsRequest>
```

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <credentials token="HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3">
    <site id="9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
          contentUrl="MarketingSite"/>
  </credentials>
</tsResponse>
```