---
schema_version: "1"
id: e0f285a411fbc9100cd472739bc7b0cbb7b0115cae643e4fe289042e8603b2fd
title: Connected App Methods
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/api/rest_api/REST/rest_api_ref_connected_app.md
canonical_url: https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 12d25d3afe3e4495f8f9e0dc2ca1246a81d6c2cf4fbf39f3395e66432bc74bcf
description: Connected app-specific methods were introduced in Tableau 2021
---
[Skip to main content](#main-content)

# Connected App Methods

Connected app-specific methods were introduced in Tableau 2021.4. Site-level external authorization server-specific methods were introduced in September 2022 for Tableau Cloud and in Tableau Server version 2024.2.

A connected app enables you to establish a trusted relationship between Tableau and any custom application. A connected app can be used to securely authenticate (SSO) your users to Tableau content embedded in a custom application or to authorize access to the REST API.

**Connected app methods using direct trust**

Using the connected app methods of the Tableau REST API, you can:

- Create, query, update, and delete a Tableau connected app
- Create, query, and delete the secret generated for a Tableau connected app

This functionality relates to UI elements and concepts described at:

- For Tableau Server: [Configure Tableau Connected Apps to with Direct Trust](https://help.tableau.com/current/server-linux/en-us/connected_apps_direct.htm)
- For Tableau Cloud: [Configure Tableau Connected Apps with Direct Trust](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm)

**Connected app methods using OAuth 2.0 trust**

As an alternative, you can register an external authorization server (EAS) to a site to establish a trust relationship.

Using the EAS-specific methods of the Tableau REST API, you can:

- Register, query, update, and delete an EAS on a site

This functionality relates to UI elements and concepts described at:

- For Tableau Server: [Configure Tableau Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/current/server-linux/en-us/connected_apps_eas.htm)
- For Tableau Cloud: [Confgiure Tableau Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/current/online/en-us/connected_apps_eas.htm)

**Note:** Tableau Server admins can set up server-wide EAS through TSM. For more information, see [Register EAS to Enable SSO for Embedded Content](https://help.tableau.com/current/server-linux/en-us/connected_apps_eas.htm).

## Use Postman

Our Postman collection of requests enables you to construct, send, and examine HTTP requests to the Tableau Server or Tableau Cloud API without writing initial code. Postman is a free online app used by many developers for prototyping API calls, investigating issues, and generating request code in a variety of languages.

[Postman: Connected Apps](https://www.postman.com/salesforce-developers/salesforce-developers/folder/43j3adj/connected-apps)

## Create Connected App

Create a connected app.

A connected app can be used to securely authenticate your users to Tableau content embedded in a custom application or for REST API authorization (introduced to Tableau Cloud in June 2022 and Tableau Server 2023). By creating a connected app, you can establish a trusted relationship between Tableau and any custom application.

For more information about connected apps, see one of the following:

- For Tableau Server: [Configure Tableau Connected Apps to Enable SSO for Embedded Content](https://help.tableau.com/current/server-linux/en-us/connected_apps.htm)
- For Tableau Cloud: [Configure Tableau Connected Apps with Direct Trust](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm)

#### URI

POST api/_api-version_/sites/_site-id_/connected-apps/direct-trust

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr></tbody></table>

#### Request Body

Tableau Cloud and Tableau Server using API 3.23 or later

```
<tsRequest>
  <connectedApplication
		name="name"
		enabled="enabled"
		domainSafelist="domainSafelist"
		unrestrictedEmbedding="unrestrictedEmbedding">
				<projectIds>
					<projectId>project_id</projectId>
					<projectId>project_id</projectId>
					<projectId>project_id</projectId>
				</projectIds>
  </connectedApplication>
</tsRequest>
```

Tableau Server (or Tableau Cloud) using API 3.21 or earlier

```
<tsRequest>
  <connectedApplication
		name="name"
		enabled="enabled"
		projectId="project_id"
		domainSafelist="domainSafelist"
	unrestrictedEmbedding="unrestrictedEmbedding" />
</tsRequest>
```

#### Attribute Values

Any combination of attributes inside the <connectedApplication> element is valid, however name is required.

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-wide" style="width: 264px;">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">name</span>
                                </td>
                                <td>
                        Name of the connected app.
                    </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">enabled</span>
                                </td>
                                <td>
                        (Optional) Controls whether the connected app is enabled or not. Value can be "<span class="uicontrol">true</span>" or "<span class="uicontrol">false</span>". If the state is not specified, the connected app is set to "false" and not enabled by default. </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">project_id</span>
                                </td>
                                <td>
                                    <p>(Optional, embedding workflows only) The IDs of the projects that the connected app's access level is scoped to. To get a project's project ID, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#query_projects">Query Projects</a>. You can specify one project, multiple projects, all projects on a site.</p>
                                    <ul>
                                        <li>
                                            <p><b>Single project:</b> </p>
                                            <ul>
                                                <li>
                                                    <p>For Tableau Cloud (using API&nbsp;3.22 or later) and Tableau Server (using&nbsp;API&nbsp;3.23 or later), to scope the connected app's access to one project, the recommended workflow is to specify the <span class="api-command-ref">projectIds</span> and <span class="api-command-ref">projectId</span> attributes and projectId value. </p>
                                                </li>
                                                <li>
                                                    <p>For Tableau Server (or Tableau Cloud) using&nbsp;API 3.21 or earlier, specify the <span class="api-command-ref">projectId</span> parameter and its value.</p>
                                                </li>
                                            </ul>
                                        </li>
                                        <li>
                                            <p><b>Multiple projects:</b> Beginning with API&nbsp;3.22 (February 2024) for Tableau Cloud and&nbsp;API 3.23 for Tableau Server, you can specify the <span class="api-command-ref">projectIds</span> attribute and projectId values  to scope the connected app's access to multiple projects.</p>
                                        </li>
                                        <li>
                                            <p><b>All projects:</b> </p>
                                            <ul>
                                                <li>
                                                    <p>For Tableau Cloud (using API&nbsp;3.22 or later) and Tableau Server (using API&nbsp;3.23 or later), to scope the connected app's access to all projects on a site, omit the <code>projectIds</code> attribute from the request. </p>
                                                </li>
                                                <li>
                                                    <p>For Tableau Server (or Tableau Cloud) using&nbsp;API 3.21 or earlier, to scope the connected app's access to all projects on a site, omit the <code>projectId</code> attribute from the request. </p>
                                                </li>
                                            </ul>
                                            <p><b>Note:</b> Specifying "all projects" in an update request for a connected app is handled differently. For more information, see <a href="#project_update" target="_blank">update project</a>.</p>
                                        </li>
                                    </ul>
                                    <p><b>Note:</b>&nbsp;The stand-alone <span class="uicontrol">projectId</span> attribute will be retired in a future release so we recommend using <span class="api-command-ref">projectIds</span> attribute instead.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">domainSafelist</span>
                                </td>
                                <td>
                                    <p>(Optional, embedding workflows only) A list of domains the connected app is allowed to be hosted. Specify one or more URLs, separated by spaces, using a format described in <a href="https://help.tableau.com/current/server-linux/en-us/connected_apps.htm#domain_rules" target="_blank">Domain allowlist rules</a> in the Tableau Server Help or <a href="https://help.tableau.com/current/online/en-us/connected_apps.htm#domain_rules" target="_blank">Domain allowlist rules</a> in the Tableau Cloud Help. </p>
                                    <p><b>Important:</b> We recommend using the domain allowlist as a security best practice to ensure Tableau content is only embedded in locations that you allow.</p>
                                    <p>For example: <code>https://tableau.com https://myco.com:552 marketing.example.com</code></p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">unrestrictedEmbedding</span>
                                </td>
                                <td>(Optional, embedding workflows only) Controls whether the connected app can be hosted on all domains. If "<span class="uicontrol">true</span>" value is specified, the connected app can be hosted on all domains. If  "<span class="uicontrol">false</span>" value is specified, the connected app can only be hosted on the domains specified in the <code>&lt;domainSafelist&gt;</code> attribute.</td>
                            </tr>
                        </tbody>
                    </table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:connected_apps_direct_trust:create
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

201

#### Response Body

**Example response:**

```
<tsResponse>
  <connectedApplication>
	<name>ConnectedApp_MyCo</name>
	<enabled>true</enabled>
	<clientId>ac95d175-c844-4779-9d58-415e01fe7dab</clientId>
	<projectIds>
		<projectId>1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e</projectId>
		<projectId>1234de4e-5d6d-7c8c-9b0b-1a2a3f4f5e0e</projectId>
	</projectIds>
	<createdAt>2021-08-10T18:46:30Z</createdAt>
	<unrestrictedEmbedding>true</unrestrictedEmbedding>
  </connectedApplication>
</tsResponse>
```

**Note:** When the scope of the connected app's access is set to all projects, the request does not return the `projectId` attribute.

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, POST /api/_api-version_/sites/_site-id_/connected-apps/direct-trust, was added in version 3.17. The original resource, POST /api/_api-version_/sites/_site-id_/connected-applications, was deprecated in API 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400109</td><td>Bad request</td><td>The request body can't be empty.</td></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr></tbody></table>

## Register EAS

Create a connected app with OAuth 2.0 trust by registering an external authorization server (EAS) to a site.

You can register an external authorization server (EAS) to establish a trust relationship between your Tableau Server site or Tableau Cloud site and EAS using the OAuth 2.0 standard protocol. By establishing a trust relationship, you’re able to provide your users with a single sign-on (SSO) experience to Tableau content embedded in your custom applications or REST API authorization through an identity provider (IdP) you've already configured.

**Notes:**

- Beginning in API version 3.22, you can register multiple EASs per site for Tableau Cloud.
- Beginning in API version 3.23, Tableau Server supports site-level EAS (and multiple registrations of EASs per site).

For more information, see one of the following:

- For Tableau Server: [Register EAS to Enable SSO for Embedded Content](https://help.tableau.com/current/server-linux/en-us/connected_apps_eas.htm)
- For Tableau Cloud: [Register EAS to Enable SSO for Embedded Content](https://help.tableau.com/current/online/en-us/connected_apps_eas.htm)

#### URI

POST api/_api-version_/sites/_site-id_/connected-apps/external-authorization-servers

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <externalAuthorizationServer
	issuerUrl="URL" jwksUri="URI" name="name"/>
</tsRequest>
```

#### Attribute Values

A combination of attributes inside the <externalAuthorizationServer> element is valid, however issuerUrl is required.

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-wide" style="width: 264px;">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">URL</span>
                                </td>
                                <td>
                        The entity id of your identity provider (IdP) or URL&nbsp;that uniquely identifies your IdP.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">URI</span>
                                </td>
                                <td>
                                    <p>(Optional) The JSON Web Key (JKWS) of the EAS.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">name</span>
                                </td>
                                <td>
                                    <p>(Optional) The name of the connected app. If the name attribute is not specified, the connected app name defaults to "External Authorization Server."</p>
                                    <p>This attribute is available  starting from API version 3.22 (February 2024).</p>
                                </td>
                            </tr>
                        </tbody>
                    </table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:external_authorization_servers:create
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

201

#### Response Body

The request returns details about the EAS, including the following:

- `<name>`: The name of the connected app.
- `<id>`: The ID of the EAS.
- `<issuerUrl>:` The issuer URL of the EAS.

- `<jwksUri>:` The JSON web key set (JWKS) of the EAS.

You can use the returned EAS ID (`<id>`) in [Update EAS](#update_connectedapp_eas) and [Delete EAS](#delete_connectedapp_eas) requests.

**Example response:**

```
<tsResponse>
   <externalAuthorizationServer>
	<name>EAS_1</name>
	<id>50bdc8cd-1aa4-48fe-a0e7-68982d85daa8</id>
	<issuerUrl>https://dev-57741098.okta.com/oauth2/aus3gd9kw7ixSfBKC5d7</issuerUrl>
	<jwksUri>https://dev-57741098.okta.com/jwks.json</jwksUri>
	<createdAt>2022-04-07T03:50:34Z</createdAt>
   </externalAuthorizationServer>
</tsResponse>
```

#### Version

Introduced in Tableau Cloud June 2022 (API 3.16). Introduced in Tableau Server 2024.1 (API 3.23).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400008</td><td>Issuer URL&nbsp;missing</td><td>The required issuer URL is missing from the request body.</td></tr><tr><td>400</td><td>400157</td><td>Unexpected EAS&nbsp;error</td><td>There was a unexpected error when creating the connected app.</td></tr><tr><td>400</td><td>400161</td><td>EAS limit exceeded</td><td>The site has reached its limit of EAS&nbsp;that can be registered or the external&nbsp;authorization server (EAS)&nbsp;ID is not in the correct format.</td></tr><tr><td>400</td><td>400194</td><td>Issuer URL already configured</td><td>Another connected app on the site is using the same issuer URL.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr></tbody></table>

## Create Connected App Secret

Generate a secret for a connected app.

Secrets are tokens shared by Tableau and a custom application, and used to establish a trusted relationship.

A maximum of two secrets can be associated with a connected app. These secrets do not expire and remain valid until deleted. If a connected app has already reached its two secret maximum when another one is generated, an error is thrown.

#### URI

POST api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_/secrets

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">client-id</span></td><td>The unique ID&nbsp;of the connected app.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Response Code

201

#### Response Body

The request returns details about the generated secret, including the secret value `<value>`.

**Example response:**

```
<tsResponse>
  <connectedApplicationSecret>
	<value>TO7/wkW+45U001IBtyNbtyIMYQ/GBM0XlRXqsgYqPlY=</value>
	<id>7ecc5c7c-d923-4ffd-917b-cab1bd89f03b</id>
	<createdAt>2021-08-10T18:48:40Z</createdAt>
  </connectedApplicationSecret>
</tsResponse>
```

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, POST /api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_/secrets, was added in version 3.17. The original resource, POST /api/_api-version_/sites/_site-id_/connected-applications/_client-id_/secrets, was deprecated in version 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table">
                        <colgroup>
                            <col class="api-error-table-col-1">
                            <col class="api-error-table-col-2" style="width: 87px;">
                            <col class="api-error-table-col-3">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <th>HTTP status</th>
                                <th><code>error</code> Code</th>
                                <th>Condition</th>
                                <th>Details</th>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400143</td>
                                <td>Generic connected app error</td>
                                <td>The connected app could not be deleted for some other reason than those specified in this table.</td>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400144</td>
                                <td>Secret limit exceeded</td>
                                <td>
                                    <p>The connected app has already  reached its two secret maximum.</p>
                                </td>
                            </tr>
                            <tr>
                                <td>403</td>
                                <td>403000</td>
                                <td>Admin permissions required</td>
                                <td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td>
                            </tr>
                            <tr>
                                <td>404  </td>
                                <td>404000</td>
                                <td>Resource not found </td>
                                <td>The  site ID in the URI doesn't correspond to an existing  site.  </td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404041</td>
                                <td>Connected app not found</td>
                                <td>The requested connected app could not be found.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404042</td>
                                <td>Secret not found</td>
                                <td>The requested secret for the connected app could not be found.</td>
                            </tr>
                        </tbody>
                    </table>

## Delete Connected App

Permanently remove a connected app.

Deleting the connected app also deletes the secrets associated with the connected app. For more information about deleting a connected app, see one of the following: 

- For Tableau Server: [Effects of deleting a connected app](https://help.tableau.com/current/server-linux/en-us/connected_apps.htm#effects)
- For Tableau Cloud: [Effects of deleting a connected app](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm#effects)

#### URI

DELETE api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">client-id</span></td><td>The unique ID&nbsp;of the connected app.</td></tr></tbody></table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:connected_apps_direct_trust:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, DELETE api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_, was added in version 3.17. The original resource, DELETE api/_api-version_/sites/_site-id_/connected-applications/_client-id_, was deprecated in version 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr></tbody></table>

## Delete EAS

Delete a registered external authorization server (EAS).

#### URI

DELETE api/_api-version_/sites/_site-id_/connected-apps/external-authorization-servers/_eas-id_

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><i>eas-id</i></td><td>The unique ID&nbsp;of the registered EAS.</td></tr></tbody></table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:external_authorization_servers:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Introduced in Tableau Cloud June 2022 (API 3.16). Introduced in Tableau Server 2024.2 (API 3.23).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404047</td><td>EAS not found</td><td>The requested EAS could not be found.</td></tr></tbody></table>

## Delete Connected App Secret

Permanently remove a secret associated with a connected app.

For more information about deleting a connected app, see one of the following:

- For Tableau Server: [Effects of deleting a secret](https://help.tableau.com/current/server-linux/en-us/connected_apps.htm#effects)
- For Tableau Cloud: [Effects of deleting a secret](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm#effects)

#### URI

DELETE api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_/secrets/_secret-id_

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">client-id</span></td><td>The unique ID&nbsp;of the connected app.</td></tr><tr><td><span class="api-placeholder">secret-id</span></td><td>The unique ID of the connected app secret.</td></tr></tbody></table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:connected_app_direct_trust_secrets:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, DELETE api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_/secrets/_secret-id_, was added in version 3.17. The original resource, DELETE api/_api-version_/sites/_site-id_/connected-applications/_client-id_/secrets/_secret-id_, was deprecated in version 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr><tr><td>404</td><td>404042</td><td>Secret not found</td><td>The requested secret for the connected app could not be found.</td></tr></tbody></table>

## Get Connected App

Query a connected app by its ID.

#### URI

GET api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">client-id</span></td><td>The unique ID of the connected app.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:connected_apps_direct_trust:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

The request returns details about the connected app, including the following:

- `<secret>`: Information related to the secret only if it has been previously generated. To create a secret for a connected app, see [Create Connected App Secret](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#create_connectedapp_secret). To get the secret value, see [Query Connected App Secret](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#get_connectedapp_secret).
- `<name>`: Name of the connected app.
- `<enabled>`: Whether the connected app is enabled or not.
- `<clientId>`: The ID of the connected app.
- `<projectId>:` The project that the connected app's access level is scoped to.
- `<domainSafelist>:` If specified, one or more domains that the connected app is allowed to be hosted on.
- `<unrestrictedEmbedding>`: Whether the connected app can be hosted on all domains. If `false` is returned, the `<domainSafelist>` attribute determines the domain access.

**Example response:**

```
<tsResponse>
  <connectedApplications>
	<connectedApplication>
	  <secret>
		<id>7ecc5c7c-d923-4ffd-917b-cab1bd89f03b</id>
		<createdAt>2021-08-10T18:48:40Z</createdAt>
	  </secret>
	  <name>ConnectedApp_MyCo</name>
	  <enabled>true</enabled>
	  <clientId>ac95d175-c844-4779-9d58-415e01fe7dab</clientId>
	  <projectIds>
		<projectId>1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e</projectId>
		<projectId>1234de4e-5d6d-7c8c-9b0b-1a2a3f4f5e0e</projectId>
	  </projectIds>
	  <createdAt>2021-08-10T18:46:30Z</createdAt>
	  <unrestrictedEmbedding>false</unrestrictedEmbedding>
	</connectedApplication>
  <connectedApplications>
</tsResponse>
```

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, GET api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_, was added in version 3.17. The original resource, GET api/_api-version_/sites/_site-id_/connected-applications/_client-id_, was deprecated in version 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr></tbody></table>

## List Connected Apps

Query all connected apps configured on a site.

#### URI

GET api/_api-version_/sites/_site-id_/connected-apps/direct-trust

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:connected_apps_direct_trust:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

The request returns details about the connected app, including the following:

- `<secret>`: Information related to the secret only if it has been previously generated. To create a secret for a connected app, see [Create Connected App Secret](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#create_connectedapp_secret). To get the secret value, see [Query Connected App Secret](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#get_connectedapp_secret).
- `<name>`: Name of the connected app.
- `<enabled>`: Whether the connected app is enabled or not.
- `<clientId>`: The ID of the connected app.
- `<projectId>:` The project that the connected app's access level is scoped to.
- `<domainSafelist>:` If specified, one or more domains that the connected app is allowed to be hosted on.
- `<unrestrictedEmbedding>`: Whether the connected app can be hosted on all domains. If `false` is returned, the `<domainSafelist>` attribute determines the domain access.

**Example response:**

```
<tsResponse>
  <connectedApplications>
	<connectedApplication>
	  <secret>
		<id>7ecc5c7c-d923-4ffd-917b-cab1bd89f03b</id>
		<createdAt>2021-08-10T18:48:40Z</createdAt>
	  </secret>
	  <name>ConnectedApp_MyCo</name>
	  <enabled>true</enabled>
	  <clientId>ac95d175-c844-4779-9d58-415e01fe7dab</clientId>
	  <projectIds>
			<projectId>1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e</projectId>
			<projectId>1234de4e-5d6d-7c8c-9b0b-1a2a3f4f5e0e</projectId>
	  </projectIds>
	  <createdAt>2021-08-10T18:46:30Z</createdAt>
	  <domainSafelist>https://myco.com</domainSafelist>
	  <unrestrictedEmbedding>false</unrestrictedEmbedding>
	</connectedApplication>
	<connectedApplication>
	  <name>ConnectedApp_MyCo_stage1</name>
	  <enabled>false</enabled>
	  <clientId>7370df14-2741-43f9-bbdd-450f707530a0</clientId>
	  <projectIds>
			<projectId>11213e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e</projectId>
			<projectId>21234de4e-5d6d-7c8c-9b0b-1a2a3f4f5e0e</projectId>
	  </projectIds>
	  <createdAt>2021-08-18T00:49:05Z</createdAt>
	  <unrestrictedEmbedding>true</unrestrictedEmbedding>
	</connectedApplication>
	<connectedApplication>
	  <name>ConnectedApp_MyCo_stage2</name>
	  <enabled>false</enabled>
	  <clientId>f1e57298-ecd4-46a9-b8d9-e5ab0bf76a82</clientId>
	  <createdAt>2021-08-18T00:54:30Z</createdAt>
	</connectedApplication>
  <connectedApplications>
</tsResponse>
```

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, GET api/_api-version_/sites/_site-id_/connected-apps/direct-trust, was added in version 3.17. The original resource, GET api/_api-version_/sites/_site-id_/connected-applications, was deprecated in version 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr></tbody></table>

## List All Registered EAS

Get all external authorization servers (EASs) registered to a site.

#### URI

GET api/_api-version_/sites/_site-id_/connected-apps/external-authorization-servers

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:external_authorization_servers:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

The request returns details about the EAS, including the following:

- `<name>`: The name of the connected app.
- `<id>`: The ID of the EAS.
- `<issuerUrl>:` The issuer URL of the EAS.

**Example response:**

```
<tsResponse>
   <externalAuthorizationServerList>
	<externalAuthorizationServer>
	   <name>External Authorization Server</name>
	   <id>7ecc5c7c-d923-4ffd-917b-cab1bd89f03b</id>
	   <issuerUrl>https://dev-57741098.okta.com/oauth2/aus3gd9kw7ixSfBKC5d7</issuerUrl>
	   <createdAt>2022-04-07T03:50:34Z</createdAt>
	</externalAuthorizationServer>
	<externalAuthorizationServer>
	   <name>EAS_1</name>
	   <id>be5f8262-6ae4-407c-9765-dfe5b37cb4b5</id>
	   <issuerUrl>https://dev-57741099.okta.com/oauth2/aus3gd9kw7ixSfBKC5d7</issuerUrl>
	   <createdAt>2022-05-15T13:00:34Z</createdAt>
	</externalAuthorizationServer>
   <externalAuthorizationServerList>
</tsResponse>
```

#### Version

Introduced in Tableau Cloud June 2022 (API 3.16). Introduced in Tableau Server 2024.2 (API 3.23).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr></tbody></table>

## List Registered EAS

Get an external authorization server (EAS) registered to a site.

#### URI

GET api/_api-version_/sites/_site-id_/connected-apps/external-authorization-servers/_eas-id_

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><i>eas-id</i></td><td>The unique ID&nbsp;of the registered EAS.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:external_authorization_servers:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

The request returns details about the EAS, including the following:

- `<name>`: The name of the connected app.
- `<id>`: The ID of the EAS.
- `<issuerUrl>:` The issuer URL of the EAS.

**Example response:**

```
<tsResponse>
   <externalAuthorizationServerList>
	<externalAuthorizationServer>
	   <name>EAS_1</name>
	   <id>7ecc5c7c-d923-4ffd-917b-cab1bd89f03b</id>
	   <issuerUrl>https://dev-57741098.okta.com/oauth2/aus3gd9kw7ixSfBKC5d7</issuerUrl>
	   <createdAt>2022-04-07T03:50:34Z</createdAt>
	</externalAuthorizationServer>
   <externalAuthorizationServerList>
</tsResponse>
```

#### Version

Introduced in Tableau Cloud June 2022 (API 3.16). Introduced in Tableau Server 2024.2 (API 3.23).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404047</td><td>EAS not found</td><td>The requested EAS could not be found.</td></tr></tbody></table>

## Get Connected App Secret

Query a connected app secret and the token value using the connected app's ID.

Secrets are tokens shared by Tableau and a custom application, and used to establish a trusted relationship.

A maximum of two secrets can be associated with a connected app. These secrets do not expire and remain valid until deleted.

#### URI

GET api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_/secrets/_secret-id_

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">client-id</span></td><td>The unique ID of the connected app.</td></tr><tr><td><span class="api-placeholder">secret-id</span></td><td>The unique ID of the connected app secret.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Response Code

200

#### Response Body

The request returns details about the secret associated with the connected app, including the following:

- `<value>`: The token value of the secret.
- `<id>:` The ID of the secret.

**Example response:**

```
<tsResponse>
  <connectedApplicationSecret>
	<value>TO7/wkW+45U001IBtyNbtyIMYQ/GBM0XlRXqsgYqPlY=</value>
	<id>7ecc5c7c-d923-4ffd-917b-cab1bd89f03b</id>
	<createdAt>2021-08-10T18:48:40Z</createdAt>
  </connectedApplicationSecret>
</tsResponse>
```

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, GET api/_api-version_/sites/_site-id_/connected-apps/direct-trust/_client-id_/secrets/_secret-id_, was added in version 3.17. The original resource, GET api/_api-version_/sites/_site-id_/connected-applications/_client-id_/secrets/_secret-id_, was deprecated in version 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr><tr><td>404</td><td>404042</td><td>Secret not found</td><td>The requested secret for the connected app could not be found.</td></tr></tbody></table>

## Update Connected App

Update a connected app.

#### URI

PUT api/api-version/sites/_site-id_/connected-apps/direct-trust/_client-id_

**Note:** The `connected-applications` endpoint that performed this function was deprecated in API 3.17 (Tableau Cloud October 2022 / Tableau Server 2022.3), is no longer supported and may be retired in a future release.

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">client-id</span></td><td>The unique ID&nbsp;of the connected app.</td></tr></tbody></table>

#### Request Body

For Tableau Cloud and Tableau Server using API 3.23 or later

```
<tsRequest>
  <connectedApplication
		name="name"
		enabled="enabled"
		domainSafelist="domainSafelist"
		unrestrictedEmbedding="unrestrictedEmbedding">
				<projectIds>
					<projectId>project_id</projectId>
					<projectId>project_id</projectId>
					<projectId>project_id</projectId>
				</projectIds>
  </connectedApplication>
</tsRequest>
```

For Tableau Server (or Tableau Cloud) using API 3.21 or earlier

```
<tsRequest>
  <connectedApplication
		name="name"
		enabled="enabled"
		projectId="project_id" domainSafelist="domainSafelist"
		unrestrictedEmbedding="unrestricedEmbedding" />
</tsRequest>
```

#### Attribute Values

Any combination of attributes inside the <connectedApplication> element is valid.

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-wide" style="width: 264px;">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">name</span>
                                </td>
                                <td>
                        (Optional) The new name of the connected app. </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">enabled</span>
                                </td>
                                <td>
                        (Optional) Controls whether the connected app is enabled or not. Value can be "<span class="uicontrol">true</span>" or "<span class="uicontrol">false</span>". If the state is not specified, the connected app is set to "false" and not enabled by default. </td>
                            </tr>
                            <tr>
                                <td><a name="project_update"></a><span class="api-placeholder">project_id</span>
                                </td>
                                <td>
                                    <p>(Optional, embedding workflows only) The ID of the project that the connected app's access level is scoped to. To get the project ID, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#query_projects">Query Projects</a>. You can specify one project, multiple projects, and all projects on a site.</p>
                                    <ul>
                                        <li>
                                            <p><b>Single project:</b>
                                            </p>
                                            <ul>
                                                <li>
                                                    <p>For Tableau Cloud (using API&nbsp;3.22 or later) and Tableau Server (using API&nbsp;3.23 or later), to scope the connected app's access to one project, the recommended workflow is to specify the <span class="api-command-ref">projectIds</span> and <span class="api-command-ref">projectId</span> attributes and projectId value. </p>
                                                </li>
                                                <li>
                                                    <p>For Tableau Server (or Tableau Cloud) using API 3.21 or earlier, specify the <span class="api-command-ref">projectId</span> attribute and its value.</p>
                                                </li>
                                            </ul>
                                        </li>
                                        <li>
                                            <p><b>Multiple projects:</b> Beginning with API 3.22 (February 2024) for Tableau Cloud and API 3.23 for Tableau Server, you can specify the <span class="api-command-ref">projectIds</span> and <span class="api-command-ref">projectId</span> attributes and  projectId values  to scope the connected app's access to multiple projects. </p>
                                        </li>
                                        <li>
                                            <p><b>All projects:</b>
                                            </p>
                                            <ul>
                                                <li>
                                                    <p>For Tableau Cloud (using API&nbsp;3.22 or later) and Tableau Server (using API&nbsp;3.23 or later), specify the <span class="api-command-ref">projectIds</span> attribute and do not specify values. For example, <span class="api-command-ref">&lt;projectIds&gt;&lt;/projectIds&gt;</span>.</p>
                                                </li>
                                                <li>
                                                    <p>For Tableau Server (or Tableau Cloud) using&nbsp;API 3.21 or earlier, specify the <span class="api-command-ref">projectId</span> attribute and leave its value empty. For example <code>projectId=""</code>. </p>
                                                </li>
                                            </ul>
                                            <p><b>Note:</b>&nbsp;If the <code>projectIds</code> or <code>projectId</code>&nbsp;is not included in the request, the connected apps' access level is not updated.</p>
                                        </li>
                                    </ul>
                                    <p><b>Note:</b>&nbsp;The stand-alone <span class="uicontrol">projectId</span> attribute will be retired in a future release so we recommend using <span class="api-command-ref">projectIds</span> attribute instead.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">domainsafelist</span>
                                </td>
                                <td>
                                    <p>(Optional, embedding workflows only ) A list of domains the connected app is allowed to be hosted. Specify one or more URLs, separated by spaces, using a format described in <a href="https://help.tableau.com/current/server-linux/en-us/connected_apps.htm#domain_rules" target="_blank">Domain allowlist rules</a> in the Tableau Server Help or <a href="https://help.tableau.com/current/online/en-us/connected_apps.htm#domain_rules" target="_blank">Domain allowlist rules</a> in the Tableau Cloud Help.</p>
                                    <p><b>Important:</b> We recommend using the domain allowlist as a security best practice to ensure Tableau content is only embedded in locations that you allow. </p>
                                    <p>For example: <code>https://tableau.com https://myco.com:552 marketing.example.com</code></p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">unrestrictedEmbedding</span>
                                </td>
                                <td>(Optional, embedding workflows only) Controls whether the connected app can be hosted on all domains. If "<span class="uicontrol">true</span>" value is specified, the connected app can trust and connect to all domains. If  "<span class="uicontrol">false</span>" value is specified, the connected app can only be hosted on the domains specified in the <code>&lt;domainSafelist&gt;</code> attribute.</td>
                            </tr>
                        </tbody>
                    </table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:connected_apps_direct_trust:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

**Example response:**

```
<tsResponse>
  <connectedApplication>
	<secret>
	  <id>d8a51b6c-bf70-4aaf-959b-93d2ba4897e6</id>
	  <createdAt>2021-08-18T17:59:11Z</createdAt>
	</secret>
	<name>ConnectedApp_MyCo</name>
	<enabled>true</enabled>
	<clientId>9486dee1-ca98-4144-b6e0-f5c555e64796</clientId>
	<projectIds>
		<projectId>1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e</projectId>
		<projectId>1234de4e-5d6d-7c8c-9b0b-1a2a3f4f5e0e</projectId>
	</projectIds>
	<createdAt>2021-08-18T17:48:03Z</createdAt>
	<unrestrictedEmbedding>true</unrestrictedEmbedding>
  </connectedApplication>
</tsResponse>
```

**Notes:**

- The request will return the secret associated with the connected app only if it has been previously generated. To get the secret value, see [Query Connected App Secret](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#get_connectedapp_secret).
- When the scope of the connected app's access is set to all projects, the request does not return the `projectId` attribute.

#### Version

Version 3.14 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

The resource, PUT api/api-version/sites/_site-id_/connected-apps/direct-trust/_client-id_, was added in version 3.17. The original resource, PUT api/api-version/sites/_site-id_/connected-applications/_client-id_, was deprecated in API 3.17 and will be retired in a future release.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400109</td><td>Bad request</td><td>The request body can't be empty.</td></tr><tr><td>400</td><td>400143</td><td>Generic connected app error</td><td>The connected app could not be deleted for some other reason than those specified in this table.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404041</td><td>Connected app not found</td><td>The requested connected app could not be found.</td></tr></tbody></table>

## Update EAS

Update a connected app with OAuth 2.0 trust.

**Notes:**

- Beginning in API version 3.22, you can register multiple EASs per site for Tableau Cloud.
- Beginning in API version 3.23, Tableau Server supports site-level EAS (and multiple registrations of EASs per site).

#### URI

PUT api/_api-version_/sites/_site-id_/connected-apps/external-authorization-servers/_eas-id_

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><i>eas-id</i></td><td>The unique ID&nbsp;of the registered EAS.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
   <externalAuthorizationServer
	issuerUrl="URL"
	jwksUri="URI"
	name="name" />
</tsRequest>
```

#### Attribute Values

A combination of attributes inside the <externalAuthorizationServer> element is valid.

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-wide" style="width: 264px;">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">URL</span>
                                </td>
                                <td>(Optional) The entity id of your identity provider (IdP) or URL&nbsp;that uniquely identifies your IdP.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">URI</span>
                                </td>
                                <td>
                                    <p>(Optional) The JSON Web Key (JKWS) of the EAS.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">name</span>
                                </td>
                                <td>
                                    <p>(Optional) The name of the connected app. If the name attribute is not specified, the connected app name defaults to "External Authorization Server."</p>
                                    <p>This attribute is available starting from API version 3.22 (February 2024).</p>
                                </td>
                            </tr>
                        </tbody>
                    </table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:external_authorization_servers:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

The request returns details about the EAS, including the following:

- `<name>`: The name of the connected app.
- `<id>`: The ID of the EAS.
- `<issuerUrl>:` The issuer URL of the EAS.

- `<jwksUri>:` The JSON web key set (JWKS) of the EAS.

**Example response:**

```
<tsResponse>
   <externalAuthorizationServer>
	<name>EAS_2</name>
	<id>50bdc8cd-1aa4-48fe-a0e7-68982d85daa8</id>
	<issuerUrl>https://dev-57741098.okta.com/oauth2/aus3gd9kw7ixSfBKC5d7</issuerUrl>
	<jwksUri>https://dev-57741098.okta.com/jwks.json</jwksUri>
	<createdAt>2022-04-07T03:50:34Z</createdAt>
   </externalAuthorizationServer>
</tsResponse>
```

#### Version

Introduced in Tableau Cloud June 2022 (API 3.16). Introduced in Tableau Server 2024.2 (API 3.23).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400008</td><td>Issuer URL missing</td><td>The request body contains an empty issuer URL attribute.</td></tr><tr><td>400</td><td>400157</td><td>Unexpected EAS error</td><td>There was an unexpected error when updating the connected app.</td></tr><tr><td>400</td><td>400194</td><td>Issuer URL already configured</td><td>Another connected app on the site is using the same issuer URL.</td></tr><tr><td>403</td><td>403000</td><td>Admin permissions required</td><td>A non-admin user called this method and doesn't have adequate permissions to perform the action.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404047</td><td>EAS not found</td><td>The requested EAS could not be found.</td></tr></tbody></table>