---
schema_version: "1"
id: fdebf33c396a3add30e3d88d0e5b4bad00fec437690e599f12997487a4835210
title: OpenID Connect Methods
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/api/rest_api/REST/rest_api_ref_openid_connect.md
canonical_url: https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_openid_connect.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 861713df8594888b2b49cb131d242567af057101620463773600a582ef88b9f4
description: "Using the OpenID Connect (OIDC) methods of the Tableau REST API you can:"
---
[Skip to main content](#main-content)

# OpenID Connect Methods

Using the OpenID Connect (OIDC) methods of the Tableau REST API you can:

- Set your Tableau Cloud site to use OIDC authentication to authenticate users 
    - Configure OIDC authentication when your identity provider (IdP) does not provide a configuration URL (in other words, a URL that ends with `.well-known/openid-configuration`)
    - Configure client authentication, custom scope, prompt, essential ACR Values, or voluntary ACR values that the Tableau Cloud's OIDC configuration UI does not support
- Get details about the OIDC configuration
- Update your OIDC configuration
- Remove your OIDC configuration

The above functionality relates to OIDC elements described at: [OpenID Connect](https://help.tableau.com/current/online/en-us/openid_auth.htm).

## Create OpenID Connect Configuration

Create the Tableau Cloud site's OpenID Connect (OIDC) configuration.

After you've configured OIDC authentication, you can use the Tableau Cloud's UI to [test the configuration](https://help.tableau.com/current/online/en-us/openid_auth_server_config.htm#test) and [add users](https://help.tableau.com/current/online/en-us/openid_auth_server_config.htm#test).

For more information about OIDC authentication in Tableau Cloud, see [OpenID Connect](https://help.tableau.com/current/online/en-us/openid_auth.htm) in the Tableau Cloud Help.

**Version:** Available in API 3.22 (Tableau Cloud February 2024) and later. Not available for Tableau Server._[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Tableau Cloud site admins only.

**JWT Access Scope:** Not available.

#### URI

PUT /api/api-version/sites/site-luid/site-oidc-configuration

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr></tbody></table>

#### Request Body

Copy

```
<tsRequest>  <siteOIDCConfiguration    idpConfigurationName="idpConfigurationName"    enabled="enabled"    clientId="clientId"    clientSecret="clientSecret"    authorizationEndpoint="authorizationEndpoint"    tokenEndpoint="tokenEndpoint"    userinfoEndpoint="userinfoEndpoint"    jwksUri="jwksUri"    endSessionEndpoint="endSessionEndpoint"    allowEmbeddedAuthentication="allowEmbeddedAuthentication"    prompt="prompt"    customScope="customScope"    clientAuthentication="clientAuthentication"    essentialAcrValues="essentialAcrValues"    voluntaryAcrValues="voluntaryAcrValues"    emailMapping="emailMapping"    firstNameMapping="firstNameMapping"    lastNameMapping="lastNameMapping"    fullNameMapping="fullNameMapping"    useFullName="useFullName" /></tsRequest>
```

Copy

```
{  "siteOIDCConfiguration": {    "idpConfigurationName": "idpConfigurationName",    "enabled": "enabled",    "clientId": "clientId",    "clientSecret": "clientSecret",    "authorizationEndpoint": "authorizationEndpoint",    "tokenEndpoint": "tokenEndpoint",    "userinfoEndpoint": "userinfoEndpoint",    "jwksUri": "jwksUri",    "endSessionEndpoint": "endSessionEndpoint",    "allowEmbeddedAuthentication": "allowEmbeddedAuthentication",    "prompt":"prompt",    "customScope":"customScope",    "clientAuthentication": "clientAuthentication",    "essentialAcrValues": "essentialAcrValues",    "voluntaryAcrValues": "voluntaryAcrValues",    "emailMapping": "emailMapping",    "firstNameMapping": "firstNameMapping",    "lastNameMapping": "lastNameMapping",    "fullNameMapping": "fullNameMapping",    "useFullName": "useFullName"    }}
```

#### Request Attributes

<table class="api-parameters-table" style="margin-left: 0;margin-right: auto;">
                            <colgroup><col class="api-parameters-table-col-1">
                            <col>
                            </colgroup><tbody>
                                <tr>
                                    <td><code>idpConfigurationName</code>
                                    </td>
                                    <td>
                                        <p>(Required) The name of the configuration. </p>
                                        <p>Starting in API&nbsp;3.24, you can create and enable multiple authentication configurations. For more information, see <a href="https://help.tableau.com/current/online/en-us/security_auth.htm#multiple_idp" target="_blank">Authentication</a> in the Tableau Cloud Help.</p>
                                    </td>
                                </tr>
                                <tr>
                                    <td><code>enabled</code>
                                    </td>
                                    <td>(Required) Controls whether the configuration is enabled or not. Value can be "<span class="api-command-ref">true</span>" or "<span class="api-command-ref">false</span>". For example "true".</td>
                                </tr>
                                <tr>
                                    <td><code>clientId</code>
                                    </td>
                                    <td>(Required) The client ID&nbsp;from your IdP. For example, "0oa111usf1gpUkVUt0h1".</td>
                                </tr>
                                <tr>
                                    <td><code>clientSecret</code>
                                    </td>
                                    <td>(Required) The client secret from your IdP.</td>
                                </tr>
                                <tr>
                                    <td><code>authorizationEndpoint</code>
                                    </td>
                                    <td>(Required) Use the authorization endpoint from your IdP. To find the value, enter the configuration URL in a browser and obtain the user information endpoint (<code>authorization_endpoint</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/authorize".</td>
                                </tr>
                                <tr>
                                    <td><code>tokenEndpoint</code>
                                    </td>
                                    <td>(Required) Use the token endpoint from your IdP. To find the value, enter the configuration URL in a browser and obtain the token endpoint (<code>token_endpoint</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/token". </td>
                                </tr>
                                <tr>
                                    <td><code>userinfoEndpoint</code>
                                    </td>
                                    <td>(Required) Use the user information endpoint from your IdP. To find the value, enter the configuration URL in a browser and obtain the user information endpoint (<code>userinfo_endpoint</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/userinfo".</td>
                                </tr>
                                <tr>
                                    <td><code>jwksUri</code>
                                    </td>
                                    <td>(Required) Use the JWK set URI from your IdP. To find the value, enter the configuration URL in a browser and obtain the JWK set URI endpoint (<code>jwks_uri</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/keys".</td>
                                </tr>
                                <tr>
                                    <td><code>endSessionEndpoint</code>
                                    </td>
                                    <td>(Optional) If single logout (SLO) is enabled for the site, which is done through Tableau Cloud site UI, you can specify the configuration URL&nbsp;or the end session endpoint from your IdP. For example, "https://myidp.com/oauth2/v1/logout".</td>
                                </tr>
                                <tr>
                                    <td><code>allowEmbeddedAuthentication</code>
                                    </td>
                                    <td>(Optional) Controls how users authenticate when accessing embedded views. Value can be "<span class="api-command-ref">true</span>"&nbsp;or "<span class="api-command-ref">false</span>". Default value is "false", which authenticates users in a separate pop-up window. When set to "true", users authenticate using an inline frame (IFrame), which is less secure.</td>
                                </tr>
                                <tr>
                                    <td><code>customScope</code>
                                    </td>
                                    <td>(Optional) Specifies a custom scope user-related value that you can use to query the IdP. For example, "openid, email, profile".</td>
                                </tr>
                                <tr>
                                    <td><code>prompt</code>
                                    </td>
                                    <td>(Optional) Specifies whether the user is prompted for re-authentication and consent. For example, "login, consent".</td>
                                </tr>
                                <tr>
                                    <td><code>clientAuthentication</code>
                                    </td>
                                    <td>(Optional) Token endpoint authentication method. Value can be "<span class="api-command-ref">client_secret_basic</span>" or "<span class="api-command-ref">client_secret_post</span>". Default value is "client_secret_basic". </td>
                                </tr>
                                <tr>
                                    <td><code>essentialAcrValues</code>
                                    </td>
                                    <td>(Optional) List of essential Authentication Context Reference Class values used for authentication. For example, "phr".</td>
                                </tr>
                                <tr>
                                    <td><code>voluntaryAcrValues</code>
                                    </td>
                                    <td>(Optional) List of voluntary Authentication Context Reference Class values used for authentication.</td>
                                </tr>
                                <tr>
                                    <td><code>emailMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving email from the OIDC token. Default value is "email".</td>
                                </tr>
                                <tr>
                                    <td><code>firstNameMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving first name from the OIDC token. Default value is "given_name". You can use this attribute to retrieve the user’s display name when <code>useFullName</code> attribute is set to "false".</td>
                                </tr>
                                <tr>
                                    <td><code>lastNameMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving last name from the OIDC token. Default value is "family_name". You can use this attribute to retrieve the user’s display name when <code>useFullName</code> attribute is set to "false".</td>
                                </tr>
                                <tr>
                                    <td><code>fullNameMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving name from the OIDC token. Default value is "name". You can use this attribute to retrieve the user’s display name when <code>useFullName</code> attribute is set to "true".</td>
                                </tr>
                                <tr>
                                    <td><code>useFullName</code>
                                    </td>
                                    <td>(Optional) Controls what is used as the display name. Value can be "<span class="api-command-ref">true</span>" or "<span class="api-command-ref">false</span>". Default value is "false", which uses first name <code>(firstNameMapping</code> attribute) and last name (<code>lastNameMapping</code> attribute)&nbsp;as the user display name. When set to "true", full name (<code>fullNameMapping</code> attribute) is used as the user display name.</td>
                                </tr>
                            </tbody>
                        </table>

#### cURL Request Example

`curl "https://us-west-2a.online.tableau.com/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/site-oidc-configuration" -X PUT -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @create-update-oidc-config.xml`

**Content of create-update-oidc-config.xml:**

Copy

```
<tsRequest>  <siteOIDCConfiguration    idpConfigurationName="idpConfigurationName"    enabled="enabled"    clientId="clientId"    clientSecret="clientSecret"    authorizationEndpoint="authorizationEndpoint"    tokenEndpoint="tokenEndpoint"    userinfoEndpoint="userinfoEndpoint"    jwksUri="jwksUri"    idpConfigurationName="idpConfigurationName"    endSessionEndpoint="endSessionEndpoint"    allowEmbeddedAuthentication="allowEmbeddedAuthentication"    prompt="prompt"    customScope="customScope"    clientAuthentication="clientAuthentication"    essentialAcrValues="essentialAcrValues"    voluntaryAcrValues="voluntaryAcrValues"    emailMapping="emailMapping"    firstNameMapping="firstNameMapping"    lastNameMapping="lastNameMapping"    fullNameMapping="fullNameMapping"    useFullName="useFullName" /></tsRequest>
```

#### Response Code

200

#### Response Body

Copy

```
<tsResponse>  <siteOIDCConfiguration    idpConfigurationName="Auth_External_OIDC"    enabled="true"     testLoginUrl="https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC"    allowEmbeddedAuthentication="false"    clientId="0oa111usf1gpUkVUt0h1"     clientSecret="&lt;omit>"    authorizationEndpoint="https://myidp.com/oauth2/v1/authorize"    tokenEndpoint="https://myidp.com/oauth2/v1/token"    userinfoEndpoint="https://myidp.com/oauth2/v1/userinfo"    jwksUri="https://myidp.com/oauth2/v1/keys"    endSessionEndpoint="https://myidp.com/oauth2/v1/logout"    customScope="openid, email, profile"    prompt="login,consent"    clientAuthentication="client_secret_basic"    essentialAcrValues="phr"    emailMapping="email"    firstNameMapping="given_name"    lastNameMapping="family_name"    fullNameMapping="name"    useFullName="false" /></tsResponse>
```

Copy

```
{"siteOIDCConfiguration": {    "idpConfigurationName":"Auth_External_OIDC",    "enabled":"true",     "testLoginUrl":"https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC",    "allowEmbeddedAuthentication":"false",    "clientId":"0oa111usf1gpUkVUt0h1",     "clientSecret":"&lt;omit>",    "authorizationEndpoint":"https://myidp.com/oauth2/v1/authorize",    "tokenEndpoint":"https://myidp.com/oauth2/v1/token",    "userinfoEndpoint":"https://myidp.com/oauth2/v1/userinfo",    "jwksUri":"https://myidp.com/oauth2/v1/keys",    "endSessionEndpoint":"https://myidp.com/oauth2/v1/logout",    "customScope":"openid, email, profile",    "prompt":"login,consent",    "clientAuthentication":"client_secret_basic",    "essentialAcrValues":"phr",    "emailMapping":"email",    "firstNameMapping":"given_name",    "lastNameMapping":"family_name",    "fullNameMapping":"name",    "useFullName":"false"    }}
```

**Notes:**

- The response hides the client secret and replaces it with `&lt;omit>`.
- You can use the testloginURL attribute to validate the OIDC configuration. When you enter the URL in a browser, details about the configuration displays.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header was invalid or has expired.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Get OpenID Connect Configuration

Get details about the Tableau Cloud site's OpenID Connect (OIDC) configuration.

**Version:** Available in API 3.22 (Tableau Cloud February 2024) and later. Not available for Tableau Server. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Tableau Cloud site admins only.

**JWT Access Scope:** Not available.

#### URI

GET /api/api-version/sites/site-luid/site-oidc-configuration?idpConfigurationId=idp-configuration-id

**Note:** The resource, GET /api/api-version/sites/site-luid/site-oidc-configuration?idpConfigurationId=idpConfigurationId, was added in version 3.24. The original resource, PUT /api/api-version/sites/site-luid/site-oidc-configuration, continues to be a supported resource if your site is configured with only one OIDC authentication configuration. If you don’t specify an `idpConfigurationId` value starting in API 3.24, the initial OIDC configuration on the site is removed. If there is no initial OIDC configuration on the site, then no OIDC configuration is removed.

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">idp-configuration-id</span></td><td>The ID of the configuration. To get the <span class="api-command-ref">idpConfigurationId</span> value, use the <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a> method.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "https://us-west-2a.online.tableau.com/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/site-oidc-configuration?idpConfigurationId=00000000-0000-0000-0000-0000000000" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Code

200

#### Response Body

Copy

```
<tsResponse>  <siteOIDCConfiguration    enabled="true"     testLoginUrl="https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC"    allowEmbeddedAuthentication="false"    clientId="0oa111usf1gpUkVUt0h1"     clientSecret="&lt;omit>"    authorizationEndpoint="https://myidp.com/oauth2/v1/authorize"    tokenEndpoint="https://myidp.com/oauth2/v1/token"    userinfoEndpoint="https://myidp.com/oauth2/v1/userinfo"    jwksUri="https://myidp.com/oauth2/v1/keys"    idpConfigurationName="Initial OIDC"    endSessionEndpoint="https://myidp.com/oauth2/v1/logout"    customScope="openid, email, profile"    prompt="login,consent"    clientAuthentication="client_secret_basic"    essentialAcrValues="phr"    emailMapping="email"    firstNameMapping="given_name"    lastNameMapping="family_name"    fullNameMapping="name"    useFullName="false"    idpConfigurationId="00000000-0000-0000-0000-000000000000" /></tsResponse>
```

Copy

```
{ "siteOIDCConfiguration": {    "enabled":"true",    "testLoginUrl":"https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC",    "allowEmbeddedAuthentication":"false",    "clientId":"0oa111usf1gpUkVUt0h1",    "clientSecret":"&lt;omit>",    "authorizationEndpoint":"https://myidp.com/oauth2/v1/authorize",    "tokenEndpoint":"https://myidp.com/oauth2/v1/token",    "userinfoEndpoint":"https://myidp.com/oauth2/v1/userinfo",    "jwksUri":"https://myidp.com/oauth2/v1/keys",    "idpConfigurationName":"Initial OIDC"    "endSessionEndpoint":"https://myidp.com/oauth2/v1/logout",    "customScope":"openid, email, profile",    "prompt":"login,consent",    "clientAuthentication":"client_secret_basic",    "essentialAcrValues":"phr",    "emailMapping":"email",    "firstNameMapping":"given_name",    "lastNameMapping":"family_name",    "fullNameMapping":"name",    "useFullName":"false",    "idpConfigurationId":"00000000-0000-0000-0000-000000000000"    }}
```

**Notes:**

- The response hides the client secret and replaces it with `&lt;omit>`.
- You can use the `testloginURL` to validate the OIDC configuration. When you enter the URL in a browser, details about the configuration displays.
- You can use the `idpConfigurationId` to assign the authentication method to a user using the [Add User to Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#add_user_to_site) and [Update User](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#update_user) methods.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header was invalid or has expired.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Remove OpenID Connect Configuration

Disable and clear the Tableau Cloud site's OpenID Connect (OIDC) configuration.

**Important:** Before removing the OIDC configuration, make sure that users who are set to authenticate with OIDC are set to use a different authentication type. Users who are not set with a different authentication type before removing the OIDC configuration will not be able to sign in to Tableau Cloud.

**Version:** Available in API 3.22 (Tableau Cloud February 2024) and later. Not available for Tableau Server. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Tableau Cloud site admins only.

**JWT Access Scope:** Not available.

#### URI

PUT /api/api-version/sites/site-luid/disable-site-oidc-configuration?idpConfigurationId=idp-configuration-id

**Note:** The resource, PUT /api/api-version/sites/site-luid/disable-site-oidc-configuration?idpConfigurationId=idpConfigurationId, was added in version 3.24. The original resource, PUT /api/api-version/sites/site-luid/disable-site-oidc-configuration, continues to be a supported resource if your site is configured with only one OIDC authentication configuration. If you don’t specify an `idpConfigurationId` value starting in API 3.24, the initial (default) OIDC configuration on the site is removed. If there is no initial OIDC configuration on the site, then no OIDC configuration is removed.

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">idp-configuration-id</span></td><td>The ID of the configuration. To get the <span class="api-command-ref">idpConfigurationId</span> value, use the <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a> method.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "https://us-west-2a.online.tableau.com/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/disable-site-oidc-configuration?idpConfigurationId=b2207590-024c-4a6e-ac4a-eca6eefabb2e" -X PUT -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Code

200

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header was invalid or has expired.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Update OpenID Connect Configuration

Update the Tableau Cloud site's OpenID Connect (OIDC) configuration.

**Version:** Available in API 3.22 (Tableau Cloud February 2024) and later. Not available for Tableau Server._[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Tableau Cloud site admins only.

**JWT Access Scope:** Not available.

#### URI

PUT /api/api-version/sites/site-luid/site-oidc-configuration

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr></tbody></table>

#### Request Body

Copy

```
<tsRequest>  <siteOIDCConfiguration    idpConfigurationId="idpConfigurationId"    enabled="enabled"    clientId="clientId"    clientSecret="clientSecret"    authorizationEndpoint="authorizationEndpoint"    tokenEndpoint="tokenEndpoint"    userinfoEndpoint="userinfoEndpoint"    jwksUri="jwksUri"    idpConfigurationName="idpConfigurationName"    endSessionEndpoint="endSessionEndpoint"    allowEmbeddedAuthentication="allowEmbeddedAuthentication"    prompt="prompt"    customScope="customScope"    clientAuthentication="clientAuthentication"    essentialAcrValues="essentialAcrValues"    voluntaryAcrValues="voluntaryAcrValues"    emailMapping="emailMapping"    firstNameMapping="firstNameMapping"    lastNameMapping="lastNameMapping"    fullNameMapping="fullNameMapping"    useFullName="useFullName" /></tsRequest>
```

Copy

```
{  "siteOIDCConfiguration": {    "idpConfigurationId": "idpConfigurationId",    "enabled": "enabled",    "clientId": "clientId",    "clientSecret": "clientSecret",    "authorizationEndpoint": "authorizationEndpoint",    "tokenEndpoint": "tokenEndpoint",    "userinfoEndpoint": "userinfoEndpoint",    "jwksUri": "jwksUri",    "idpConfigurationName": "idPConfigurationName",    "endSessionEndpoint": "endSessionEndpoint",    "allowEmbeddedAuthentication": "allowEmbeddedAuthentication",    "prompt":"prompt",    "customScope":"customScope",    "clientAuthentication": "clientAuthentication",    "essentialAcrValues": "essentialAcrValues",    "voluntaryAcrValues": "voluntaryAcrValues",    "emailMapping": "emailMapping",    "firstNameMapping": "firstNameMapping",    "lastNameMapping": "lastNameMapping",    "fullNameMapping": "fullNameMapping",    "useFullName": "useFullName"    }}
```

#### Request Attributes

**Note:** Because partial updates are not supported therefore, you must include all the needed attributes in your request to ensure the configuration update is completed successfully.

<table class="api-parameters-table" style="margin-left: 0;margin-right: auto;">
                            <colgroup><col class="api-parameters-table-col-1">
                            <col>
                            </colgroup><tbody>
                                <tr>
                                    <td><code>idpConfigurationId</code>
                                    </td>
                                    <td>
                       (Required)
Starting in API 3.24, multiple authentication configurations can be created and enabled at the same time. Include the <span class="api-command-ref">idpConfigurationId</span> to identify which configuration to update. If no <span class="api-command-ref">IdPConfigurationId</span> is specified, the initial (default) OIDC configuration is updated if it exists.<p>To get the <span class="api-command-ref">idpConfigurationId</span> value, use the <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a> method.</p><p>For more information, see <a href="https://help.tableau.com/current/online/en-us/security_auth.htm#multiple_idp" target="_blank">Authentication</a> in the Tableau Cloud Help.</p></td>
                                </tr>
                                <tr>
                                    <td><code>enabled</code>
                                    </td>
                                    <td>(Required) Controls whether the configuration is enabled or not. Value can be "<span class="api-command-ref">true</span>" or "<span class="api-command-ref">false</span>". For example "true".</td>
                                </tr>
                                <tr>
                                    <td><code>clientId</code>
                                    </td>
                                    <td>(Required) The client ID&nbsp;from your IdP. For example, "0oa111usf1gpUkVUt0h1".</td>
                                </tr>
                                <tr>
                                    <td><code>clientSecret</code>
                                    </td>
                                    <td>(Required) The client secret from your IdP.</td>
                                </tr>
                                <tr>
                                    <td><code>authorizationEndpoint</code>
                                    </td>
                                    <td>(Required) Use the authorization endpoint from your IdP. To find the value, enter the configuration URL in a browser and obtain the user information endpoint (<code>authorization_endpoint</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/authorize".</td>
                                </tr>
                                <tr>
                                    <td><code>tokenEndpoint</code>
                                    </td>
                                    <td>(Required) Use the token endpoint from your IdP. To find the value, enter the configuration URL in a browser and obtain the token endpoint (<code>token_endpoint</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/token". </td>
                                </tr>
                                <tr>
                                    <td><code>userinfoEndpoint</code>
                                    </td>
                                    <td>(Required) Use the user information endpoint from your IdP. To find the value, enter the configuration URL in a browser and obtain the user information endpoint (<code>userinfo_endpoint</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/userinfo".</td>
                                </tr>
                                <tr>
                                    <td><code>jwksUri</code>
                                    </td>
                                    <td>(Required) Use the JWK set URI from your IdP. To find the value, enter the configuration URL in a browser and obtain the JWK set URI endpoint (<code>jwks_uri</code>) from the details that are returned. For example, "https://myidp.com/oauth2/v1/keys".</td>
                                </tr>
                                <tr>
                                    <td><code>idpConfigurationName</code>
                                    </td>
                                    <td>
                                        <p>(Optional) The name of the configuration. </p>
                                        <p>Starting in API&nbsp;3.24, you can create and enable multiple authentication configurations. Authentication configurations that were enabled before API 3.24 are given a name and its name can't be updated. For example, "Initial OIDC". If this configuration was created after API&nbsp;3.23 and no name is provided for the update, the name will stay the same. For more information, see <a href="https://help.tableau.com/current/online/en-us/security_auth.htm#multiple_idp" target="_blank">Authentication</a> in the Tableau Cloud Help.</p>
                                    </td>
                                </tr>
                                <tr>
                                    <td><code>endSessionEndpoint</code>
                                    </td>
                                    <td>(Optional) If single logout (SLO) is enabled for the site, which is done through Tableau Cloud site UI, you can specify the configuration URL&nbsp;or the end session endpoint from your IdP. For example, "https://myidp.com/oauth2/v1/logout".</td>
                                </tr>
                                <tr>
                                    <td><code>allowEmbeddedAuthentication</code>
                                    </td>
                                    <td>(Optional) Controls how users authenticate when accessing embedded views. Value can be "<span class="api-command-ref">true</span>"&nbsp;or "<span class="api-command-ref">false</span>". Default value is "false", which authenticates users in a separate pop-up window. When set to "true", users authenticate using an inline frame (IFrame), which is less secure.</td>
                                </tr>
                                <tr>
                                    <td><code>customScope</code>
                                    </td>
                                    <td>(Optional) Specifies a custom scope user-related value that you can use to query the IdP. For example, "openid, email, profile".</td>
                                </tr>
                                <tr>
                                    <td><code>prompt</code>
                                    </td>
                                    <td>(Optional) Specifies whether the user is prompted for re-authentication and consent. For example, "login, consent".</td>
                                </tr>
                                <tr>
                                    <td><code>clientAuthentication</code>
                                    </td>
                                    <td>(Optional) Token endpoint authentication method. Value can be "<span class="api-command-ref">client_secret_basic</span>" or "<span class="api-command-ref">client_secret_post</span>". Default value is "client_secret_basic". </td>
                                </tr>
                                <tr>
                                    <td><code>essentialAcrValues</code>
                                    </td>
                                    <td>(Optional) List of essential Authentication Context Reference Class values used for authentication. For example, "phr".</td>
                                </tr>
                                <tr>
                                    <td><code>voluntaryAcrValues</code>
                                    </td>
                                    <td>(Optional) List of voluntary Authentication Context Reference Class values used for authentication.</td>
                                </tr>
                                <tr>
                                    <td><code>emailMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving email from the OIDC token. Default value is "email".</td>
                                </tr>
                                <tr>
                                    <td><code>firstNameMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving first name from the OIDC token. Default value is "given_name". You can use this attribute to retrieve the user’s display name when <code>useFullName</code> attribute is set to "false".</td>
                                </tr>
                                <tr>
                                    <td><code>lastNameMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving last name from the OIDC token. Default value is "family_name". You can use this attribute to retrieve the user’s display name when <code>useFullName</code> attribute is set to "false".</td>
                                </tr>
                                <tr>
                                    <td><code>fullNameMapping</code>
                                    </td>
                                    <td>(Optional) Claim for retrieving name from the OIDC token. Default value is "name". You can use this attribute to retrieve the user’s display name when <code>useFullName</code> attribute is set to "true".</td>
                                </tr>
                                <tr>
                                    <td><code>useFullName</code>
                                    </td>
                                    <td>(Optional) Controls what is used as the display name. Value can be "<span class="api-command-ref">true</span>" or "<span class="api-command-ref">false</span>". Default value is "false", which uses first name <code>(firstNameMapping</code> attribute) and last name (<code>lastNameMapping</code> attribute)&nbsp;as the user display name. When set to "true", full name (<code>fullNameMapping</code> attribute) is used as the user display name.</td>
                                </tr>
                            </tbody>
                        </table>

#### cURL Request Example

`curl "https://us-west-2a.online.tableau.com/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/site-oidc-configuratioin" -X PUT -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @create-update-oidc-config.xml`

**Content of create-update-oidc-config.xml:**

Copy

```
<tsRequest>  <siteOIDCConfiguration    idpConfigurationId="idpConfigurationId"    enabled="enabled"    clientId="clientId"    clientSecret="clientSecret"    authorizationEndpoint="authorizationEndpoint"    tokenEndpoint="tokenEndpoint"    userinfoEndpoint="userinfoEndpoint"    jwksUri="jwksUri"    idPConfigurationName="idPConfigurationName"    endSessionEndpoint="endSessionEndpoint"    allowEmbeddedAuthentication="allowEmbeddedAuthentication"    prompt="prompt"    customScope="customScope"    clientAuthentication="clientAuthentication"    essentialAcrValues="essentialAcrValues"    voluntaryAcrValues="voluntaryAcrValues"    emailMapping="emailMapping"    firstNameMapping="firstNameMapping"    lastNameMapping="lastNameMapping"    fullNameMapping="fullNameMapping"    useFullName="useFullName" /></tsRequest
```

#### Response Code

200

#### Response Body

Copy

```
<tsResponse>  <siteOIDCConfiguration    idpConfigurationId="00000000-0000-0000-0000-000000000000"    enabled="true"     testLoginUrl="https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC"    allowEmbeddedAuthentication="false"    clientId="0oa111usf1gpUkVUt0h1"     clientSecret="&lt;omit>"    authorizationEndpoint="https://myidp.com/oauth2/v1/authorize"    tokenEndpoint="https://myidp.com/oauth2/v1/token"    userinfoEndpoint="https://myidp.com/oauth2/v1/userinfo"    jwksUri="https://myidp.com/oauth2/v1/keys"    idPConfigurationName="Initial OIDC"    endSessionEndpoint="https://myidp.com/oauth2/v1/logout"    customScope="openid, email, profile"    prompt="login,consent"    clientAuthentication="client_secret_basic"    essentialAcrValues="phr"    emailMapping="email"    firstNameMapping="given_name"    lastNameMapping="family_name"    fullNameMapping="name"    useFullName="false" /></tsResponse>
```

Copy

```
{  "siteOIDCConfiguration": {    "idpConfigurationId":"00000000-0000-0000-0000-000000000000",    "enabled":"true",    "testLoginUrl="https://sso.online.tableau.com/public/testLogin?alias=080bca2d-578b-49cc-b40d-3781b36b30ee&authSetting=OIDC",    "allowEmbeddedAuthentication":"false",    "clientId":"0oa111usf1gpUkVUt0h1",    "clientSecret":"&lt;omit>",    "authorizationEndpoint":"https://myidp.com/oauth2/v1/authorize",    "tokenEndpoint":"https://myidp.com/oauth2/v1/token",    "userinfoEndpoint":"https://myidp.com/oauth2/v1/userinfo",    "jwksUri":"https://myidp.com/oauth2/v1/keys",    "idPConfigurationName":"Initial OIDC",    "endSessionEndpoint":"https://myidp.com/oauth2/v1/logout",    "customScope":"openid, email, profile",    "prompt":"login,consent",    "clientAuthentication":"client_secret_basic",    "essentialAcrValues":"phr",    "emailMapping":"email",    "firstNameMapping":"given_name",    "lastNameMapping":"family_name",    "fullNameMapping":"name",    "useFullName":"false"     }}
```

**Notes:**

- The response hides the client secret and replaces it with `&lt;omit>`.
- You can use the testloginURL to validate the OIDC configuration. When you enter the URL in a browser, details about the configuration displays.
- You can use the idpConfigurationId to assign authentication to a user using the [Add User to Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#add_user_to_site) and [Update User](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#update_user) methods.

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header was invalid or has expired.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).