---
schema_version: "1"
id: 377abcd10072411ef65fb58c7c7c3d2d35ba2659460101e5c2364af3ebecce06
title: Permissions Methods
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/api/rest_api/REST/rest_api_ref_permissions.md
canonical_url: https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_permissions.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 4bf981bcb66b928d4ff599e29cab31d05c95fd86cf0ea2d6f761cfa6c61e4810
description: "Using the permissions methods of the Tableau REST API you can:"
---
[Skip to main content](#main-content)

# Permissions Methods

Using the permissions methods of the Tableau REST API you can:

- List, add, and delete granular default permissions that apply to new content created in a project
- List, add, and delete granular permissions for existing projects, workbooks, views, flows, metrics, Ask data lenses, and data sources

This functionality relates to the UI elements and concepts described at: [Permissions Reference](https://help.tableau.com/current/server/en-us/permissions.htm).

## Use Postman

Our Postman collection of requests enables you to construct, send, and examine HTTP requests to the Tableau Server or Tableau Cloud API without writing initial code. Postman is a free online app used by many developers for prototyping API calls, investigating issues, and generating request code in a variety of languages.

[Postman: Permissions](https://www.postman.com/salesforce-developers/salesforce-developers/folder/qs14seb/permissions)

## Add Ask Data Lens Permissions - Retired in API 3.22

> > [!WARNING]
> > 
> > Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai).

Adds permissions to the specified ask data lens for a user or group. You can specify multiple sets of permissions using one request.

If a specified permission has already been granted or denied for a given user or group, the system ignores it.

#### URI

PUT /api/api-version/sites/site-luid/lenses/lens-luid/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID of the site that contains the data source.</td></tr><tr><td><span class="api-placeholder">lens-luid</span></td><td>The LUID of the data source to set permissions for.</td></tr></tbody></table>

#### Request Body

                    `<tsRequest>   <permissions>     <lens id="lens-luid" />     <granteeCapabilities>       <user id="user-luid" />       <capabilities>         <capability name="capability-name" mode="capability-mode" />         ... additional capabilities ...       </capabilities>     </granteeCapabilities>     <granteeCapabilities>       <group id="group-luid" />       <capabilities>         <capability name="capability-name" mode="capability-mode" />         ... additional capabilities ...       </capabilities>     </granteeCapabilities>     ... additional grantee capability sets ...   </permissions> </tsRequest>`
        

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">lens-luid</span>
                                        </td>
                                        <td>Required. The LUID of the ask data lens permissions are being configured for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-luid</span>
                                        </td>
                                        <td>Optional <i>(at least one user or group must be specified)</i>. The LUID of the user to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-luid</span>
                                        </td>
                                        <td>Optional. The LUID of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                   The capability to assign. For valid capabilities for a data source project are
                       <span class="api-command-ref">ChangePermissions</span>,
                       <span class="api-command-ref">Delete</span>,
                       <span class="api-command-ref">Move</span>,
                       <span class="api-command-ref">Read</span>,
					   <span class="api-command-ref">Write</span>.
						<p>For more information, see
<a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.
				  </p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to allow the capability,
                                    or <span class="api-command-ref">Deny</span> to deny it. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Users with server or site administrator permissions, and non-administrators that have ChangePermissions permission for the lens (either explicitly or implicitly), can add ask data lens permissions.

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <lens id="lens-luid"  name ="lens-name" />
    <granteeCapabilities>
      <user id="user-luid" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        <!--    ... additional capabilities ... -->
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-luid" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        <!--   ... additional capabilities ...  -->
      </capabilities>
    </granteeCapabilities>
    <!--   ... additional grantee capability sets ...   -->
  </permissions>
</tsResponse>
```

#### Version

Introduced Tableau Cloud June 2022 (API 3.16). Not currently available for Tableau Server. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The specified capability is invalid for a data source. Valid capabilities for a data source are <span class="api-command-ref">ChangePermissions</span>, <span class="api-command-ref">Delete</span>, <span class="api-command-ref">Move</span>, <span class="api-command-ref">Read</span>, and <span class="api-command-ref">Write</span>.</td></tr><tr><td>403</td><td>403004</td><td>No permissions to set permissions.</td><td>A user attempted to add permissions to a data source, but the caller doesn't have permission to set permissions on the data source.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The specified site doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user specified in the request body doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404006</td><td>Lens not found</td><td>The specified lens doesn't correspond to an existing data source.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group specified in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>A capability specified in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">PUT</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add Collection Permissions

Adds permissions to the specified collection for a user or group. You can specify multiple sets of permissions using one call.

If a specified permission has already been granted or denied for a given user or group, the system ignores it.

#### URI

PUT /api/api-version/sites/site-id/collections/collection-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the collection.</td></tr><tr><td><span class="api-placeholder">collection-id</span></td><td>The ID of the collection to set permissions for.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
    <granteeCapabilities>
      <user id="user-id" />
        <capabilities>
          <capability name="capability-name" mode="capability-mode" />
          <!-- ... additional capabilities ... -->
        </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
        <capabilities>
          <capability name="capability-name" mode="capability-mode" />
          <!-- ... additional capabilities ... -->
        </capabilities>
    </granteeCapabilities>
    <!-- ... additional granteeCapability sets ... -->
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-extra-wide">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">user-id</span>
                                </td>
                                <td>The ID  of the user to add permissions for.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">group-id</span>
                                </td>
                                <td>The ID  of the group to add permissions for.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">capability-name</span>
                                </td>
                                <td>
                                    <p>The capability to assign. The only valid capability for a collection is <span class="api-command-ref">Read</span>.</p>
                                    <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">capability-mode</span>
                                </td>
                                <td><span class="api-command-ref">Allow</span> to allow the capability,
                                    or <span class="api-command-ref">Deny</span> to deny it.</td>
                            </tr>
                        </tbody>
                    </table>

#### Permissions

This method can be called by server administrators, site administrators, and collection owners.

#### Required scope for JWT authorization

_Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <collection id="1a1b1c1d-2e2f-2a2b-3c3d-3e3f4a4b4c4d" name="My Collection">
      <owner id="12ab34cd-56ef-78ab-90cd-12ef34ab56cd"/>
    </collection>
    <granteeCapabilities>
      <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d"/>
      <capabilities>
        <capability name="Read" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <user id="#9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"/>
      <capabilities>
        <capability name="Read" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsResponse>
```

#### Version

Version 3.12 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                        <colgroup>
                            <col class="api-error-table-col-1">
                            <col class="api-error-table-col-2">
                            <col class="api-error-table-col-3">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <th>HTTP status</th>
                                <th><code>error</code> Code</th>
                                <th>Condition</th>
                                <th>Details</th>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400000</td>
                                <td>Bad request</td>
                                <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                            </tr>
                            <tr>
                                <td>403</td>
                                <td>403004</td>
                                <td>No permissions to set permissions.</td>
                                <td>A user attempted to add permissions to a collection, but the caller doesn't have permission to set permissions on the collection.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404000</td>
                                <td>Resource not found</td>
                                <td>The site ID in the URI wasn't found.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404002</td>
                                <td>User not found</td>
                                <td>The user in the request body wasn't found.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404012</td>
                                <td>Group not found</td>
                                <td>The group in the request body wasn't found.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404013</td>
                                <td>Resource not found</td>
                                <td>
                                    <p>The capability to remove the permission for. The only valid capability name for a collection is <span class="api-command-ref">Read</span>. The only valid capability mode is <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span>.</p>
                                </td>
                            </tr>
                        </tbody>
                    </table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add Data Source Permissions

Adds permissions to the specified data source for a user or group. You can specify multiple sets of permissions using one call.

If a specified permission has already been granted or denied for a given user or group, the system ignores it.

If the request body includes a child workbook or <project> element, the request is invalid.

#### URI

PUT /api/api-version/sites/site-id/datasources/datasource-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the data source.</td></tr><tr><td><span class="api-placeholder">datasource-id</span></td><td>The ID of the data source to set permissions for.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
    <datasource id="datasource-id" />
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">datasource-id</span>
                                        </td>
                                        <td>
                  The <span class="api-command-ref">&lt;datasource&gt;</span> element is not required, but can be included for compatibility
					with earlier versions of the REST API. If the <span class="api-command-ref">&lt;datasource&gt;</span> element is included,
					the <span class="api-placeholder">datasource-id</span> value must match the data source ID in the URI. Any other attributes
					in the <span class="api-command-ref">&lt;datasource&gt;</span> element are ignored.
              </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID (not name) of the user to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID (not name) of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                   The capability to assign. For valid capabilities for a data source project are
					   <span class="api-command-ref">PulseMetricDefine</span>,
                       <span class="api-command-ref">ChangePermissions</span>,
                       <span class="api-command-ref">Connect</span>,
                       <span class="api-command-ref">Delete</span>,
                       <span class="api-command-ref">ExportXml</span>, <strong>ExtractRefresh</strong>,<span class="api-command-ref">Read</span> (view),
						<span class="api-command-ref">Write</span>, and
						<span class="api-command-ref">SaveAs</span>.
						<p>For more information, see
<a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.
				  </p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to allow the capability,
                                    or <span class="api-command-ref">Deny</span> to deny it. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Users who are not server administrators or site administrators can add permissions only to a data source for which they have ChangePermissions permission (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse version-and-namespace-settings>
  <permissions>
    <datasource id="datasource-id" />
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsResponse>
```

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The specified capability is invalid for a data source. Valid capabilities for a data source are <span class="api-command-ref">ChangePermissions</span>, <span class="api-command-ref">Connect</span>, <span class="api-command-ref">Delete</span>, <span class="api-command-ref">ExportXml</span>, <span class="api-command-ref">Read</span>, and <span class="api-command-ref">Write</span>.</td></tr><tr><td>403</td><td>403004</td><td>No permissions to set permissions.</td><td>A user attempted to add permissions to a data source, but the caller doesn't have permission to set permissions on the data source.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The specified site doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user specified in the request body doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404004</td><td>Data source not found</td><td>The specified data source doesn't correspond to an existing data source.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group specified in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>A capability specified in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add Default Permissions

Adds default permission rules for workbook, data source, data role, lens, flow, metric, or virtual connection resources in a project for a user or group. If Tableau Catalog is enabled, also adds default permission rules for database or table resources in a project for a user or group. After adding default permission rules, new resources of the type you specify that are added to the project will have those permission rules. If permissions are [locked to the project](https://help.tableau.com/current/server/en-us/permissions.htm#LockProject), then the same is true for all existing child content of the project. For more information, see [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm).

Content owners can override default permissions for their content, but only if project permissions have not been locked. Project permissions can be locked for a new project when you call [Create Project](#create_project) or for an existing project by calling [Update Project](#update_project). For more information, see [Lock Content Permissions to the Project](https://help.tableau.com/current/server/en-us/permissions.htm#LockProject).

#### URI

Workbooks:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/workbooks

Data sources:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/datasources

Data roles:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/dataroles

Lenses:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/lenses

Metrics:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/metrics

Flows:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/flows

Virtual Connections _(endpoint introduced in [API version](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm#rest_and_tableau_version_table) 3.23)_:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/virtualconnections

Databases:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/databases

Tables:

PUT /api/api-version/sites/site-luid/projects/project-luid/default-permissions/tables

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID of the site that contains the project.</td></tr><tr><td><span class="api-placeholder">project-luid</span></td><td>The LUID of the project to set default permissions for.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
	<granteeCapabilities>
	  <user id="user-luid" />
      <capabilities>
	    <capability name="capability-name" mode="capability-mode" />
	    < !-- ... additional capabilities ... -->
	  </capabilities>
	</granteeCapabilities>
	<granteeCapabilities>
      <group id="group-luid" />
	  <capabilities>
		<capability name="capability-name" mode="capability-mode" />
		< !-- ...  additional capabilities ... -->
	  </capabilities>
	</granteeCapabilities>
    < !-- ... additional grantee capability sets ...  -->
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-luid</span>
                                        </td>
                                        <td>The LUID of the user to add default permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-luid</span>
                                        </td>
                                        <td>The LUID of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>The capability to assign. Valid capabilities for a workbook are
					</p><ul><li><span class="api-command-ref">AddComment</span></li><li><span class="api-command-ref">ChangeHierarchy</span></li><li><span class="api-command-ref">ChangePermissions</span></li><li><span class="api-command-ref">Delete</span></li><li><span class="api-command-ref">ExportData</span></li><li><span class="api-command-ref">ExportImage</span></li><li><span class="api-command-ref">ExportXml</span></li><li><span class="api-command-ref">Filter</span></li><li><span class="api-command-ref">Read</span> (view)</li><li><span class="api-command-ref">ShareView</span></li><li><span class="api-command-ref">ViewComments</span></li><li><span class="api-command-ref">ViewUnderlyingData</span></li><li><span class="api-command-ref">WebAuthoring</span></li><li><span class="api-command-ref">Write</span></li><li><span class="api-command-ref">RunExplainData</span></li><li><span class="api-command-ref">CreateRefreshMetrics</span></li></ul><p></p>
                                            <p>Valid capabilities for a data source are
					</p><ul><li><span class="api-command-ref">ChangePermissions</span></li><li><span class="api-command-ref">Connect</span></li><li><span class="api-command-ref">Delete</span></li><li><span class="api-command-ref">ExportXml</span></li><li><span class="api-command-ref">SaveAs</span></li><li><span class="api-command-ref">Read</span> (view)</li><li><span class="api-command-ref">Write</span></li></ul><p></p>
                                            <p>Valid capabilities for a flow are
					</p><ul><li><span class="api-command-ref">ChangeHierarchy</span></li><li><span class="api-command-ref">ChangePermissions</span></li><li><span class="api-command-ref">Delete</span></li><li><span class="api-command-ref">ExportXml</span> (download)</li><li><span class="api-command-ref">Execute</span></li><li><span class="api-command-ref">Read</span> (view)</li><li><span class="api-command-ref">WebAuthoringForFlows</span></li><li><span class="api-command-ref">Write</span></li></ul><p></p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to allow the capability, or <span class="api-command-ref">Deny</span> to deny it. This value is case sensitive.</td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Users who are not server administrators can add permissions defaults for a project only if they have the ProjectLeader permission for that project (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
	<database id="12ab34cd-56ef-78ab-90cd-12ef34ab56cd" name="oracle.test.example.com:1521"/>
	<granteeCapabilities>
	  <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"/>
	  <capabilities>
		<capability name="Read" mode="Allow"/>
		</capabilities>
	</granteeCapabilities>
  </permissions>
</tsResponse>
```

#### Version

- Version 2.1 and later.
- Version 3.23 and later for the virtual connection default permissions methods.
- For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400009</td>
                                        <td>Invalid capability</td>
                                        <td>                                         The capability in the URI is invalid for a data source.                                       <p>Valid capabilities for a workbook are                                     <span class="api-command-ref">AddComment</span>,                                     <span class="api-command-ref">ChangeHierarchy</span>,                                     <span class="api-command-ref">ChangePermissions</span>,     <span class="api-command-ref">CreateRefreshMetrics</span>,                                <span class="api-command-ref">Delete</span>,                                     <span class="api-command-ref">ExportData</span>,                                     <span class="api-command-ref">ExportImage</span>,                                     <span class="api-command-ref">ExportXml</span>,                                     <span class="api-command-ref">Filter</span>,                                     <span class="api-command-ref">Read</span> (view),        <span class="api-command-ref">RunExplainData</span>,                             <span class="api-command-ref">ShareView</span>,                                     <span class="api-command-ref">ViewComments</span>,                                     <span class="api-command-ref">ViewUnderlyingData</span>,                                     <span class="api-command-ref">WebAuthoring</span>, and                                     <span class="api-command-ref">Write</span>.</p><p>Valid capabilities for a data source are                                     <span class="api-command-ref">ChangePermissions</span>,                                     <span class="api-command-ref">Connect</span>,                                     <span class="api-command-ref">Delete</span>,                                     <span class="api-command-ref">ExportXml</span>,                                     <span class="api-command-ref">Read</span> (view), and                                     <span class="api-command-ref">Write</span>.</p></td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400042</td>
                                        <td>Malformed permissions qualifier</td>
                                        <td>The request body includes a <span class="api-command-ref">&lt;workbook&gt;</span> or <span class="api-command-ref">&lt;datasource&gt;</span> element.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403004</td>
                                        <td>Permissions setting forbidden</td>
                                        <td>A non-administrator user called this method but doesn't have permission to add permissions on the project.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site LUID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404002</td>
                                        <td>User not found</td>
                                        <td>A user LUID in the request body as the grantee doesn't correspond to an existing user.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404005</td>
                                        <td>Project not found</td>
                                        <td>The project LUID in the URI doesn't correspond to an existing project.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404009</td>
                                        <td>Project ID mismatch</td>
                                        <td>A project LUID specified in the URI does not match the project ID specified in the request body. (You do not have to specify a project ID in the request body.)</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404012</td>
                                        <td>Group not found</td>
                                        <td>A group LUID in the request body doesn't correspond to an existing group.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404013</td>
                                        <td>Capability not found</td>
                                        <td>The capability in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than                                         <span sclass="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add Project Permissions

Adds permissions to the specified project for a user or group. You can specify multiple sets of permissions using one call.

If the request body includes a child datasource or <project> element, the request is invalid.

#### URI

PUT /api/api-version/sites/site-id/projects/project-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the project.</td></tr><tr><td><span class="api-placeholder">project-id</span></td><td>The ID of the project to set permissions for.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID (not name) of the user to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID (not name) of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><a id="capability_name"></a><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                        The capability to assign permissions to. In Tableau Server 10.0, the valid
                                        capabilities for a project are
                                        <span class="api-command-ref">ProjectLeader</span>,
                                        <span class="api-command-ref">Read</span> (view), and
                                        <span class="api-command-ref">Write</span>.
                                        <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to allow the capability,
                                    or <span class="api-command-ref">Deny</span> to deny it. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Users who are not server administrators or site administrators can add permissions for a project only if they have ChangePermissions (version `2.0`) or ProjectLeader (version `2.1`) permission for that project (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <project id="project-id" name="project-name" />
      <owner id="project-owner-id" />
    </project>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsResponse>
```

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400009</td>
                                        <td>Invalid capability</td>
                                        <td>
                                            <p>
									The capability specified in the request is not in the <a href="#capability_name">list of valid capability names</a>
									for this method.
								</p>
                                            <p>
									The mode of the capability for <span class="api-command-ref">ProjectLeader</span> cannot be set to
									<span class="api-command-ref">Deny</span>.
								</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403004</td>
                                        <td>Permissions setting forbidden</td>
                                        <td>A non-administrator user called this method but doesn't have permission to add permissions on the project.
                                </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404002</td>
                                        <td>User not found</td>
                                        <td>A user ID in the request body as the grantee doesn't correspond to an existing user.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404005</td>
                                        <td>Project not found</td>
                                        <td>The project ID in the URI doesn't correspond to an existing project.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404009</td>
                                        <td>Project ID mismatch</td>
                                        <td>A project ID specified in the URI does not match the project ID specified in the request body. (You do not have to specify a project ID in the request body.)</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404012</td>
                                        <td>Group not found</td>
                                        <td>A group ID in the request body doesn't correspond to an existing group.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404013</td>
                                        <td>Capability not found</td>
                                        <td>The capability in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than
                                        <span sclass="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.
                                    </td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add View Permissions

Adds permissions to the specified view (also known as a sheet) for a user or group. You can specify multiple sets of permissions using one call.

#### URI

PUT /api/_api-version_/sites/_site-id_/views/_view-id_/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><i>api-version</i></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><i>site-id</i></td><td>The ID of the site that contains the workbook view.</td></tr><tr><td><i>view-id</i></td><td>The ID of the view to set permissions for. You can obtain this ID by calling <a href="#query_views_for_site">Query Views for Site</a>.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
    <view id="view-id" />
	<granteeCapabilities>
	  <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><i>view-id</i>
                                        </td>
                                        <td>The <i>view-id</i> value must match the view ID in the URI.
									</td>
                                    </tr>
                                    <tr>
                                        <td><i>user-id</i>
                                        </td>
                                        <td>The ID (not name) of the user to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><i>group-id</i>
                                        </td>
                                        <td>The ID (not name) of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><i>capability-name</i>
                                        </td>
                                        <td>The capability to assign. If any capability has already been
										granted or denied for a specified user or group, that capability is ignored. For valid capabilities for a view are
										<b>AddComment</b>, <b>ChangePermissions</b>, <b>Delete</b>, <b>ExportData</b>, <b>ExportImage</b>, <b>ExportXml</b>, <b>Filter</b>, <b>Read</b> (view), <b>ShareView</b>, <b>ViewComments</b>, <b>ViewUnderlyingData</b>, <b>WebAuthoring</b>, and <b>Write</b>.
									<p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p></td>
                                    </tr>
                                    <tr>
                                        <td><i>capability-mode</i>
                                        </td>
                                        <td><b>Allow</b> to allow the capability, or <b>Deny</b> to deny it. This value is case sensitive.
									</td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by server and site administrators, and user who have permission to set permissions on the workbook (either explicitly or implicitly). To use this method, the parent workbook that contains the specified view must have its **showTabs** attribute set to **Hide**. You can configure this setting by using the [Update Workbook](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#update_workbook) method.

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <view id="view-id" />
      <owner id="owner-id"/>
    </view>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        <capability name="capability-name" mode="capability-mode" />
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        <capability name="capability-name" mode="capability-mode" />
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
          </capabilities>
          </granteeCapabilities>
  </permissions>
</tsResponse>
```

The **createdAt** and **updatedAt** values are dates and times in UTC format (YYYY-MM-DDTHH:MM:SSZ).

#### Version

Version 3.2 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a view.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to set permissions on the view.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404011</td><td>View not found</td><td>The view ID in the URI doesn't correspond to an existing view.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group ID in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The specified capability doesn't correspond to a defined capability. This can apply to either an invalid capability name or an invalid capability value (other than <b>Allow</b> or <b>Deny</b>).</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/13020592-762f-4de4-a25e-f4beb005836e/views/e5a4b73e-5cbb-412d-907e-f31cc31684f7" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @add-view-permissions.xml`

**Example of add-view-permissions.xml:**

```
<tsRequest>
  <permissions>
    <view id="34acb0d7-fa37-43d7-bdde-d6635eb724b5" />
    <granteeCapabilities>
      <user id="8eda27d9-5ad2-42cd-a39a-61bc01a423af" />
      <capabilities>
        <capability name="ExportImage" mode="Allow" />
        <capability name="ChangePermissions" mode="Deny" />
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsRequest>
```

**Example response:**

```
<tsResponse>
  <permissions>
    <view id="34acb0d7-fa37-43d7-bdde-d6635eb724b5" name="What If Forecast">
      <owner id="8eda27d9-5ad2-42cd-a39a-61bc01a423af"/>
    </view>
    <granteeCapabilities>
      <group id="2aa47cfa-9f2b-11e8-a260-af4a26124661"/>
      <capabilities>
        <capability name="ShareView" mode="Allow"/>
        <capability name="ViewComments" mode="Allow"/>
        <capability name="Filter" mode="Allow"/>
        <capability name="ExportData" mode="Allow"/>
        <capability name="Read" mode="Allow"/>
        <capability name="AddComment" mode="Allow"/>
        <capability name="ViewUnderlyingData" mode="Allow"/>
        <capability name="ExportImage" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <user id="8eda27d9-5ad2-42cd-a39a-61bc01a423af"/>
      <capabilities>
        <capability name="ExportImage" mode="Allow"/>
        <capability name="ChangePermissions" mode="Deny"/>
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsResponse>
```

## Add Virtual Connection Permissions

Adds permissions to the specified virtual connection for a user or group. You can specify multiple sets of permissions using one call.

If a specified permission has already been granted or denied for a given user or group, the system ignores it.

#### URI

PUT /api/api-version/sites/site-id/virtualconnections/virtualconnection-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the virtual connection.</td></tr><tr><td><span class="api-placeholder">virtualconnection-id</span></td><td>The ID of the virtual connection to set permissions for.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        <!--   ...additional capabilities...   -->
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        <!--   ...additional capabilities...   -->
      </capabilities>
    </granteeCapabilities>
    <!--   ...additional granteeCapability sets...   -->
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The LUID of the user to add permissions for. A request does not need to include both a user and a group grantee.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The LUID of the group to add permissions for. A request does not need to include both a user and a group grantee.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>
                   The capability to assign. Valid capabilities for a virtual connection are
                       <span class="api-command-ref">Read</span>,
                       <span class="api-command-ref">Connect</span>,
                       <span class="api-command-ref">Overwrite</span>,
                       <span class="api-command-ref">ChangeHierarchy</span>,
					   <span class="api-command-ref">Delete</span>, and
					   <span class="api-command-ref">ChangePermissions</span>.
				  </p>
                                            <p>For more information, see
<a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to allow the capability,
                                    or <span class="api-command-ref">Deny</span> to deny it.</td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

You must be an administrator or have the ChangePermissions permission for the virtual connection (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <virtualConnection id="virtualconnection-id"
      name="virtual-connection-name">
      <owner id="user-id"/>
    </virtualConnection>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        <!--   ... additional capabilities ...   -->
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        <!--   ... additional capabilities ...   -->
      </capabilities>
    </granteeCapabilities>
    <!--   ... additional granteeCapability sets ...   -->
  </permissions>
</tsResponse>
```

#### Version

Version 3.23 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The specified capability is invalid for a virtual connection. Valid capabilities for a virtual connection are <span class="api-command-ref">Read</span>, <span class="api-command-ref">Connect</span>, <span class="api-command-ref">Overwrite</span>, <span class="api-command-ref">ChangeHierarchy</span>, <span class="api-command-ref">Delete</span>, and <span class="api-command-ref">ChangePermissions</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>The user tried to change permissions for a virtual connection but doesn't have the permission to change them.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The specified site doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user specified in the request body doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group specified in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not assigned</td><td>The capability in the URI is not assigned to the specified user or group with the specified mode (Allow or Deny).</td></tr><tr><td>404</td><td>404014</td><td>Capability not found</td><td>A capability specified in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">PUT</span>.</td></tr><tr><td>400</td><td>409004</td><td>Invalid LUID</td><td>The virtual connection LUID in the URI was not found.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl --location --request PUT 'http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/virtualconnections/12ab34cd-56ef-78ab-90cd-12ef34ab56cd/permissions' --header 'Content-Type: application/xml' --header 'X-Tableau-Auth: HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3' --data '<tsRequest> <permissions> <granteeCapabilities> <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" /> <capabilities> <capability name="read" mode="allow" /> </capabilities> </granteeCapabilities> </permissions> </tsRequest>'`

## Add Workbook Permissions

Adds permissions to the specified workbook for a user or group. You can specify multiple sets of permissions using one call.

#### URI

PUT /api/api-version/sites/site-id/workbooks/workbook-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the workbook.</td></tr><tr><td><span class="api-placeholder">workbook-id</span></td><td>The ID of the workbook to set permissions for.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <permissions>
    <workbook id="workbook-id" />
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability-name" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">workbook-id</span>
                                        </td>
                                        <td>
            The <span class="api-command-ref">&lt;workbook&gt;</span> element is not required, but can be included for compatibility with earlier versions of
            the REST API. If the <span class="api-command-ref">&lt;workbook&gt;</span> element is included, the <span class="api-placeholder">workbook-id</span>
            value must match the workbook ID in the URI. Any other attributes in the <span class="api-command-ref">&lt;workbook&gt;</span> element are ignored.
               </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID (not name) of the user to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID (not name) of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>The capability to assign. If any capability has already been granted or denied for a specified user or group, that capability is ignored.
                     Valid capabilities for a workbook are
                     <span class="api-command-ref">AddComment</span>,
                     <span class="api-command-ref">ChangeHierarchy</span>,
                     <span class="api-command-ref">ChangePermissions</span>,
					 <span class="api-command-ref">CreateRefreshMetrics</span>,
                     <span class="api-command-ref">Delete</span>,
                     <span class="api-command-ref">ExportData</span>,
                     <span class="api-command-ref">ExportImage</span>,
                     <span class="api-command-ref">ExportXml</span>, <strong>ExtractRefresh</strong>,
                     <span class="api-command-ref">Filter</span>,
                     <span class="api-command-ref">Read</span> (view),
					 <span class="api-command-ref">RunExplainData</span>,
                     <span class="api-command-ref">ShareView</span>,
                     <span class="api-command-ref">ViewComments</span>,
                     <span class="api-command-ref">ViewUnderlyingData</span>,
                     <span class="api-command-ref">WebAuthoring</span>, and
				 	 <span class="api-command-ref">Write</span>.
				</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to allow the capability,
                                    or <span class="api-command-ref">Deny</span> to deny it. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

Users who are not server administrators or site administrators can call this method only if the have permission to set permissions on the workbook (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:update
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <workbook id="workbook-id" />
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsResponse>
```

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a workbook resource. Valid capabilities for a workbook are <span class="api-command-ref">AddComment</span>, <span class="api-command-ref">ChangeHierarchy</span>, <span class="api-command-ref">ChangePermissions</span>, <span class="api-command-ref">CreateRefreshMetrics</span>, <span class="api-command-ref">Delete</span>, <span class="api-command-ref">ExportData</span>, <span class="api-command-ref">ExportImage</span>, <span class="api-command-ref">ExportXml</span>, <span class="api-command-ref">Filter</span>, <span class="api-command-ref">Read</span> (view), <span class="api-command-ref">RunExplainData</span>, <span class="api-command-ref">ShareView</span>, <span class="api-command-ref">ViewComments</span>, <span class="api-command-ref">ViewUnderlyingData</span>, <span class="api-command-ref">WebAuthoring</span>, and <span class="api-command-ref">Write</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to set permissions on the workbook.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>A user ID in the request body doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404006</td><td>Workbook not found</td><td>The workbook ID in the URI doesn't correspond to an existing workbook.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group ID in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The specified capability doesn't correspond to a defined capability. This can apply to either an invalid capability name or a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add Workbook to Server Schedule

Adds a task to refresh or accelerate a workbook to an existing schedule on Tableau Server.

The task type must match the schedule type. For a list of schedule types, see [Create a Schedule](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#create_schedule).  
_For Tableau Cloud, see [Create Cloud Extract Refresh Task](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_extract_and_encryption.htm#create_cloud_extract_refresh_task)._

**Note:** This method is not available for Tableau Cloud.

**Important changes for Tableau View Acceleration and Data Acceleration**

Tableau's View Acceleration feature and Data Acceleration APIs are retired. These features were retired in Tableau Cloud in June 2026 and in Tableau Server version 2026.2.

#### URI

PUT /api/api-version/sites/site-id/schedules/schedule-id/workbooks

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the view.</td></tr><tr><td><span class="api-placeholder">schedule-id</span></td><td>The ID of the schedule that you are associating with the workbook.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <task>
    <extractRefresh>
      <workbook id="workbook-id" />
    </extractRefresh>
  </task>
  <task>
    <dataAcceleration>
      <workbook id="workbook-id" />
    </dataAcceleration>
  </task>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">workbook-id</span></td><td>The ID of the workbook to add to the schedule.</td></tr></tbody></table>

#### Permissions

Only Tableau Server users who are server administrators or site administrators can add a workbook to a data acceleration schedule. Tableau Server users who are not server administrators or site administrators can only add a workbook to other types of schedules if they own the workbook, or are the project leader for the project that contains the workbook.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:schedules:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
  <task>
    <extractRefresh id="extractRefresh-id" type="extractRefresh-type">
      <schedule id="schedule-id" />
      <workbook id="workbook-id" />
    </extractRefresh>
  </task>
</tsResponse>
```

#### Version

Starting in Tableau Server 10.5 (API 2.8) you can add a task to refresh a workbook extract. In Tableau Server 2020.2 (API 3.8) through 2021.4 (API 3.15), you can add a task to add data acceleration to a workbook.

For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header was invalid or has expired.</td></tr><tr><td>403</td><td>403032</td><td>Update Forbidden</td><td>A non-administrator user called this method, but the caller doesn't have sufficient permissions.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI is unknown.</td></tr><tr><td>404</td><td>404006</td><td>Resource not found</td><td>The workbook ID in the request body is unknown.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">PUT</span>.</td></tr><tr><td>500</td><td>500000</td><td>Internal Server Error</td><td>The schedule ID in the URI is unknown.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/ 1edc53ac-e247-4870-9fd3-6fad0ce5f84d/schedules/9a4ebbab-9ec8-487a-9b48-47fa81d6077a/workbooks" -X PUT -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" –d @add-to-schedule.xml"`

**Content of add-to-schedule.xml:**

```
<tsRequest>
  <task>
    <extractRefresh>
      <workbook id="5de9cc53-b17d-45af-804d-49144b39f29f" />
    </extractRefresh>
  </task>
</tsRequest>
```

**Example response:**

```
<tsResponse>
  <task>
    <extractRefresh id="9bf8aea0-e3ca-422e-b7ef-d9c4ba6cca45" priority="50" consecutiveFailedCount="0" type="RefreshExtractTask">
      <schedule id="9a4ebbab-9ec8-487a-9b48-47fa81d6077a" name="Weekday early mornings" state="Active" />
      <workbook id="5de9cc53-b17d-45af-804d-49144b39f29f" />
    </extractRefresh>
  </task>
</tsResponse>
```

## Delete Ask Data Lens Permission - Retired in API 3.22

> > [!WARNING]
> > 
> > Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai).

Deletes the specified permissions to the specified ask data lens for a user or group.

#### URI

DELETE /api/api-version/sites/site-luid/lenses/lens-luid/permissions/groups/group-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/lenses/lens-luid/permissions/users/user-luid/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-luid</span>
                                        </td>
                                        <td>Required. The LUID of the site that contains the view.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">lens-luid</span>
                                        </td>
                                        <td>Required. The LUID of the lens to delete permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-luid</span>
                                        </td>
                                        <td>Optional <i>(one user or group must be specified)</i>. The LUID of the group to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-luid</span>
                                        </td>
                                        <td>Optional. The LUID of the user to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>The capability to remove the permission for.</p>
                                            <p>The valid capabilities for a view are
                                        <span class="api-command-ref">ChangePermissions</span>,
                                        <span class="api-command-ref">Delete</span>,
                                        <span class="api-command-ref">Move</span>,
                                        <span class="api-command-ref">Read</span>,
                                        <span class="api-command-ref">Write</span>.</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to
                                    remove the deny permission.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

Users with server or site administrator permissions, and non-administrators that have Delete or ChangePermissions permission (either explicitly or implicitly) for the lens, can delete ask data lens permissions.

#### Response Code

204

#### Response Body

None

#### Version

Introduced Tableau Cloud June 2022 (API 3.16). Not currently available for Tableau Server. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for an ask data lense. Valid capabilities for a lens are <b>ChangePermissions</b>, <b>Delete</b>, <b>Move</b>, <b>Read</b>, and <b>Write</b>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to delete permissions on the view.</td></tr><tr><td>403</td><td>403039</td><td>Project permissions locked</td><td>The parent project that contains the specified ask data lens has its permissions locked.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID or URL namespace in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user ID in the URI doesn’t correspond to an existing user.</td></tr><tr><td>404</td><td>404046</td><td>Lens not found</td><td>The ask data lens LUID in the URI doesn't correspond to an existing view.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group LUID in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The specified capability doesn't correspond to a defined capability. This can apply to either an invalid capability name or an invalid capability value (other than <b>Allow</b> or <b>Deny</b>).</td></tr><tr><td>404</td><td>404014</td><td>Capability not assigned</td><td>The capability in the URI is not assigned to the specified user or group with the specified mode (<b>Allow</b> or <b>Deny</b>).</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete Collection Permission

Removes the specified collection permission for the specified group or user.

#### URI

DELETE /api/api-version/sites/site-id/collections/collection-id/permissions/groups/group-id/capability-name/capability-mode

DELETE /api/api-version/sites/site-id/collections/collection-id/permissions/users/user-id/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-extra-wide">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">api-version</span>
                                </td>
                                <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">site-id</span>
                                </td>
                                <td>The ID of the site that contains the collection.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">collection-id</span>
                                </td>
                                <td>The ID of the collection to remove the permission for.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">group-id</span>
                                </td>
                                <td>The ID of the group to remove the permission for.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">user-id</span>
                                </td>
                                <td>The ID of the user to remove the permission for.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">capability-name</span>
                                </td>
                                <td>
                                    <p>The capability to remove the permission for.
                                    The only valid capability for a collection is
                                    <span class="api-command-ref">Read</span>. The only valid capability mode is Allow or Deny.</p>
                                    <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">capability-mode</span>
                                </td>
                                <td><span class="api-command-ref">Allow</span> to delete an allow permission, or <span class="api-command-ref">Deny</span> to delete a deny permission. This value is case sensitive.
                           </td>
                            </tr>
                        </tbody>
                    </table>

#### Request Body

None

#### Permissions

This method can be called by server administrators, site administrators, and collection owners.

#### Required scope for JWT authorization

_Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

Version 3.12 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a collection. The only valid capability for a collection is <span class="api-command-ref">Read</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to set permissions on the collection.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI wasn't found.</td></tr><tr><td>404</td><td>404002</td><td>Resource not found</td><td>The user ID in the URI wasn't found.</td></tr><tr><td>404</td><td>404012</td><td>Resource not found</td><td>The group ID in the URI wasn't found.</td></tr><tr><td>404</td><td>404013</td><td>Resource not found</td><td>The capability in the URI isn't recognized.</td></tr><tr><td>404</td><td>404014</td><td>Resource not found</td><td>The user or group permission wasn't found on the collection. Check the permissions on the collection that you're trying to remove and try again.</td></tr><tr><td>404</td><td>404038</td><td>Resource not found</td><td>The collection ID in the URI wasn't found.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete Data Source Permission

Removes the specified data source permission for the specified group or user.

#### URI

DELETE /api/api-version/sites/site-id/datasources/datasource-id/permissions/groups/group-id/capability-name/capability-mode

DELETE /api/api-version/sites/site-id/datasources/datasource-id/permissions/users/user-id/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the data source.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">datasource-id</span>
                                        </td>
                                        <td>The ID of the data source to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID of the group to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID of the user to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>
                                    The capability to remove the permission for.
                                    Valid capabilities for a data source are
                                    <span class="api-command-ref">ChangePermissions</span>,
                                    <span class="api-command-ref">Connect</span>,
                                    <span class="api-command-ref">Delete</span>,
                                    <span class="api-command-ref">ExportXml</span>, <span class="api-command-ref">ExtractRefresh</span>, <span class="api-command-ref">Read</span> (view),
                                    <span class="api-command-ref">Write</span>, and
									<span class="api-command-ref">SaveAs</span>.
								</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to
                                    remove the deny permission. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

Users who are not server administrators or site administrators can call this method only if they have permission to delete permissions from the data source (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a data source. Valid capabilities for a data source are <span class="api-command-ref">ChangePermissions</span>, <span class="api-command-ref">Connect</span>, <span class="api-command-ref">Delete</span>, <span class="api-command-ref">ExportXml</span>, <span class="api-command-ref">Read</span>, and <span class="api-command-ref">Write</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to set permissions on the data source.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user ID in the URI doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404004</td><td>Data source not found</td><td>The data source ID in the URI doesn't correspond to an existing data source.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the URI doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not assigned</td><td>The capability in the URI is not assigned to the specified user or group with the specified mode (Allow or Deny).</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete Default Permission

Removes default permission rules for workbook, data source, data role, lens, flow, metric, or virtual connection resources in a project for a user or group. If Tableau Catalog is enabled, also removes default permission rules for database or table resources in a project for a user or group. After removing default permission rules, new resources of the type you specify that are added to the project will no longer have those permission rules. If permissions are [locked to the project](https://help.tableau.com/current/server/en-us/permissions.htm#LockProject), then the same is true for all existing child content of the project.

#### URI

Workbooks:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/workbooks/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/workbooks/groups/group-luid/capability-name/capability-mode

Data sources:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/datasources/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/datasources/groups/group-luid/capability-name/capability-mode

Data roles:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/dataroles/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/dataroles/groups/group-luid/capability-name/capability-mode

Lenses:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/lenses/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/lenses/groups/group-luid/capability-name/capability-mode

Metrics:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/metrics/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/metrics/groups/group-luid/capability-name/capability-mode

Flows:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/flows/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/flows/groups/group-luid/capability-name/capability-mode

Virtual Connections _(endpoints introduced in [API version](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm#rest_and_tableau_version_table) 3.23)_:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/virtualconnections/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/virtualconnections/groups/group-luid/capability-name/capability-mode

Databases:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/databases/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/databases/groups/group-luid/capability-name/capability-mode

Tables:

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/tables/users/user-luid/capability-name/capability-mode

DELETE /api/api-version/sites/site-luid/projects/project-luid/default-permissions/tables/groups/group-luid/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The LUID of the site that contains the project.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">project-id</span>
                                        </td>
                                        <td>The LUID of the project to remove the default permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The LUID of the group to remove the default permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The LUID of the user to remove default permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>The capability to remove the permissions for.</p>
                                            <p>Valid capabilities for a workbook are
					</p><ul><li><span class="api-command-ref">AddComment</span></li><li><span class="api-command-ref">ChangeHierarchy</span></li><li><span class="api-command-ref">ChangePermissions</span></li><li><span class="api-command-ref">Delete</span></li><li><span class="api-command-ref">ExportData</span></li><li><span class="api-command-ref">ExportImage</span></li><li><span class="api-command-ref">ExportXml</span></li><li><span class="api-command-ref">Filter</span></li><li><span class="api-command-ref">Read</span> (view)</li><li><span class="api-command-ref">ShareView</span></li><li><span class="api-command-ref">ViewComments</span></li><li><span class="api-command-ref">ViewUnderlyingData</span></li><li><span class="api-command-ref">WebAuthoring</span></li><li><span class="api-command-ref">Write</span></li><li><span class="api-command-ref">RunExplainData</span></li><li><span class="api-command-ref">CreateRefreshMetrics</span></li></ul><p></p>
                                            <p>Valid capabilities for a data source are
					</p><ul><li><span class="api-command-ref">ChangePermissions</span></li><li><span class="api-command-ref">Connect</span></li><li><span class="api-command-ref">Delete</span></li><li><span class="api-command-ref">ExportXml</span></li><li><span class="api-command-ref">SaveAs</span></li><li><span class="api-command-ref">Read</span> (view)</li><li><span class="api-command-ref">Write</span></li></ul><p></p>
                                            <p>Valid capabilities for a flow are
					</p><ul><li><span class="api-command-ref">ChangeHierarchy</span></li><li><span class="api-command-ref">ChangePermissions</span></li><li><span class="api-command-ref">Delete</span></li><li><span class="api-command-ref">ExportXml</span> (download)</li><li><span class="api-command-ref">Execute</span></li><li><span class="api-command-ref">Read</span> (view)</li><li><span class="api-command-ref">WebAuthoringForFlows</span></li><li><span class="api-command-ref">Write</span></li></ul><p></p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to                                             remove the deny permission. This value is case sensitive.</td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

Users who are not server administrators can remove permissions for a project only if they have ProjectLeader permissions for that project (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

- Version 2.1 and later.
- Version 3.23 and later for the virtual connection default permissions methods.
- For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permissions to remove permissions for the project.</td></tr><tr><td>403</td><td>403095</td><td>Delete permissions for flows forbidden</td><td>A non-administrator user called this method but doesn't have permissions to remove permissions for the project where the flow is located.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site LUID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>A user LUID in the URI doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404005</td><td>Project not found</td><td>The project LUID in the URI doesn't correspond to an existing project.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group LUID in the URI doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not assigned</td><td>The capability in the URI isn't assigned to the specified user or group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The capability in the URI doesn't correspond to a defined capability. This can apply to either an invalid capability name or a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr><tr><td>404</td><td>404027</td><td>Flow not found</td><td>The flow LUID in the URI doesn't correspond to an existing flow.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete Project Permission

Removes the specified project permission for the specified group or user.

#### URI

DELETE /api/api-version/sites/site-id/projects/project-id/permissions/groups/group-id/capability-name/capability-mode

DELETE /api/api-version/sites/site-id/projects/project-id/permissions/users/user-id/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the project.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">project-id</span>
                                        </td>
                                        <td>The ID of the project to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID of the group to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID of the user to remove project the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                    The capability to remove the permission for. In Tableau Server 10.0, valid capabilities for a project are
                                        <span class="api-command-ref">ProjectLeader</span>,
                                        <span class="api-command-ref">Read</span> (view), and
                                        <span class="api-command-ref">Write</span>.
                                        <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to
                                    remove the deny permission. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

Tableau Server users who are not server administrators or site administrators can remove permissions for a project only if they have ChangePermissions (version `2.0`) or ProjectLeader (version `2.1`) permissions for that project (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a project. For a list of valid capabilities, see the <span class="api-placeholder">capability-name</span> attribute earlier.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permissions to remove default permissions for the project.</td></tr><tr><td>403</td><td>403004</td><td>Delete forbidden</td><td>A non-administrative user tried to update the project, but does not have permissions to the project.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>A user ID in the URI doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404005</td><td>Project not found</td><td>The project ID in the URI doesn't correspond to an existing project.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group ID in the URI doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not assigned</td><td>The capability in the URI isn't assigned to the specified user or group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The capability in the URI doesn't correspond to a defined capability. This can apply to either an invalid capability name or a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete View Permission

Deletes permission to the specified view (also known as a sheet) for a Tableau Server user or group.

#### URI

DELETE /api/api-version/sites/site-id/views/view-id/permissions/groups/group-id/capability-name/capability-mode

DELETE /api/api-version/sites/site-id/views/view-id/permissions/users/user-id/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the view.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">view-id</span>
                                        </td>
                                        <td>The ID of the view to delete permissions for. You can obtain this ID by calling <a href="#query_views_for_site">Query Views for Site</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID of the group to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID of the user to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>The capability to remove the permission for.</p>
                                            <p>The valid capabilities for a view are
                                        <span class="api-command-ref">AddComment</span>,
                                        <span class="api-command-ref">ChangePermissions</span>,
                                        <span class="api-command-ref">Delete</span>,
                                        <span class="api-command-ref">ExportData</span>,
                                        <span class="api-command-ref">ExportImage</span>,
                                        <span class="api-command-ref">ExportXml</span>,
                                        <span class="api-command-ref">Filter</span>,
                                        <span class="api-command-ref">Read</span> (view),
                                        <span class="api-command-ref">ShareView</span>,
                                        <span class="api-command-ref">ViewComments</span>,
                                        <span class="api-command-ref">ViewUnderlyingData</span>,
                                        <span class="api-command-ref">WebAuthoring</span>, and
                                        <span class="api-command-ref">Write</span>.</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to
                                    remove the deny permission.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

Users who are not server administrators or site administrators can delete permissions from a view only if they have ChangePermissions permissions on the view (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

Version 3.2 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a view.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to delete permissions on the view.</td></tr><tr><td>403</td><td>403039</td><td>Project permissions locked</td><td>The parent project that contains the specified view has its permissions locked.</td></tr><tr><td>403</td><td>403096</td><td>Parent workbook tabs enabled</td><td>The specified view currently has permissions inherited from its parent workbook. View permission can be deleted if the parent workbook has its tabs disabled.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID or URL namespace in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user ID in the URI doesn’t correspond to an existing user.</td></tr><tr><td>404</td><td>404011</td><td>View not found</td><td>The view ID in the URI doesn't correspond to an existing view.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group ID in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The specified capability doesn't correspond to a defined capability. This can apply to either an invalid capability name or an invalid capability value (other than <b>Allow</b> or <b>Deny</b>).</td></tr><tr><td>404</td><td>404014</td><td>Capability not assigned</td><td>The capability in the URI is not assigned to the specified user or group with the specified mode (<b>Allow</b> or <b>Deny</b>).</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/fbfa6f03-982c-4930-8ec1-d5949a19125d/views/0524c7ce-250b-45b1-adf2-d08f1648643c/permissions/users/ff43cb47-f208-4d2f-9a22-0fbb6d29f7f1/AddComment/Allow" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

## Delete Virtual Connection Permission

Removes the specified virtual connection permission for the specified group or user.

#### URI

DELETE /api/api-version/sites/site-id/virtualconnections/virtualconnection-id/permissions/groups/group-id/capability-name/capability-mode

DELETE /api/api-version/sites/site-id/virtualconnections/virtualconnection-id/permissions/users/user-id/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the virtual connection.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">virtualconnection-id</span>
                                        </td>
                                        <td>The ID of the virtual connection to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The LUID of the group to remove the permission for. A request does not need to include both a user and a group grantee.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The LUID of the user to remove the permission for. A request does not need to include both a user and a group grantee.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>
                                    The capability to remove the permission for.
                                    Valid capabilities for a virtual connection are
                       <span class="api-command-ref">Read</span>,
                       <span class="api-command-ref">Connect</span>,
                       <span class="api-command-ref">Overwrite</span>,
                       <span class="api-command-ref">ChangeHierarchy</span>,
					   <span class="api-command-ref">Delete</span>, and
					   <span class="api-command-ref">ChangePermissions</span>.
					</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to
                                    remove the deny permission.</td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

You must be an administrator or have the Delete permission for the virtual connection (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

Version 3.23 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The specified capability is invalid for a virtual connection. Valid capabilities for a virtual connection are <span class="api-command-ref">Read</span>, <span class="api-command-ref">Connect</span>, <span class="api-command-ref">Overwrite</span>, <span class="api-command-ref">ChangeHierarchy</span>, <span class="api-command-ref">Delete</span>, and <span class="api-command-ref">ChangePermissions</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>The user tried to change permissions for a virtual connection but doesn't have the permission to change them.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The specified site doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user specified in the request body doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the URI doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not assigned</td><td>The capability in the URI is not assigned to the specified user or group with the specified mode (Allow or Deny).</td></tr><tr><td>404</td><td>404014</td><td>Capability not found</td><td>A capability specified in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr><tr><td>400</td><td>409004</td><td>Invalid LUID</td><td>The virtual connection LUID in the URI was not found.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl --location --request DELETE 'http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/virtualconnections/12ab34cd-56ef-78ab-90cd-12ef34ab56cd/permissions/users/9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d/read/allow' --header 'Content-Type: application/xml' --header 'X-Tableau-Auth: HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3'`

## Delete Workbook Permission

Deletes the specified permission from the specified workbook for a group or user.

#### URI

DELETE /api/api-version/sites/site-id/workbooks/workbook-id/permissions/groups/group-id/capability-name/capability-mode

DELETE /api/api-version/sites/site-id/workbooks/workbook-id/permissions/users/user-id/capability-name/capability-mode

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the workbook.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">workbook-id</span>
                                        </td>
                                        <td>The ID of the workbook to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID of the group to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID of the user to remove the permission for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>
                The capability to remove the permission for.
                Valid capabilities for a workbook are
                    <span class="api-command-ref">AddComment</span>,
                    <span class="api-command-ref">ChangeHierarchy</span>,
                    <span class="api-command-ref">ChangePermissions</span>,
                    <span class="api-command-ref">Delete</span>,
                    <span class="api-command-ref">ExportData</span>,
                    <span class="api-command-ref">ExportImage</span>,
                    <span class="api-command-ref">ExportXml</span>,
<span class="api-command-ref">ExtractRefresh</span>, <span class="api-command-ref">Filter</span>,
                    <span class="api-command-ref">Read</span> (view),
                    <span class="api-command-ref">ShareView</span>,
                    <span class="api-command-ref">ViewComments</span>,
                    <span class="api-command-ref">ViewUnderlyingData</span>,
					<span class="api-command-ref">WebAuthoring</span>,
					<span class="api-command-ref">Write</span>,
					<span class="api-command-ref">RunExplainData</span>, and
					<span class="api-command-ref">CreateRefreshMetrics</span>.
				</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-mode</span>
                                        </td>
                                        <td><span class="api-command-ref">Allow</span> to remove the allow permission, or <span class="api-command-ref">Deny</span> to
                                    remove the deny permission. This value is case sensitive.
                                </td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

Users who are not server administrators or site administrators can delete permissions from a workbook only if they have ChangePermissions permission for workbook (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:delete
```

#### Response Code

204

#### Response Body

None

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a workbook resource. Valid capabilities for a workbook are <span class="api-command-ref">AddComment</span>, <span class="api-command-ref">ChangeHierarchy</span>, <span class="api-command-ref">ChangePermissions</span>, <span class="api-command-ref">Delete</span>, <span class="api-command-ref">ExportData</span>, <span class="api-command-ref">ExportImage</span>, <span class="api-command-ref">ExportXml</span>, <span class="api-command-ref">Filter</span>, <span class="api-command-ref">Read</span>, <span class="api-command-ref">Share_view</span>, <span class="api-command-ref">ViewComments</span>, <span class="api-command-ref">ViewUnderlyingData</span>, <span class="api-command-ref">WebAuthoring</span>, and <span class="api-command-ref">Write</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to delete permissions from the workbook.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user ID in the URI doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404006</td><td>Workbook not found</td><td>The workbook ID in the URI doesn't correspond to an existing workbook.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the URI doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The capability in the URI doesn't correspond to a defined capability. This can apply to either an invalid capability name or a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> at the end of the URI.</td></tr><tr><td>404</td><td>404013</td><td>Capability not assigned</td><td>The capability in the URI is not assigned to the specified user or group with the specified mode (Allow or Deny).</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## List Ask Data Lens Permissions

> > [!WARNING]
> > 
> > Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai).

List all permissions configured for the specified ask data lens that the user has read capability for.

#### URI

GET /api/api-version/sites/site-luid/lens/lens-Luid/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID of the site that contains the metrics.</td></tr><tr><td><span class="api-placeholder">lens-luid</span></td><td>The LUID of the ask data lens whose permissions are being listed.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Users with server or site administrator permissions, and non-administrators that have **Read** permission (either explicitly or implicitly), can list permissions for an ask data lens.

lu

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
	<parent type="Project" id="project-luid" />
    <lens id="lens-luid"  name ="lens-name/>
    <granteeCapabilities>
      <user id="user-luid" />
      <capabilities>
        <capability name="capability" mtode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        <--    ... additional capabilities ...    -->
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-luid" />
      <capabilities>
        <capability name="capability" mode="Allow-or-Deny" />
        <capability name="capability" mode="Allow-or-Deny" />
        <--    ... additional capabilities ...    -->
      </capabilities>
    </granteeCapabilities>
    <--    ... additional grantee capability sets ...    -->
  </permissions>
</tsResponse>
```

**Note:** The parent element is included in the response only if the lens' permissions are determined by project-level default permissions and project permissions are locked. Project permissions can be locked for a new project when you call Create Project or for an existing project by calling Update Project. For more information, see Lock Content Permissions to the Project.

#### Version

Introduced Tableau Cloud June 2022 (API 3.16). Not currently available for Tableau Server. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"><col class="api-error-table-col-2"><col class="api-error-table-col-3"><col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>403</td><td>403018</td><td>Read forbidden</td><td>A non-administrator user attempted to query metrics for the site, but the caller doesn't have <span class="api-command-ref">Read</span> permission.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404046</td><td>Lens not found</td><td>A lens with the requested LUID could be found.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## List Collection Permissions

Returns a list of permissions for a specific collection.

#### URI

GET /api/api-version/sites/site-id/collections/collection-luid/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the collection.</td></tr><tr><td><span class="api-placeholder">collection-id</span></td><td>The ID of the collection to get permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can be called by server administrators, site administrators, and collection owners.

#### Required scope for JWT authorization

_Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <collection id="12ab34cd-56ef-78ab-90cd-12ef34ab56cd" name="Bob's Collection">
      <owner id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"/>
    </collection>
    <granteeCapabilities>
      <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d"/>
      <capabilities>
        <capability name="Read" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <user id="08a7b6b5-b4ba-be3a-4d2d-1e9e59a8a7b6"/>
      <capabilities>
        <capability name="Read" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>

  </permissions>
</tsResponse>
```

#### Version

Version 3.12 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404038</td><td>Resource not found</td><td>The collection ID in the URI wasn't found.</td></tr><tr><td>404</td><td>404000</td><td>Resource not found</td><td>The site ID in the URI wasn't found.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## List Data Source Permissions

Returns a list of permissions for a specific data source.

#### URI

GET /api/api-version/sites/site-id/datasources/datasource-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the data source.</td></tr><tr><td><span class="api-placeholder">datasource-id</span></td><td>The ID of the data source to get permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Users who are not server administrators or site administrators can view a data source only if they have Read (view) permission for the data source (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
   <parent type="Project" id="project-id"
   <datasource id="datasource-id"
     owner="owner-user-id" />
   <granteeCapabilities>
     <user id="user-id" />
     <capabilities>
       <capability name="capability-name" mode="capability-mode" />
       ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability" mode="capability-mode" />
        ... additional capabilities ...
       </capabilities>
     </granteeCapabilities>
     ... additional grantee capability sets ...
  </permissions>
</tsResponse>
```

**Note**: The parent element is included in the response only if the workbook's permissions are determined by project-level default permissions and project permissions are locked. Project permissions can be locked for a new project when you call [Create Project](#create_project) or for an existing project by calling [Update Project](#update_project). For more information, see [Lock Content Permissions to the Project](https://help.tableau.com/current/server/en-us/help.htm#permissions_project_lock.htm).

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404004</td><td>Data source not found</td><td>The data source ID in the URI doesn't correspond to an existing data source.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/datasources/1a2a3b4b-5c6c-7d8d-9e0e-1f2f3a4a5b6b/permissions" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <parent type="Project" id="1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e" />
  <permissions>
    <datasource id="1a2a3b4b-5c6c-7d8d-9e0e-1f2f3a4a5b6b" name="USPS-rates">
      <owner id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"/>
    </datasource>
    <granteeCapabilities>
      <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" />
      <capabilities>
        <capability name="Connect" mode="Allow"/>
        <capability name="Read" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsResponse>
```

## List Default Permissions

Returns details of default permission rules granted to users and groups for workbook, data source, data role, lens, flow, metric, or virtual connection resources in a project for a user or group. If Tableau Catalog is enabled, this method can also return details of default permission rules granted to users and groups for database or table resources in a project.

#### URI

Workbooks:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/workbooks

Data sources:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/datasources

Data roles:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/dataroles

Lenses:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/lenses

Metrics:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/metrics

Flows:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/flows

Virtual Connections _(endpoint introduced in [API version](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm#rest_and_tableau_version_table) 3.23)_:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/virtualconnections

Databases:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/databases

Tables:

GET /api/api-version/sites/site-luid/projects/project-luid/default-permissions/tables

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID of the site that contains the project.</td></tr><tr><td><span class="api-placeholder">project-luid</span></td><td>The LUID of the project to get default permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Users who are not server administrators can query default permissions for a project only if they have the ProjectLeader permission for that project (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

**Note:** The following scope applies to data sources, workbooks, and metrics only.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
	<project id="project-luid" name="project-name" />
	<granteeCapabilities>
      <user id="user-luid" />
	  <capabilities>
	    <capability name="capability" mode="capability-mode" />
	    <capability name="capability" mode="capability-mode" />
	    <... additional capabilities ...>
	  </capabilities>
	</granteeCapabilities>
	<... additional grantee capabilities ...>
  </permissions>
</tsResponse>
```

#### Version

- Version 2.1 and later.
- Version 3.23 and later for the virtual connection default permissions methods.
- For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>403</td><td>403035</td><td>Querying data source permissions forbidden</td><td>The caller doesn't have permissions to query the project's default permissions for data sources.</td></tr><tr><td>403</td><td>403036</td><td>Querying workbook permissions forbidden</td><td>The caller doesn't have permissions to query the project's default permissions for workbooks.</td></tr><tr><td>403</td><td>403035</td><td>Querying flow permissions forbidden</td><td>The caller doesn't have permissions to query the project's default permissions for flows.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site LUID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404005</td><td>Project not found</td><td>The project LUID in the URI doesn't correspond to an existing project.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## List Project Permissions

Returns information about the set of permissions allowed or denied for groups and users in a project.

#### URI

GET /api/api-version/sites/site-id/projects/project-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the project.</td></tr><tr><td><span class="api-placeholder">project-id</span></td><td>The project to get permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <permissions>
    <project id="project-id" name="project-name" />
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability" mode="capability-mode" />
        <capability name="capability" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability" mode="capability-mode" />
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capabilities ...
  </permissions>
</tsResponse>
```

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404005</td><td>Project not found</td><td>The project ID in the URI doesn't correspond to an existing project.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/projects/1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e/permissions" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <permissions>
    <project id="1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e" name="default">
      <owner id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"/>
    </project>
    <granteeCapabilities>
      <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d"/>
      <capabilities>
        <capability name="Read" mode="Allow"/>
        <capability name="Write" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsResponse>
```

## List View Permissions

Returns a list of permissions for the specific view.

#### URI

GET /api/api-version/sites/site-id/views/view-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the view.</td></tr><tr><td><span class="api-placeholder">view-id</span></td><td>The ID of the view to get permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can only be called by server and site administrators, and users who have Read (view) permission for the specific view.

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <parent type="Project" id="project-id" />
  <permissions>
    <view id="view-id"/>
      <owner id="owner-id"/>
    </view>
    <granteeCapabilities>
      <user id="user-id"/>
      <capabilities>
        <capability name="capability-name" mode="capability-mode"/>
        <capability name="capability-name" mode="capability-mode"/>
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <user id="user-id"/>
      <capabilities>
        <capability name="capability-name" mode="capability-mode"/>
        <capability name="capability-name" mode="capability-mode"/>
        ... additional capabilities ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id"/>
      <capabilities>
        <capability name="capability-name" mode="capability-mode"/>
        ... additional capabilities ...
      </capabilities>
      </granteeCapabilities>
  </permissions>
</tsResponse>
```

**Note**: The parent element is included in the response only if the view's permissions are determined by project-level default permissions and project permissions are locked. Project permissions can be locked for a new project when you call [Create Project](#create_project) or for an existing project by calling [Update Project](#update_project). For more information, see [Lock Content Permissions to the Project](https://help.tableau.com/current/server/en-us/help.htm#permissions_project_lock.htm).

#### Version

Version 3.2 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to set permissions on the view.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID or URL namespace in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404011</td><td>View not found</td><td>The view ID in the URI doesn't correspond to an existing view.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/views/0524c7ce-250b-45b1-adf2-d08f1648643c/permissions" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse>
  <permissions>
    <view id="0524c7ce-250b-45b1-adf2-d08f1648643c"/>
      <owner id="1a5dffe8-2439-4862-9eb0-46d055ef7379"/>
    </view>
    <granteeCapabilities>
      <group id="9e617a5c-a733-11e8-8ec3-b748ab3bf3d6"/>
      <capabilities>
        <capability name="ViewComments" mode=mode="Allow"/>
        <capability name="ExportData" mode=mode="Allow"/>
        <capability name="AddComment" mode=mode="Allow"/>
        <capability name="Filter" mode=mode="Allow"/>
        <capability name="ViewUnderlyingData" mode=mode="Allow"/>
        <capability name="Read" mode=mode="Allow"/>
        <capability name="ShareView" mode=mode="Allow"/>
        <capability name="ExportImage" mode=mode="Allow"/>
      </capabilities>
      </granteeCapabilities>
    <granteeCapabilities>
      <user id="1a5dffe8-2439-4862-9eb0-46d055ef7379"/>
      <capabilities>
        <capability name="ExportImage" mode=mode="Allow"/>
        <capability name="AddComment" mode=mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <user id="ff43cb47-f208-4d2f-9a22-0fbb6d29f7f1"/>
      <capabilities>
        <capability name="AddComment" mode=mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsResponse>
```

## List Virtual Connection Permissions

Returns a list of permissions for a specific virtual connection.

#### URI

GET /api/api-version/sites/site-id/virtualconnections/virtualconnection-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the virtual connection.</td></tr><tr><td><span class="api-placeholder">virtualconnection-id</span></td><td>The ID of the virtual connection to get permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

You must be an administrator or have the Read (View) permission for the virtual connection (either explicitly or implicitly).

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
    <permissions>
        <parent id="project-id"
            type="Project"/>
        <virtualConnection id="virtualconnection-id"
            name="virtualconnection-name">
            <owner id="owner-id"/>
        </virtualConnection>
        <granteeCapabilities>
            <group id="group-id"/>
            <capabilities>
                <capability name="capability-name"
                    mode="capability-mode"/>
                <!--   ...additional capabilities...   -->
            </capabilities>
        </granteeCapabilities>
        <granteeCapabilities>
            <user id="user-id"/>
            <capabilities>
                <capability name="capability-name"
                    mode="capability-mode"/>
                <!--   ...additional capabilities...   -->
            </capabilities>
        </granteeCapabilities>
        <!--   ...additional granteeCapability sets...   -->
    </permissions>
</tsResponse>
```

**Note**: The parent element is included in the response only if the workbook's permissions are determined by project-level default permissions and project permissions are locked. Project permissions can be locked for a new project when you call [Create Project](#create_project) or for an existing project by calling [Update Project](#update_project). For more information, see [Lock Content Permissions to the Project](https://help.tableau.com/current/server/en-us/help.htm#permissions_project_lock.htm).

#### Version

Version 3.23 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404004</td><td>Virtual Connection not found</td><td>The virtual connection ID in the URI doesn't correspond to an existing virtual connection.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl --location 'http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/virtualconnections/12ab34cd-56ef-78ab-90cd-12ef34ab56cd/permissions' --header 'Content-Type: application/xml' --header 'X-Tableau-Auth: HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3'`

## List Workbook Permissions

Returns a list of permissions for the specific workbook.

#### URI

GET /api/api-version/sites/site-id/workbooks/workbook-id/permissions

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the workbook.</td></tr><tr><td><span class="api-placeholder">workbook-id</span></td><td>The ID of the workbook to get permissions for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

_Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17)._

Authorize use of this method by including this scope in the JSON Web Token (JWT). For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud), or [Access Scopes for Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm) in the Tableau Cloud Help or [Access Scopes for Connected Apps](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm) in the Tableau Server Help.

```
tableau:permissions:read
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <parent type="Project" id="project-id" />
  <permissions>
    <workbook id="workbook-id" name="workbook-name >
      <owner="owner-user-id" />
    </workbook>
    <granteeCapabilities>
      <user id="user-id" />
      <capabilities>
        <capability name="capability" mode="capability-mode" />
         ... additional capabilities for users ...
      </capabilities>
    </granteeCapabilities>
    <granteeCapabilities>
      <group id="group-id" />
      <capabilities>
        <capability name="capability" mode="capability-mode" />
         ... additional capabilities for groups ...
      </capabilities>
    </granteeCapabilities>
    ... additional grantee capability sets ...
  </permissions>
</tsResponse>
```

**Note**: The parent element is included in the response only if the workbook's permissions are determined by project-level default permissions and project permissions are locked. Project permissions can be locked for a new project when you call [Create Project](#create_project) or for an existing project by calling [Update Project](#update_project). For more information, see [Lock Content Permissions to the Project](https://help.tableau.com/current/server/en-us/help.htm#permissions_project_lock.htm).

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404006</td><td>Workbook not found</td><td>The workbook ID in the URI doesn't correspond to an existing workbook.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/workbooks/1a1b1c1d-2e2f-2a2b-3c3d-3e3f4a4b4c4d/permissions" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <parent type="Project" id="1f2f3e4e-5d6d-7c8c-9b0b-1a2a3f4f5e6e" />
  <permissions>
    <workbook id="1a1b1c1d-2e2f-2a2b-3c3d-3e3f4a4b4c4d" name="Finance">
      <owner id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"/>
    </workbook>
    <granteeCapabilities>
      <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d"/>
      <capabilities>
        <capability name="Read" mode="Allow"/>
        <capability name="Filter" mode="Allow"/>
        <capability name="ViewUnderlyingData" mode="Allow"/>
        <capability name="ExportImage" mode="Allow"/>
        <capability name="ExportData" mode="Allow"/>
        <capability name="AddComment" mode="Allow"/>
        <capability name="ViewComments" mode="Allow"/>
        <capability name="ShareView" mode="Allow"/>
      </capabilities>
    </granteeCapabilities>
  </permissions>
</tsResponse>
```

## Replace Project's Default Permissions

Replaces default permissions in the specified content. If Tableau Catalog is enabled, it also adds default permission rules for database or table resources in a project. After adding default permission rules, new resources of the type you specify that are added to the project will have those permission rules. If permissions are [locked to the project](https://help.tableau.com/current/server/en-us/permissions.htm#LockProject), then the same is true for all existing child content of the project. For more information, see [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm).

**Version:** Available in API 3.23 (Tableau Cloud June 2024 / Tableau Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** Users who are not server administrators, project owners, or project leaders can replace permissions defaults for a project only if they have effective **ChangePermissions** permission.   _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:permissions:update

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

POST /api/api-version/sites/site-luid/projects/project-luid/default-permissions/dataroles

POST /api/api-version/sites/site-luid/projects/project-luid/default-permissions/databases

POST /api/api-version/sites/site-luid/projects/project-luid/default-permissions/datasources

POST /api/api-version/sites/site-luid/projects/project-luid/default-permissions/flows

POST /api/api-version/sites/site-luid/projects/project-luid/default-permissions/tables

POST /api/api-version/sites/site-luid/projects/project-luid/default-permissions/workbooks

#### URI Parameter Values

<table class="api-parameters-table">
                            <colgroup>
                                <col class="api-parameters-table-col-1-wide">
                                <col>
                            </colgroup>
                            <tbody>
                                <tr>
                                    <td><span class="api-placeholder">api-version</span>
                                    </td>
                                    <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.
						</td>
                                </tr>
                                <tr>
                                    <td><span class="api-placeholder">site-luid</span>
                                    </td>
                                    <td>
                                        <p>The LUID for the site.</p>
                                    </td>
                                </tr>
                                <tr>
                                    <td><span class="api-placeholder">project-luid</span>
                                    </td>
                                    <td>
                                        <p>The LUID for the project.</p>
                                    </td>
                                </tr>
                            </tbody>
                        </table>

#### Request Body

Copy

```
<tsRequest>  <permissions>    <granteeCapabilities>      <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" />      <capabilities>        <capability name="AddComment" mode="Allow" />        <!-- ... additional capabilities ... -->      </capabilities>    </granteeCapabilities>    <granteeCapabilities>      <group id="2aa47cfa-9f2b-11e8-a260-af4a26124661" />      <capabilities>        <capability name="ViewComments" mode="Allow" />        <!-- ...  additional capabilities ... -->      </capabilities>    </granteeCapabilities>    <!-- ... additional grantee capability sets ...  -->  </permissions></tsRequest>
```

Copy

```
{  "permissions": [    {      "user": {        "id": "user-luid"      },      "capabilities": [        {          "name": "capability-name",          "mode": "capability-mode"        }      ]    },    {      "group": {        "id": "group-luid"      },      "capabilities": [        {          "name": "capability-name",          "mode": "capability-mode"        }      ]    }  ]}
```

#### Request Attributes

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-luid</span>
                                        </td>
                                        <td>The LUID of the user to add default permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-luid</span>
                                        </td>
                                        <td>The LUID of the group to add permissions for.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">capability-name</span>
                                        </td>
                                        <td>
                                            <p>The capability to assign. Valid capabilities for a workbook are
					<span class="api-command-ref">AddComment</span>,
					<span class="api-command-ref">ChangeHierarchy</span>,
					<span class="api-command-ref">ChangePermissions</span>,
						<span class="api-command-ref">Delete</span>,
					<span class="api-command-ref">ExportData</span>,
					<span class="api-command-ref">ExportImage</span>,
					<span class="api-command-ref">ExportXml</span>,
					<span class="api-command-ref">Filter</span>,
					<span class="api-command-ref">Read</span> (view),
					<span class="api-command-ref">RunExplainData</span>,
					<span class="api-command-ref">ShareView</span>,
					<span class="api-command-ref">ViewComments</span>,
					<span class="api-command-ref">ViewUnderlyingData</span>,
					<span class="api-command-ref">WebAuthoring</span>, and
					<span class="api-command-ref">Write</span>.

				</p>
                                            <p>Valid capabilities for a data source are
					<span class="api-command-ref">ChangePermissions</span>,
					<span class="api-command-ref">Connect</span>,
					<span class="api-command-ref">Delete</span>,
					<span class="api-command-ref">ExportXml</span>,
					<span class="api-command-ref">SaveAs</span>,
					<span class="api-command-ref">Read</span> (view), and
					<span class="api-command-ref">Write</span>.</p>
                                            <p>For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm" class="xref">Permissions</a>.</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### cURL Request Example

`curl --location "http://MY-SERVER/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/projects/1a1b1c1d-2e2f-2a2b-3c3d-3e3f4a4b4c4d/default-permissions/dataroles" --header "Content-Type: application/xml" --data @replace-default-permissions-workbook.xml`

#### Response Code

200

#### Response Body

None

#### Errors

<table class="api-error-table">
                        <colgroup>
                            <col class="api-error-table-col-1">
                            <col class="api-error-table-col-2">
                            <col class="api-error-table-col-3">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <th>HTTP status</th>
                                <th><code>error</code> Code</th>
                                <th>Condition</th>
                                <th>Details</th>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400000</td>
                                <td>Bad request</td>
                                <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400009</td>
                                <td>Invalid capability</td>
                                <td>                                         The capability in the URI is invalid for a data source.                                       <p>Valid capabilities for a workbook are                                     <span class="api-command-ref">AddComment</span>,                                     <span class="api-command-ref">ChangeHierarchy</span>,                                     <span class="api-command-ref">ChangePermissions</span>,                                    <span class="api-command-ref">Delete</span>,                                     <span class="api-command-ref">ExportData</span>,                                     <span class="api-command-ref">ExportImage</span>,                                     <span class="api-command-ref">ExportXml</span>,                                     <span class="api-command-ref">Filter</span>,                                     <span class="api-command-ref">Read</span> (view),        <span class="api-command-ref">RunExplainData</span>,                             <span class="api-command-ref">ShareView</span>,                                     <span class="api-command-ref">ViewComments</span>,                                     <span class="api-command-ref">ViewUnderlyingData</span>,                                     <span class="api-command-ref">WebAuthoring</span>, and                                     <span class="api-command-ref">Write</span>.</p><p>Valid capabilities for a data source are                                     <span class="api-command-ref">ChangePermissions</span>,                                     <span class="api-command-ref">Connect</span>,                                     <span class="api-command-ref">Delete</span>,                                     <span class="api-command-ref">ExportXml</span>,                                     <span class="api-command-ref">Read</span> (view), and                                     <span class="api-command-ref">Write</span>.</p><p>For detailed information about capabilities for each content type, see <a href="https://help.tableau.com/current/online/en-us/permissions_capabilities.htm#capabilities">Capabilities</a>.</p></td>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400042</td>
                                <td>Malformed permissions qualifier</td>
                                <td>The request body includes a <span class="api-command-ref">&lt;workbook&gt;</span> or <span class="api-command-ref">&lt;datasource&gt;</span> element.</td>
                            </tr>
                            <tr>
                                <td>403</td>
                                <td>403004</td>
                                <td>Permissions setting forbidden</td>
                                <td>A non-administrator user called this method but doesn't have permission to add permissions on the project.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404000</td>
                                <td>Site not found</td>
                                <td>The site LUID in the URI doesn't correspond to an existing site.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404002</td>
                                <td>User not found</td>
                                <td>A user LUID in the request body as the grantee doesn't correspond to an existing user.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404005</td>
                                <td>Project not found</td>
                                <td>The project LUID in the URI doesn't correspond to an existing project.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404009</td>
                                <td>Project ID mismatch</td>
                                <td>A project LUID specified in the URI doesn’t match the project ID specified in the request body. (You don’t have to specify a project ID in the request body.)</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404012</td>
                                <td>Group not found</td>
                                <td>A group LUID in the request body doesn't correspond to an existing group.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404013</td>
                                <td>Capability not found</td>
                                <td>The capability in the request body doesn't correspond to a defined capability. This can apply to either an invalid capability name or to a capability other than                                         <span sclass="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td>
                            </tr>
                            <tr>
                                <td>405</td>
                                <td>405000</td>
                                <td>Invalid request method</td>
                                <td>The request type wasn’t <b>POST</b>.</td>
                            </tr>
                        </tbody>
                    </table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Replace Content Permissions

Replaces existing permissions in the specified content. You can specify multiple sets of permissions using one call.

**Version:** Available in API 3.23 (Tableau Cloud June 2024 / Tableau Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required

**Permissions:** Users who are not server administrators or site administrators can add permissions only to content for which they have **ChangePermissions** permission.   _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:permissions:update

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

POST /api/api-version/sites/site-luid/datasources/datasource-luid/permissions

POST /api/api-version/sites/site-luid/flows/flow-luid/permissions

POST /api/api-version/sites/site-luid/projects/project-luid/permissions

POST /api/api-version/sites/site-luid/views/view-luid/permissions

POST /api/api-version/sites/site-luid/workbooks/workbook-luid/permissions

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">datasourc-luid</span></td><td>The LUID for the data source.</td></tr><tr><td><span class="api-placeholder">flow-luid</span></td><td>The LUID for the flow.</td></tr><tr><td><span class="api-placeholder">project-luid</span></td><td>The LUID for the project.</td></tr><tr><td><span class="api-placeholder">view-luid</span></td><td>The LUID for the view.</td></tr><tr><td><span class="api-placeholder">workbook-luid</span></td><td>The LUID for the workbook.<br>(Optional, but can be included for compatibility with older versions.)</td></tr></tbody></table>

#### Request Body

Copy

```
<tsRequest>  <permissions>    <granteeCapabilities>      <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" />      <capabilities>        <capability name="AddComment" mode="Allow" />        <!-- ... additional capabilities ... -->      </capabilities>    </granteeCapabilities>    <granteeCapabilities>      <group id="2aa47cfa-9f2b-11e8-a260-af4a26124661" />      <capabilities>        <capability name="ViewComments" mode="Allow" />        <!-- ...  additional capabilities ... -->      </capabilities>    </granteeCapabilities>    <!-- ... additional grantee capability sets ...  -->  </permissions></tsRequest>
```

Copy

```
{  "permissions": {    "granteeCapabilities": [      {        "user": {          "@id": "user-luid"        },        "capabilities": {          "capability": {            "@name": "capability-name",            "@mode": "capability-mode"          },          "#text": "... additional capabilities ..."        }      },      {        "group": {          "@id": "group-luid"        },        "capabilities": {          "capability": {            "@name": "capability-name",            "@mode": "capability-mode"          },          "#text": "... additional capabilities ..."        }      }    ],    "#text": "... additional grantee capability sets ..."  }}
```

#### Request Attributes

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">workbook-id</span></td><td>The <span class="api-command-ref">&lt;workbook&gt;</span> element is not required, but can be included for compatibility with earlier versions of the REST API. If the <span class="api-command-ref">&lt;workbook&gt;</span> element is included, the <span class="api-placeholder">workbook-id</span> value must match the workbook ID in the URI. Any other attributes in the <span class="api-command-ref">&lt;workbook&gt;</span> element are ignored.</td></tr><tr><td><span class="api-placeholder">user-id</span></td><td>The ID (not name) of the user to add permissions for.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The ID (not name) of the group to add permissions for.</td></tr></tbody></table>

#### cURL Request Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/datasources/1a1b1c1d-2e2f-2a2b-3c3d-3e3f4a4b4c4d/connections" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @replace-view-permissions.xml`

#### Response Code

200

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400009</td><td>Invalid capability</td><td>The capability in the URI is invalid for a workbook resource. Valid capabilities for a workbook are <span class="api-command-ref">AddComment</span>, <span class="api-command-ref">ChangeHierarchy</span>, <span class="api-command-ref">ChangePermissions</span>, <span class="api-command-ref">CreateRefreshMetrics</span>, <span class="api-command-ref">Delete</span>, <span class="api-command-ref">ExportData</span>, <span class="api-command-ref">ExportImage</span>, <span class="api-command-ref">ExportXml</span>, <span class="api-command-ref">Filter</span>, <span class="api-command-ref">Read</span> (view), <span class="api-command-ref">RunExplainData</span>, <span class="api-command-ref">ShareView</span>, <span class="api-command-ref">ViewComments</span>, <span class="api-command-ref">ViewUnderlyingData</span>, <span class="api-command-ref">WebAuthoring</span>, and <span class="api-command-ref">Write</span>.</td></tr><tr><td>403</td><td>403004</td><td>Permissions setting forbidden</td><td>A non-administrator user called this method but doesn't have permission to set permissions on the workbook.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>A user ID in the request body doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404004</td><td>Data source not found</td><td>The data source ID in the URI doesn't correspond to an existing data source.</td></tr><tr><td>404</td><td>404005</td><td>Project not found</td><td>The project ID in the URI doesn't correspond to an existing project.</td></tr><tr><td>404</td><td>404006</td><td>Workbook not found</td><td>The workbook ID in the URI doesn't correspond to an existing workbook.</td></tr><tr><td>404</td><td>404011</td><td>View not found</td><td>The view ID&nbsp;in the ID&nbsp;doesn't correspond to an existing view.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>A group ID in the request body doesn't correspond to an existing group.</td></tr><tr><td>404</td><td>404013</td><td>Capability not found</td><td>The specified capability doesn't correspond to a defined capability. This can apply to either an invalid capability name or a capability other than <span class="api-command-ref">Allow</span> or <span class="api-command-ref">Deny</span> for any mode value.</td></tr><tr><td>404</td><td>404027</td><td>Flow not found</td><td>The flow ID&nbsp;in the URI doesn't correspond to an existing flow.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>The request type was not <b>POST</b>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).