# tableau Api Tableau SCIM API (scim-api) - Full Documentation

<!-- document id=02d6886ba47b6c88e75c38f139786bea4d081f5371d9449aa29c3735444cde63 url=/tableau/current/en-us/api/scim-api/docs/about.md -->

# About Tableau Help

  

## Addressing Implicit Bias in Technical Language

In an effort to align with one of our core company values, equality, we have changed terminology to be more inclusive where possible. Because changing terms in code can break current implementations, we maintain the current terminology in the following places:

- Tableau APIs: methods, parameters, and variables
- Tableau CLIs: commands and options
- Installers, installation directories, and terms in configuration files
- Tableau Resource Monitoring Tool (we plan to make changes to non-inclusive terminology in the web interface, error messages, and related documentation soon.)
- Third-party systems documentation

For more information about our ongoing effort to address implicit bias, see [Salesforce Updates Technical Language in Ongoing Effort to Address Implicit Bias](https://www.salesforce.com/news/stories/salesforce-updates-technical-language-in-ongoing-effort-to-address-implicit-bias) on the Salesforce website.

<!-- document id=56190c20840468a23a6e0654dd991bccffb22605ca88fd8d062a804007cfb08d url=/tableau/current/en-us/api/scim-api/docs/authentication.md -->

# SCIM API Authentication

  

**In this section:**

All requests against the SCIM API require the SCIM secret as the bearer token.

### Step 1: Add SCIM secret to header

As part of the process to [enable SCIM support](https://help.tableau.com/current/online/en-us/scim_config_online.htm#step-2-enable-scim-support), you generate a secret. This secret is used in the authorization header for all API requests.

**Example header**

`Authorization: Bearer fn5V9eazQqCGcnDq7UMUnw==:onbq-F2Q8HdyByJG6mi1yaWKcRlhrpDirVSz7o3-U8k='`

### Step 2: Next steps

Use the following APIs to perform provisioning and management tasks, including the bearer token in the authorization header in every request.

| Users Methods | Groups Methods |
| --- | --- |
| [Add User](/current/api/scim-api/en-us/docs/users.html#add-user) | [Create Group](/current/api/scim-api/en-us/docs/groups.html#create-group) |
| [Get User](/current/api/scim-api/en-us/docs/users.html#get-user) | [Get Group](/current/api/scim-api/en-us/docs/groups.html#get-group) |
| [List Users](/current/api/scim-api/en-us/docs/users.html#list-users) | [List Groups](/current/api/scim-api/en-us/docs/groups.html#list-groups) |
| [Update User](/current/api/scim-api/en-us/docs/users.html#) | [Update Group](/current/api/scim-api/en-us/docs/groups.html#update-group) |
| [Delete User](/current/api/scim-api/en-us/docs/users.html#delete-user) | [Delete Group](/current/api/scim-api/en-us/docs/groups.html#delete-group) |
| [Change User Site Role](/current/api/scim-api/en-us/docs/users.html#change-user-site-role) | [Change Group Name](/current/api/scim-api/en-us/docs/groups.html#change-group-name) |
| [Change User License Status](/current/api/scim-api/en-us/docs/users.html#change-user-license-status) | [Add Group Members](/current/api/scim-api/en-us/docs/groups.html#add-group-members) |
|   | [Remove Group Members](/current/api/scim-api/en-us/docs/groups.html#remove-group-members) |

<!-- document id=43e2f7758059a64031d3f55e6a05bb338001c994e1684882f8069979593f63b5 url=/tableau/current/en-us/api/scim-api/docs/groups.md -->

# SCIM API Groups Methods

  

Using the Tableau SCIM API’s **Groups methods**, you can perform the following tasks:

- Create a group on the site
- Get a group and list all groups on the site
- Update a group or change a group name on the site, add or remove members from a group
- Delete a group from the site

**Note:** The SCIM API only processes attributes that are required by Tableau Cloud to create, modify, and delete groups. If other attributes are passed, they will be ignored.

### Create Group

Creates a group on the Tableau Cloud site.

#### URI

`POST https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |

#### Request Body (JSON)

```
{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
    "displayName": "display-name"
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schemas` | (Required) Schema to include in the request body:  
`urn:ietf:params:scim:schemas:core:2.0:Group` |
| `displayName` | Name of the group. |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`201` - Created.  
`409` - Conflict. Group with the same name already exists.

#### Response Body (JSON)

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ],
    "id": "xx9160d6-4c7f-49a2-98ff-3b57ef9a55xx",
    "meta": {
        "resourceType": "Group"
        },	
    "displayName": "Marketing IT Admins"
}
```

### Get Group

Returns the specified group on the site.

#### URI

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id`

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id?attributesfilter=displayName eq 'group-name'`

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id?excludedAttributes=members`

`GET https://scim.online.tableau.com/pods/*pod-id*/sites/*site-id*/scim/v2/Groups?filter=displayName eq 'group-name'&excludedAttributes=members`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| _`pod-id`_ | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| _`site-id`_ | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| _`group-id`_ | ID of the group. To get the group ID, see [List Groups](#list-groups). |
| _`group-name`_ | (Optional) Name of the group to filter on. |

#### Request Body

None

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`200` - OK.  
`404` - Not found. Group with specified group ID does not exist.

#### Response Body (JSON)

**Get group; get group using displayName**

```
{
   "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ],
   "id": "xX9b5a7a-bd82-440f-8312-1f955c2bf1xX",
   "meta": {
       "resourceType": "Group"
   },
   "displayName": "Marketing IT Admins",
    "members": [
        {
        "value": "c287204e-d174-4a93-0a8b-0fe61954a07f"
        },
        {
		 "value": "d398314f-d175-5a94-9a7b-1fe61954a07g"
        },
        {
		 "value": "e409425g-d176-6a95-8a8b-2fe61954a07h"
        }
    ]
}
```

**Get group without returning its members**

```
{
   "schemas": [
         "urn:ietf:params:scim:schemas:core:2.0:Group"
    ],
   "id": "xX9b5a7a-bd82-440f-8312-1f955c2bf1xX",
   "meta": {
         "resourceType": "Group"
   },
   "displayName": "Marketing IT Admins"
}
```

**Get group using displayName without returning its members**

```
{
    "schemas": [
         "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "totalResults": 1,
    "Resources": [
        {
            "schemas": [
                "urn:ietf:params:scim:schemas:core:2.0:Group"
            ],
            "id": "xX9b5a7a-bd82-440f-8312-1f955c2bf1xX",
            "meta": {
                "resourceType": "Group"
            },
            "displayName": "Marketing IT Admins"
        }
    ],
    "startIndex": 1,
    "itemsPerPage": 1
}
```

### List Groups

Returns groups on the site.

#### URI

`GET https://scim.online.tableau.com/pods/pod-id/sites/*ite-id/scim/v2/Groups`

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups?excludedAttributes=members`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |

#### Request Body

None

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`200` - OK.

#### Response Body (JSON)

**List groups**

```
{
   "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
   "totalResults": 3,
   "Resources": [
       {
           "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:Group"
           ],
           "id": "fb14b0d7-15dc-4e74-a858-2b5cc0c7eed3",
           "meta": {
               "resourceType": "Group"
           },
           "displayName": "Marketing IT Admins",
		    "members": [
               {
                   "value": "4038f45c-5803-4152-895e-19ab21e2f95e"
               },
               {
                   "value": "4eb80283-f2f1-4d29-bcca-9f210c2fa28b"
               },
               {
                   "value": "95a9af2d-181d-40cf-903a-b7bab4b57d33"
               }		
            ]
       },
       {
           "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:Group"
           ],
           "id": "63d30972-641e-4c95-b0b6-3c024757b09a",
           "meta": {
               "resourceType": "Group"
           },
           "displayName": "Marketing",
            "members": [
               {
                   "value": "b8fe3a96-1fe8-467f-8281-93811132a4b1"
               },
               {
                   "value": "3a5e3800-e297-4965-9cae-cd7c426eb386"
               },
               {
                   "value": "ef011105-4a74-49f5-bcfc-9c76187681f9"
               },
               {
                   "value": "0fb8c9f6-e50f-4456-9ac2-384f46d9d894"
               },
               {
                   "value": "617183fe-2c1e-41ec-923c-eb16bce250c5"
               },
               {
                   "value": "80c0246e-2a01-4add-a3ff-d460ad0e148c"
               },
               {
                   "value": "32c845a9-ab44-42b3-aa3d-028e28bd1d76"
               }
            ]
       },
       {
           "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:Group"
           ],
           "id": "06791e6e-c458-4b3b-9b1b-113a96140569",
           "meta": {
               "resourceType": "Group"
           },
           "displayName": "All Users",
		    "members": [
               {
                   "value": "4038f45c-5803-4152-895e-19ab21e2f95e"
               },
               {
                   "value": "4eb80283-f2f1-4d29-bcca-9f210c2fa28b"
               },
               {
                   "value": "95a9af2d-181d-40cf-903a-b7bab4b57d33"
               },
	       {
                   "value": "b8fe3a96-1fe8-467f-8281-93811132a4b1"
               },
               {
                   "value": "3a5e3800-e297-4965-9cae-cd7c426eb386"
               },
               {
                   "value": "ef011105-4a74-49f5-bcfc-9c76187681f9"
               },
               {
                   "value": "0fb8c9f6-e50f-4456-9ac2-384f46d9d894"
               },
               {
                   "value": "617183fe-2c1e-41ec-923c-eb16bce250c5"
               },
               {
                   "value": "80c0246e-2a01-4add-a3ff-d460ad0e148c"
               },
               {
                   "value": "32c845a9-ab44-42b3-aa3d-028e28bd1d76"
               }
            ] 
       }  
   ],
   "startIndex": 1,
   "itemsPerPage": 25
}
```

**List groups without returning its members**

```
{
   "schemas": [
       "urn:ietf:params:scim:api:messages:2.0:ListResponse"
   ],
   "totalResults": 51,
   "Resources": [
        {
           "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:Group"
           ],
           "id": "fb14b0d7-15dc-4e74-a858-2b5cc0c7eed3",
           "meta": {
               "resourceType": "Group"
           },
           "displayName": "Marketing Contractors"
       },
       {
           "schemas": [
               "urn:ietf:params:scim:schemas:core:2.0:Group"
           ],
           "id": "63d30972-641e-4c95-b0b6-3c024757b09a",
           "meta": {
               "resourceType": "Group"
           },
           "displayName": "Marketing Fulltime"
       }
   ],
   "startIndex": 1,
   "itemsPerPage": 25
}
```

### Update Group

Modifies the group.

Depending on your identity provider (IdP), you might use the [Change Group Name](#change-group-name), [Add Group Members](#add-group-members), and [Remove Group Members](#remove-group-members) methods to update the group instead.

#### URI

`PUT https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `group-id` | ID of the group to update. To get the group ID, see [List Groups](#list-groups). |

#### Request Body (JSON)

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "displayName": "group-name",
    "members": [
        {
            "value": "user-id",
            "display": "username"
        }
    ],
    "minimumSiteRole": "site-role"
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schemas` | (Required) Schemas to include in the request body:  
`urn:ietf:params:scim:schemas:core:2.0:Group`  
`urn:ietf:params:scim:schemas:extension:tableau:3.0` |
| `displayName` | New name of the group. |
| `value` | ID of the user to add to or remove from the group. |
| `display` | Claim for retrieving the user’s username. Claim value is `username`. |
| `minimumSiteRole` | Role to assign the user.  
  
You can assign one of the following roles. Role values are case sensitive.  
`Creator`  
`Explorer`  
`ExplorerCanPublish`  
`SiteAdministratorExplorer`  
`SiteAdministratorCreator`  
`Unlicensed`  
`Viewer` |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`204` - No content.  
`404` - Not found. Group with specified group ID does not exist.

#### Response Body

None

### Delete Group

Permanently removes a group from the site.

#### URI

`DELETE https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `group-id` | ID of the group to delete. To get the group ID, see [List Groups](#list-groups). |

#### Request Body

None

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`204` - No content.  
`404` - Not found. Group with the group ID does not exist.

#### Request Body

None

### Change Group Name

Modifies the group by changing the name.

Depending on your identity provider (IdP), you might use the [Update Group](#update-group) method to change the name of the group instead.

#### URI

`PATCH https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | The first portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | The ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `group-id` | The ID of the group to update. To get the group ID, see [List Groups](#list-groups). |

#### Request Body (JSON)

```
{
   "schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
   "operations":[
{
       "op":"replace",
       "value":{
           "id":"group-id",
           "displayName":"group-name"
      		 }
  	 }
    ]
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schema` | (Required) Schema to include in the request body:  
`urn:ietf:params:scim:api:messages:2.0:PatchOp` |
| `op` | (Required) Operation type to specify: `replace`. |
| `id` | ID of the group to update. To get the group ID, see [List Groups](#list-groups). |
| `displayName` | New name of the group. |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`204` - No content.  
`400` - Bad request. Operation type is not valid.

#### Response Body

None

### Add Group Members

Modifies the group by adding one or more users to the group.

Depending on your identity provider (IdP), you might use the [Update Group](#update-group) method to add users to a group instead.

#### URI

`PATCH https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | The first portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | The ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `group-id` | The ID of the group to update. To get the group ID, see [List Groups](#list-groups). |

#### Request Body (JSON)

**Update group by adding a member**

```
{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "operations": [
        {
            "op": "add",
            "path": "members",
            "value": [
                {
                    "value": "user-id"
                }
            ]
        }
    ]
}
```

**Update group by adding multiple members**

```
{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "operations": [
        {
            "op": "add",
            "path": "members",
            "value": [
                {
                    "value": "user-id",
                    "value": "user-id",
                    "value": "user-id"
                }
            ]
        }
    ]
}
```

#### Attribute Values

| Attribute | Description |   |
| --- | --- | --- |
|   | `schemas` | (Required) Schema to include in the request body:  
`urn:ietf:params:scim:api:messages:2.0:PatchOp` |
|   | `op` | (Required) Operation type to specify: `add` |
|   | `path` | (Required) Path value to include in the request body: `members` |
|   | `value` | ID of the user to add to the group. To get the user ID, see [List Users](/current/api/scim-api/en-us/docs/users.html#list-users). |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`204` - No content.  
`400` - Bad request. Operation type is not valid.  
`404` - Not found. Group with specified group ID does not exist.

#### Response Body

None

### Remove Group Members

Remove one or all users from the group.

Depending on your identity provider (IdP), you might use the [Update Group](#update-group) method to remove users from a group instead.

#### URI

`PATCH https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Groups/group-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | The first portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | The ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `group-id` | The ID of the group to update. To get the group ID, see [List Groups](#list-groups). |

#### Request Body (JSON)

**Update group by removing a member**

```
{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "remove",
            "path": "members",
            "value": [
                {
                    "value": "user-id"
                }
            ]
        }
    ]
}
```

**Update group by removing all members**

```
{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "replace",
            "path": "members",
            "value": []
        }
    ]
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schemas` | (Required) Schema to include in the request body:  
`urn:ietf:params:scim:api:messages:2.0:PatchOp` |
| `op` | (Required) Operation type to specify, depending on the type of update: `remove` or `replace` |
| `path` | (Required) Path value to include in the request body: `members` |
| `value` | ID of the user to remove from the group. To get the user ID, see [List Users](/current/api/scim-api/en-us/docs/users.html#list-users). |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`204` - No content.  
`400` - Bad request. Operation type is not valid.  
`404` - Not found. Group with specified group ID does not exist.

#### Response Body

None

<!-- document id=5293ae6878d43e0ca4b3fc1fad76a1e2448603f734170c53bfa20f562f1a140f url=/tableau/current/en-us/api/scim-api/docs/users.md -->

# SCIM API Users Methods

  

Using the Tableau SCIM API’s **Users methods**, you can perform the following tasks:

- Add a user to a site
- Get a user and list all users on the site
- Update a user, change the site role and license status of a user
- Remove a user from the site

**Note:** The SCIM API only processes attributes that are required by Tableau Cloud to create, modify, and remove users. If other attributes are passed, they will be ignored.

### Add User

Adds a user to the site.

#### URI

`POST https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |

#### Request Body (JSON)

```
{
	"schemas": [
		"urn:ietf:params:scim:schemas:core:2.0:User",
		"urn:ietf:params:scim:schemas:extension:tableau:3.0"
	],
	"userName": "user-name",
	"name": {
		"familyName": "familyName",
		"givenName": "givenName"
	},
	"active": true,
    "entitlements": [{"value": "site-role"}],
	"urn:ietf:params:scim:schemas:extension:tableau:3.0": {
		"siteRoles": ["site-role"]
	}
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schemas` | (Required) Schemas to include in the request body:  
`urn:ietf:params:scim:schemas:core:2.0:User`  
`urn:ietf:params:scim:schemas:extension:tableau:3.0` |
| `userName` | (Required) The username (in email address format) that the user uses to sign in to Tableau Cloud. |
| `familyName` | Claim for retrieving the user’s family or last name. Claim value is `familyName`. |
| `givenName` | Claim for retrieving the user’s given or first name. Claim value is `givenName`. |
| `active` | License status of the user. Specify `true` for a licensed user and `false` for an unlicensed user.  
  
All site roles can be in a licensed or unlicensed license status. |
| `value` | Role to assign the user when `siteRoles`, `entitlements`, or both `siteRoles` and `entitlements` attributes are specified.  
  
The `siteRoles` attribute is evaluated before the `entitlements` attribute if both attributes are specified. You can assign one or more of the following roles but only the highest role is evaluated. Role values are case sensitive.  
`Creator`  
`Explorer`  
`ExplorerCanPublish`  
`SiteAdministratorExplorer`  
`SiteAdministratorCreator`  
`Unlicensed`  
`Viewer` |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`201` - Created.  
`400` - Bad request. The userName value is not valid.  
`400` - Bad request. The siteRole value is not valid.  
`409` - Conflict. User with the same username already exists.

#### Response Body (JSON)

```
{
    "active": true,
    "emails": [
        {
            "primary": true,
            "value": "alanw@example.com"
        }
    ],
    "entitlements": [
        {
            "value": "Explorer"
        }
    ],
    "groups": [
        {
            "display": "All Users",
            "value": "34b0979c-8416-4dd6-9650-6a8e00430510"
        }
    ],
    "id": "7e6cccc3-0b00-4e26-98de-12e5c16b8b76-00uj8jz0bownmVX5h5d7",
    "meta": {
        "resourceType": "User"
    },
    "name": {
        "familyName": "Wang",
        "givenName": "Alan"
    },
    "roles": [
        {
            "value": "Explorer"
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "Explorer"
        ]
    },
    "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
        "siteRoles": [
            "Explorer"
        ]
    },
    "userName": "alanw@example.com"
}
```

### Get User

Returns the specified user on the site.

#### URI

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users/user-id`

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users?filter=userName eq 'user-name'`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `user-id` | ID of the user to query. To get the user ID, see [List Users](#list-users). |
| `user-name` | (Optional) Username (in email address format) of the user to filter on. |

#### Request Body

None

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`200` - OK.  
`404` - Not Found. User with specified user ID does not exist.

#### Response Body (JSON)

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "id": "7e6cccc3-0b00-4e26-98de-12e5c16b8b76",
    "meta": {
        "resourceType": "User"
    },
    "userName": "alanw@example.com",
    "name": {
        "familyName": "Williams",
        "givenName": "Alan"
    },
    "active": true,
    "emails": [
        {
            "value": "alanw@example.com",
            "primary": true
        }
    ],
    "groups": [
        {
            "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
            "display": "Marketing IT Admins"
        }
    ],
    "entitlements": [
        {
            "value": "Creator"
        }
    ],
    "roles": [
        {
            "value": "Creator"
        }
    ],
    "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
        "siteRoles": [
            "Creator"
        ]
    },
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "Creator"
        ]
    }
}
```

### List Users

Returns users on the site.

#### URI

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users`

`GET https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users?startIndex=index&count=count`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| _`pod-id`_ | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| _`site-id`_ | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| _`index`_ | (Optional) Starting point in the list of users. |
| _`count`_ | (Optional) Number of users to return. |

#### Request Body

None

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`200` - OK.

#### Response Body (JSON)

**List users**

```
{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "totalResults": 2,
    "Resources": [
        {
            "schemas": [
                "urn:ietf:params:scim:schemas:core:2.0:User",
                "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
                "urn:ietf:params:scim:schemas:extension:tableau:3.0"
            ],
            "id": "4038f45c-5803-4152-895e-19ab21e2f95e",
            "meta": {
                "resourceType": "User"
            },
            "userName": "alanw@example.com",
            "name": {
                "familyName": "Williams",
                "givenName": "Alan"
            },
            "active": true,
            "emails": [
                {
                    "value": "alanw@example.com",
                    "primary": true
                }
            ],
            "groups": [
                {
                    "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
                    "display": "All Users"
                }
            ],
            "entitlements": [
                {
                    "value": "Creator"
                }
            ],
            "roles": [
                {
                    "value": "Creator"
                }
            ],
            "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
                "siteRoles": [
                    "Creator"
                ]
            },
            "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
                "siteRoles": [
                    "Creator"
                ]
            }
        },
        {
            "schemas": [
                "urn:ietf:params:scim:schemas:core:2.0:User",
                "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
                "urn:ietf:params:scim:schemas:extension:tableau:3.0"
            ],
            "id": "4eb80283-f2f1-4d29-bcca-9f210c2fa28b",
            "meta": {
                "resourceType": "User"
            },
            "userName": "susann@example.com",
            "name": {
                "familyName": "Nguyen",
                "givenName": "Susan"
            },
            "active": true,
            "emails": [
                {
                    "value": "susann@example.com",
                    "primary": true
                }
            ],
            "groups": [
                {
                    "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
                    "display": "All Users"
                }
            ],
            "entitlements": [
                {
                    "value": "SiteAdministratorCreator"
                }
            ],
            "roles": [
                {
                    "value": "SiteAdministratorCreator"
                }
            ],
            "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
                "siteRoles": [
                    "SiteAdministratorCreator"
                ]
            },
            "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
                "siteRoles": [
                    "SiteAdministratorCreator"
                ]
            }
        }
    ],
    "startIndex": 1,
    "itemsPerPage": 15
}
```

**List specific number of users from the specified point**

```
{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "totalResults": 2,
    "Resources": [
        {
            "schemas": [
                "urn:ietf:params:scim:schemas:core:2.0:User",
                "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
                "urn:ietf:params:scim:schemas:extension:tableau:3.0"
            ],
            "id": "4eb80283-f2f1-4d29-bcca-9f210c2fa28b",
            "meta": {
                "resourceType": "User"
            },
            "userName": "alanw@example.com",
            "name": {
                "familyName": "Alan",
                "givenName": "Williams"
            },
            "active": true,
            "emails": [
                {
                    "value": "alanw@example.com",
                    "primary": true
                }
            ],
            "groups": [
                {
                    "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
                    "display": "All Users"
                }
            ],
            "entitlements": [
                {
                    "value": "SiteAdministratorCreator"
                }
            ],
            "roles": [
                {
                    "value": "SiteAdministratorCreator"
                }
            ],
            "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
                "siteRoles": [
                    "SiteAdministratorCreator"
                ]
            },
            "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
                "siteRoles": [
                    "SiteAdministratorCreator"
                ]
            }
        }
    ],
    "startIndex": 2,
    "itemsPerPage": 1
}
```

### Update User

Modifies the user.

Depending on your identity provider (IdP), you might use the [Change User Site Role](#change-user-site-role) and [Change User License Status](#change-user-license-status) methods to update the user instead.

#### URI

`PUT https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users/user-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `user-id` | ID of the user to update. To get the user ID, see [List Users](#list-users). |

#### Request Body (JSON)

**Update user site role**

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "id": "user-id",
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "site-role",
            "site-role"
        ]
    }
}
```

**Update user license status**

```
{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "id": "aa9160d6-4c7f-49a2-98ff-3b57ef9a559c",
    "active": status,
    "entitlements": [
        {
            "value": "site-role"
        },
        {
            "value": "site-role"
        }
    ]
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schemas` | (Required) Schemas to include in the request body:  
`urn:ietf:params:scim:schemas:core:2.0:User`  
`urn:ietf:params:scim:schemas:extension:tableau:3.0` |
| `id` | (Required) ID of the user to update. For example, `6eee3d6f-2ab6-44c4-9c49-9b017c41e921`. To get the user ID, see [List Users](#list-users). |
| `siteRoles` | Role to assign the user.  
  
You can assign one or more of the following roles but only the highest role is evaluated. Role values are case sensitive.  
`Creator`  
`Explorer`  
`ExplorerCanPublish`  
`SiteAdministratorExplorer`  
`SiteAdministratorCreator`  
`Unlicensed`  
`Viewer` |
| `active` | License status of the user. Specify `true` for a licensed user and `false` for an unlicensed user. All site roles can be associated with a licensed or unlicensed license status. |
| `value` | Role to assign the user.  
  
You can assign one or more of the following roles but only the highest role is evaluated. Role values are case sensitive.  
`Creator`  
`Explorer`  
`ExplorerCanPublish`  
`SiteAdministratorExplorer`  
`SiteAdministratorCreator`  
`Unlicensed`  
`Viewer` |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`200` - OK.  
`400` - Not found. User with specified user ID does not exist.  
`500` - Unexpected error. The site role value is not valid.

#### Response Body (JSON)

**Update user site role**

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "id": "aa9160d6-4c7f-49a2-98ff-3b57ef9a559c",
    "meta": {
        "resourceType": "User"
    },
    "userName": "ashleyg@example.com",
    "name": {
        "familyName": "Garcia",
        "givenName": "Ashley"
    },
    "active": true,
    "emails": [
        {
            "value": "ashleyg@example.com",
            "primary": true
        }
    ],
    "groups": [
        {
            "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
            "display": "All Users"
        }
    ],
    "entitlements": [
        {
            "value": "Creator"
        }
    ],
    "roles": [
        {
            "value": "Creator"
        }
    ],
    "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
        "siteRoles": [
            "Creator",
            "Explorer"
        ]
    },
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "Creator"
        ]
    }
}
```

**Update user license status**

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "id": "aa9160d6-4c7f-49a2-98ff-3b57ef9a559c",
    "meta": {
        "resourceType": "User"
    },
    "userName": "ashleyg@example.com",
    "name": {
        "familyName": "Garcia",
        "givenName": "Ashley"
    },
    "active": false,
    "emails": [
        {
            "value": "ashleyg@example.com",
            "primary": true
        }
    ],
    "groups": [
        {
            "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
            "display": "All Users"
        }
    ],
    "entitlements": [
        {
            "value": "Unlicensed"
        }
    ],
    "roles": [
        {
            "value": "Unlicensed"
        }
    ],
    "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
        "siteRoles": [
            "Unlicensed"
        ]
    },
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "Unlicensed"
        ]
    }
}
```

### Delete User

Permanently removes the user from the site.

You can only remove the user if they do not own any content (projects, workbooks, views, data sources, collections, or data alerts for example). If you attempt to remove a user who owns content, the user’s site role is set to “unlicensed” and is not removed.

**Note:** The user must also be removed from the IdP.

#### URI

`DELETE https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users/user-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `user-id` | ID of the user to delete. To get the user ID, see [List Users](#list-users). |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`204` - No content.  
`404` - Not found. User with specified user ID does not exist.

#### Response Body

None

### Change User Site Role

Modifies the user by changing their site role.

Depending on your identity provider (IdP), you might use the [Update User](#update-user) method to change the site role of a user instead.

#### URI

`PATCH https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users/user-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | First portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | The ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `user-id` | The ID of the user to update. To get the user ID, see [List Users](#list-users). |

#### Request Body (JSON)

```
{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ],
    "Operations": [
        {
            "op": "replace",
            "path": "urn:ietf:params:scim:schemas:extension:tableau:3.0:User:siteRoles",
            "value": [
                {
                    "value": "site-role"
                },
                {
                    "value": "site-role"
                }
            ]
        }
    ]
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schemas` | (Required) Schema to include in the request body:  
`urn:ietf:params:scim:api:messages:2.0:PatchOp` |
| `op` | (Required) Operation type to specify: `replace` |
| `path` | (Required) Path value to include in the request body:  
`urn:ietf:params:scim:schemas:extension:tableau:3.0:User:siteRoles` |
| `value` | Role to assign the user.  
  
You can assign one or more of the following roles. Only the highest role is evaluated. Role values are case sensitive.  
`Creator`  
`Explorer`  
`ExplorerCanPublish`  
`SiteAdministratorExplorer`  
`SiteAdministratorCreator`  
`Unlicensed`  
`Viewer` |

#### Permissions

This method can only be called by Tableau Cloud site admins.

#### Response Code

`200` - OK.  
`400` - Bad Request. Operation type is not valid.  
`400` - Bad Request. Site role value is not specified.  
`400` - Bad Request. Path value is incorrect.  
`404` - Not found. User with specified user ID does not exist.

#### Response Body (JSON)

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "id": "aa9160d6-4c7f-49a2-98ff-3b57ef9a559c",
    "meta": {
        "resourceType": "User"
    },
    "userName": "susann@example.com",
    "name": {
        "familyName": "Nguyen",
        "givenName": "Susan"
    },
    "active": true,
    "emails": [
        {
            "value": "susann@example2.com",
            "primary": true
        }
    ],
    "groups": [
        {
            "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
            "display": "All Users"
        }
    ],
    "entitlements": [
        {
            "value": "SiteAdministratorExplorer"
        }
    ],
    "roles": [
        {
            "value": "SiteAdministratorExplorer"
        }
    ],
    "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
        "siteRoles": [
            "SiteAdministratorExplorer"
        ]
    },
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "SiteAdministratorExplorer"
        ]
    }
}
```

### Change User License Status

Modifies the user by changing their license status to “unlicensed” or “licensed”.

Depending on your identity provider (IdP), you might use the [Update User](#update-user) method to change the license status of the user.

#### URI

`PATCH https://scim.online.tableau.com/pods/pod-id/sites/site-id/scim/v2/Users/user-id`

#### Parameter Values

| Parameter | Description |
| --- | --- |
| `pod-id` | The first portion of a Tableau Cloud site’s URL. For example, if a site’s URL is prod-ca-a.online.tableau.com, the pod ID is `prod-ca-a`. |
| `site-id` | The ID of the site. The site ID is included in the response of a successful [Sign In request](/current/api/scim-api/en-us/docs/authentication.html#step-2-make-a-sign-in-request). |
| `user-id` | The ID of the user to update. To get the user ID, see [List Users](#list-users). |

#### Request Body (JSON)

```
{
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
    "Operations": [
        {
            "op": "replace",
            "value": {
                "active": false
            }
        }
    ]
}
```

#### Attribute Values

| Attribute | Description |
| --- | --- |
| `schema` | (Required) Schema to include in the request body:  
`urn:ietf:params:scim:api:messages:2.0:PatchOp` |
| `op` | (Required) Operation type to specify: `replace` |
| `active` | License status of the user. Specify `true` for a licensed user and `false` for an unlicensed user. All site roles can be associated with a licensed or unlicensed license status. |

#### Response Code

`204` - OK.  
`400` - Bad request. Operation type is not valid.  
`404` - Not found. User with specified user ID does not exist.  

#### Response Body (JSON)

```
{
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0:User",
        "urn:ietf:params:scim:schemas:extension:tableau:3.0"
    ],
    "id": "aa9160d6-4c7f-49a2-98ff-3b57ef9a559c",
    "meta": {
        "resourceType": "User"
    },
    "userName": "susann@example.com",
    "name": {
        "familyName": "Nguyen",
        "givenName": "Susan"
    },
    "active": false,
    "emails": [
        {
            "value": "susann@example2.com",
            "primary": true
        }
    ],
    "groups": [
        {
            "value": "34b0979c-8416-4dd6-9650-6a8e00430510",
            "display": "All Users"
        }
    ],
    "entitlements": [
        {
            "value": "Unlicensed"
        }
    ],
    "roles": [
        {
            "value": "Unlicensed"
        }
    ],
    "urn:ietf:params:scim:schemas:extension:tableau:3.0:User": {
        "siteRoles": [
            "Unlicensed"
        ]
    },
    "urn:ietf:params:scim:schemas:extension:tableau:3.0": {
        "siteRoles": [
            "Unlicensed"
        ]
    }
}
```

<!-- document id=3314f316c45266b0e33fd2ea93a138cd232b16c0ae006496afcaccc051004100 url=/tableau/current/en-us/api/scim-api/index.md -->

# Tableau SCIM API

  

## Overview

System for Cross-domain Identity Management (SCIM) is an HTTP-based protocol that standardizes the automation of users and groups provisioning for cloud-based applications like Tableau Cloud. Tableau Cloud supports SCIM, enabling identity providers (IdPs) to centrally manage user identities while streamlining the process of managing users and group membership in Tableau Cloud. The IdP uses SCIM to ensure that access is granted and revoked in a timely way and Tableau Cloud is kept in sync with the provisioning assignments in the IdP. This type of integration improves security and reduces the manual work for site admins in Tableau Cloud.

After enabling SAML authentication and SCIM integration with your Tableau Cloud site, you can use the Tableau SCIM APIs to automate users and groups provisioning.

## About the SCIM API

With the Tableau SCIM API, you can manage and change user and group resources using HTTP. The SCIM API is a separate service from Tableau Cloud, with its own REST interface.

The methods described in this documentation have been developed using SCIM 2.0 and follow the SCIM standard defined in RFC 7644.

### SCIM API Requirements

To use the SCIM API, the following requirements must be met:

1. **Site admin:** Be a Tableau Cloud site admin
2. **Authentication configured:** SAML, OIDC, or Google authentication is configured and enabled on the site. For more information, see one of the following topics in the Tableau Cloud Help:
    - [Google Authentication](https://help.tableau.com/current/online/en-us/security_auth_google.htm)
    - [OpenID Connect](https://help.tableau.com/current/online/en-us/openid_auth.htm)
    - [Enable SAML Authentication on the Site](https://help.tableau.com/current/online/en-us/saml_config_site.htm)
3. **SCIM enabled:** SCIM capability is enabled on the site. For more information, see [Enable SCIM support](https://help.tableau.com/current/online/en-us/scim_config_online.htm#enable-scim-support-with-your-idp) in the Tableau Cloud Help.

<!-- document id=210be51a88be1183021b9679a5273b19f1cf023ac737994a02ad21cc60b01b1d url=/tableau/current/en-us/api/scim-api/docs/whats_new.md -->

# What's New

  

# Tableau SCIM API

_February 2026_

Updated the authentication prerequisite to include OIDC and Google authentication, which were added to extend SCIM integration support starting February 2026 (Tableau 2026.1).

_December 2025_

This release introduces the initial set of users and groups provisioning API methods and endpoints for the Tableau SCIM API.