--- schema_version: "1" id: 6fe0e72d67a1bdd5cd701ed0e598a3bc9e8fa027bac2d0025613ca2f18c10fd2 title: Tableau Site Settings for Embedding collection: tableau version: next locale: en-us portal_url: https://docs.salesforce.com/tableau/next/en-us/api/embedding_api/docs/embedding_api_site.md canonical_url: https://help.tableau.com/v0.0/api/embedding_api/en-us/docs/embedding_api_site.html source_site: help.tableau.com content_type: documentation content_hash: 3524cd6ac575f4f8142785d46507ade95035a44ef1f64f82e4057ee03f2d156c description: Documentation for the Tableau Embedding API --- # Tableau Site Settings for Embedding To provide more control and security in embedding scenarios that are not configured as connected apps, Tableau 2022.2 provides new settings for Tableau site administrators that control embedding views from the site. * * * ## About Tableau site settings for embedding Starting with Tableau 2022.2, Tableau site administrators can control whether views from the Tableau instance are allowed to be embedded without restriction, or whether only those websites that are explicitly added to an allowlist can embed views. These settings apply to all embedded views except those that use Tableau connected apps for authentication using direct trust. Starting with Tableau 2023.2 and Tableau 2023.3[1](#fn:1), these settings also apply to embedded views if your web application uses a Tableau connected apps for authentication. If your web application uses a connected app for authentication with direct trust, you do not need to add your web application to the embedding allowlist on your Tableau site. The domain allowlist of connected apps with direct trust supersedes the Tableau site allowlist for embedding and can be configured using the steps for connected apps in [Tableau Cloud](https://help.tableau.com/current/online/en-us/connected_apps_eas.htm) or [Tableau Server](https://help.tableau.com/current/server-linux/en-us/connected_apps_eas.htm). That is, the site settings for embedding views do not affect connected apps with direct trust, only OAuth 2.0 trust. See the [Tableau site settings for embedding and connected apps](#tableau-site-settings-for-embedding-and-connected-apps). For compatibility with current embedding solutions, the default Tableau site setting allows unrestricted embedding of views from the site. If you want to control the Tableau views that can be embedded, you can change this setting so that no websites are allowed to embed views, or only websites that you specify can embed Tableau views. In Tableau 2022.2, Tableau site administrators can use the Tableau REST API (version 3.16 and later) to change the default settings. - To view the current settings, use the Tableau REST API [Get Embedding Settings for a Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#embedding_settings_for_site) method. The URI takes the form: `/api//sites//settings/embedding`. - To change the settings, use the [Update Embedding Settings for a site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#update_site) method. The settings have two options: `unrestrictedEmbedding` and `allowList`. | URI | `/api//sites//settings/embedding` | | --- | --- | | Parameters | Description | | --- | --- | | `unrestrictedEmbedding` | (Boolean) Controls whether the site allows unrestricted embedding. The default setting is `true`, and embedding is allowed. | | `allowList` | (string) A space-delimited list of websites where embedding views is allowed. | By default, the `unrestrictedEmbedding` value is set to `true`, enabling all websites to embed Tableau views, and the `allowList` value is an empty (`""`) string. If `unrestrictedEmbedding` is set to `false`, only sites that appear on the `allowList` are able to embed views. Web applications that use Tableau connected apps with direct trust for authentication are not affected by the embedding site settings. See [the Tableau Site settings for embedding and connected apps](#the-tableau-site-settings-for-embedding-and-connected-apps) for more information. ### View site settings for embedding 1. To view the settings, login to Tableau using the Tableau REST API. See [Sign In](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#sign_in). 2. Using the token returned by signing in and the site id, you can query the site for the embedding settings, see [Get Embedding Settings for a Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#embedding_settings_for_site). The following shows the results of such a query. These settings show the default configuration that allows unrestricted embedding. ``` { "site": { "settings": [ { "allowList": "", "unrestrictedEmbedding": true } ], "id": "abcd1234-ab12-ab12-ab12-abcd1234abcd" } } ``` ### Restrict embedding to websites on the allowlist To restrict embedding so that only the web site that you specify are allowed to embed views from this Tableau site, you need to set `unrestrictedEmbedding` to `false`. You then specify the websites you want to allow in the `allowList`. The `allowList` is a space-delimited list of sites. You can use wildcards and port numbers, following the [Content Security Policy standard outlined for sources](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors#sources). 1. To update the settings, login to Tableau using the Tableau REST API. See [Sign In](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#sign_in). 2. Using the credentials token returned by signing in and the site id, update the site for the embedding settings, by sending a request packet with the updated settings. See [Update Embedding Settings for a site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#update_site). For example, the following request packet restricts embedding views to just three websites, including a local computer used for testing. ``` { "site": { "settings": [ { "allowList": "https://*.example.com https://mycompany.com http://localhost:8765", "unrestrictedEmbedding": false } ], "id": "abcd1234-ab12-ab12-ab12-abcd1234abcd" } } ``` * * * ## Cross-domain security To ensure security in embedding scenarios, and to prevent cross-site scripting attacks, the website or web application that hosts the embedded view **_must not tamper with the Content Security Policy (CSP) headers_** at any point. Tampering with these headers in other places in the system could allow an attacker to retrieve information from the Tableau view. For more information, see [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). * * * ## Tableau site settings for embedding and connected apps When you embed a view that has been configured to use a Tableau connected app for authentication, the domain allowlist of the connected app is not affected by the Tableau site settings for embedding when the connected app with direct trust is used. The following table illustrates the behavior when a view is embedded with a JSON Web Token (JWT) of the connected app with direct trust. For information about using a connected app for authentication for your embedding scenario, see [Authentication and Embedded Views](/v0.0/api/embedding_api/en-us/docs/embedding_api_auth.html). In this example, the connected app domain allowlist only allows embedding inside domain `xyz.com`. | Tableau site settings for embedding | Embedding (using the connected app with direct trust) | Embedding | | --- | --- | --- | | `unrestrictedEmbedding: true` | Only allowed inside domain `xyz.com` | Embedding allowed all domains | | `unrestrictedEmbedding: false`, `allowList: "abc.com"` | Only allowed inside domain `xyz.com` | Only allowed inside domain `abc.com` | | `unrestrictedEmbedding: false`, `allowList: ""` | Only allowed inside domain `xyz.com` | Embedding completely restricted | * * * ## For more information - For information about using the Tableau REST API to configure the Tableau site settings for embedding, see [Get Embedding Settings for a Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#embedding_settings_for_site) and [Update Embedding Settings for a site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#update_site). 1. Tableau 2023.2 release is Tableau Cloud only. Tableau 2023.3 release includes Tableau Server. [↩](#fnref:1) #### On This Page