---
schema_version: "1"
id: bfdf90bae8ef50580c79bccd553d44c75800727cbb96a587f69279811373e0d7
title: Users and Groups Methods
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/api/rest_api/REST/rest_api_ref_users_and_groups.md
canonical_url: https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 7297efcc943dd0ee639e8d47bd2e2619a82aa9b5e37383fcdea8048cabecf8ae
description: "Using the groups and users methods of the Tableau REST API you can do the operations listed in the following categories:"
---
[Skip to main content](#main-content)

# Users and Groups Methods

Using the groups and users methods of the Tableau REST API you can do the operations listed in the following categories:

**Groups** (groups of users)

- Create a local group of users for a site or import users to a new local group from Active Directory
- Get a filtered, sorted list of groups of a site
- Update a local group name or refresh the users from Active Directory
- List, add, or delete users of a group
- Bulk add or remove users
- Set minimum site role and enable on-demand access (Tableau Cloud only)
- Create, update, delete a SCIM configuration that enables the automatic provisioning of groups of users (Tableau Cloud only)

**Group Sets** (sets of groups)

- Create a group set
- Get a filtered, sorted list of group sets
- Update a group set
- List, add, or delete groups of a group set
- Delete a group set

**Site Users** (users of a site)

- Get a filtered, sorted list of users of a site
- Get or update the details of a user of a site
- Add or delete a user of a site
- Import users and set their user properties from a .csv file
- Delete a group, or a list of users in a .csv file, from a site
- Download user credentials for migrating users to another site
- Upload user credentials users migrated to another site
- Create, update, delete a SCIM configuration that enables the automatic provisioning of users (Tableau Cloud only)

This functionality relates to the UI elements and concepts described at: [Manage Users and Groups](https://help.tableau.com/current/server/en-us/users.htm).

## Use Postman

Our Postman collection of requests enables you to construct, send, and examine HTTP requests to the Tableau Server or Tableau Cloud API without writing initial code. Postman is a free online app used by many developers for prototyping API calls, investigating issues, and generating request code in a variety of languages.

[Postman: Users and Groups](https://www.postman.com/salesforce-developers/salesforce-developers/folder/waribaq/users-and-groups)

## Add Group to Group Set

Adds group to a group set.

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:update

- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

PUT api/api-version/sites/site-id/groupsets/group-set-id/groups/group-id

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr><tr><td><span class="api-placeholder">group-set-id</span></td><td>The unique ID of the group set you want to add the group to.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The unique ID of the group you want to add to the group set.</td></tr></tbody></table>

#### Request Body

None

#### Response Code

200

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2" style="width: 87px;"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>403</td><td>403004</td><td>Unauthorized operation</td><td>Insufficient permissions to perform the operation.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the request body doesn't correspond to an existing group.</td></tr><tr><td>409</td><td>409120</td><td>Group set not found</td><td>The group set ID in the request body doesn't correspond to an existing group.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Add User to Group

Adds a user to the specified group.

Beginning in API 3.21, you can bulk add users to a group by specifying multiple user IDs.

**Note**: After you create a resource, the server updates its search index. If you make a query immediately to see a new resource, the query results might not be up to date.

#### URI

POST /api/api-version/sites/site-id/groups/group-id/users

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The ID of the group to add the user to.</td></tr></tbody></table>

#### Request Body

**Add a single user to a group**

```
<tsRequest>
  <user id="user-id" />
</tsRequest>
```

**Bulk add users to a group** (beginning in API 3.21)

```
<tsRequest>
  <users>
	<user id="user-id1" />
	<user id="user-id2" />
	<user id="user-id2" />
  </users>
</tsRequest>
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>
                                            <p>
                                    The ID (not name) of the user to add. You can get the user ID by calling <a href="#get_users_on_site">Get Users on Site</a>.
</p>
                                            <p>Beginning in API 3.21, you can bulk add users to a group by specifying multiple user IDs. </p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

**Add a single user to a group**

```
<tsResponse>
  <user id="user-id" name="user-name" siteRole="site-role" />
</tsResponse>
```

**Bulk add users to group** (beginning in API 3.21)

```
<tsResponse>
  <users>
	<user id="user-id"
     name="user-name"
     siteRole="site-role" />
	<user id="user-id"
	 name="user-name"
	 siteRole="site-role" />
  </users>
</tsResponse>
```

The siteRole value is returned as one of the following values: Creator, Explorer, ExplorerCanPublish, ServerAdministrator, SiteAdministratorExplorer, SiteAdministratorCreator, Unlicensed, ReadOnly, or Viewer.

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group name in the request body doesn't correspond to an existing group.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">POST</span>.</td></tr><tr><td>409</td><td>409011</td><td>User conflict</td><td>The specified user is already a member of the group.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

##### Add a single user to a group

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/users" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @add-user-to-group.xml`

**Content of add-user-to-group.xml:**

```
<tsRequest>
  <users id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" />
</tsRequest>
```

**Example response:**

```
<?xml version="1.0" encoding="UTF-8" ?>
<tsResponse version-and-namespace-settings>
  <user id="59a8a7b6-be3a-4d2d-1e9e-08a7b6b5b4ba" name="Adam"
        siteRole="Explorer" />
</tsResponse>
```

##### Bulk add users to a group (beginning in API 3.21)

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/users" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @bulk-add-user-to-group.xml`

**Content of bulk-add-user-to-group.xml:**

```
<tsRequest>
  <users>
	<user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" />
	<user id="1z4e8n7q-6t8t-8f8e-7d7c-1b1a2f2d2e2d" />
  </users>
</tsRequest>
```

**Example response:**

```
<?xml version="1.0" encoding="UTF-8" ?>
<tsResponse version-and-namespace-settings>
 <users>
  <user id="59a8a7b6-be3a-4d2d-1e9e-08a7b6b5b4ba" name="Adam"
        siteRole="Explorer" />
  <user id="11a1a1b1-be3a-4d2d-1e9e-08a7b6b5b5ba" name="Sadako"
		siteRole="Explorer" />
 <users>
</tsResponse>
```

## Add User to Site

Adds a user to Tableau Server or Tableau and assigns the user to the specified site.

**Tableau Server**

If Tableau Server is configured to use local authentication, the information you specify is used to create a new user in Tableau Server.

**Note**: After creating the user, you **must** set a full name, password, and email address for the user with the call to [Update User](#update_user). If you are using SAML with local authentication, the user information that you add is not synchronized with the SAML IdP, as it would be if you were using Active Directory. Even if it is not used by SAML, the user information must be present.

If Tableau Server is configured to use Active Directory for authentication, the user you specify is imported from Active Directory into Tableau Server.

**Tableau Cloud**

When you add a user to Tableau Cloud, the name of the user must be the email address that is used to sign in to Tableau Cloud. After you add a user, Tableau Cloud sends the user an email invitation. The user can click the link in the invitation to sign in and update their full name and password.

If you try to add a user using a specific site role but you have already reached the limit on the number of licenses for your users, the user is added as an unlicensed user. In that case, the response code is 201 (which indicates success), but the siteRole value in the response body is set to Unlicensed.

**Note:** After you create a resource, the server updates its search index. If you make a query immediately to see a new resource, the query results might not be up to date.

#### URI

POST /api/api-version/sites/site-id/users

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site to add users to.</td></tr></tbody></table>

#### Request Body

_(Use the icon in the top right corner to copy the text.)_

```
<tsRequest>
  <user name="user-name"
        siteRole="site-role"
        authSetting="auth-setting"
		identityPoolName="identity-pool-name"
		idpConfigurationId="idp-configuration-id"
		email="email-address"
		language="language"
		locale="locale" />
</tsRequest>
```

_(Use the icon in the top right corner to copy the text.)_

```
{
	"user": {
	   "name":"user-name",
	   "siteRole":"site-role",
	   "authSetting":"auth-setting",
	   "identityPoolName":"identity-pool-name",
	   "idpConfigurationId":"idp-configuration-id",
	   "email":"email-address",
	   "language":"language",
	   "locale": "locale"
	 }
}
```

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup><col class="api-parameters-table-col-1-extra-wide">
                                <col>
                                </colgroup><tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-name</span>
                                        </td>
                                        <td>The name of the user. If the server uses local authentication, this can be any name. If you are using
					Active Directory authentication, or if you are using Tableau Cloud, there are specific requirements for the name.
                                <p><b>Tableau Server</b><br>If Tableau Server uses Active Directory authentication, this must be the name of an existing
					user in Active Directory. If the user name is not unique across domains, you must include the
                    domain as part of the user name (for example, <span class="uicontrol">example\Adam</span> or
					<span class="uicontrol">adam@example.com</span>).
                                </p><p class="note"><strong>Note:</strong> Active Directory specifies a user name using two attributes: <code>sAMAccountName</code>
				     and <code>userPrincipalName</code> (UPN) prefix. For most Active Directory users, these attributes are the same. By default,
				     if you are adding a user from Active Directory, the name that you provide in the <span class="api-placeholder">user-name</span>
					is matched against the Active Directory <code>sAMAccountName</code> attribute, which becomes the name that the user signs in to
					Tableau Server with.
					<br><br>Two exceptions are when the name that you provide: is longer than 20 characters; and includes an <code>@</code> character.
					In these cases, Tableau imports the user using the Active Directory UPN. For more information, see
				<a href="https://msdn.microsoft.com/en-us/library/ms677605(v=vs.85).aspx" rel="noopener" target="_blank">User Naming Attributes</a> on
					the MSDN site.
				</p><p><b>Tableau Cloud</b><br>The <span class="api-placeholder">user-name</span> is the email address that the user will use to sign in to Tableau Cloud.
					When you add a user to the site, Tableau Cloud sends an email invitation. The user can click the link in the invitation to
					sign in and update their full name and password.
				</p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-role</span>
                                        </td>
                                        <td>The site role to assign to the user. You can assign the following roles:
											<span class="api-command-ref">Creator</span>,
											<span class="api-command-ref">Explorer</span>,
											<span class="api-command-ref">ExplorerCanPublish</span>,
											<span class="api-command-ref">SiteAdministratorExplorer</span>,
											<span class="api-command-ref">SiteAdministratorCreator</span>,
											<span class="api-command-ref">Unlicensed</span>,
											or
										<span class="api-command-ref">Viewer</span>.
                                <p><strong>Note</strong>: You cannot use the REST API to set a user to be a server administrator (<span class="api-command-ref">ServerAdministrator</span> site role).</p></td>
                                    </tr>
                                    <tr>
                                        <td><a name="authsetting"></a><span class="api-placeholder">auth-setting</span>
                                        </td>
                                        <td>(Optional) The authentication method to assign the user.
                                <p><b>Tableau Server</b></p><p>The <span class="api-command-ref">authSetting</span> attribute only applies when updating users on sites with site-specific SAML-enabled settings.</p><p><b>Tableau Cloud</b></p><p>The ability to create and enable multiple authentication methods simultaneously was introduced in API 3.25 (January 2025). As a result of this capability, consider the following:</p><ul><li><p><b>For Tableau with MFA (or Tableau) authentication:</b> To assign Tableau with MFA&nbsp;authentication (or Tableau authentication if still available for your site), you can use the <span class="api-command-ref">authSetting</span> or <span class="api-command-ref"><a href="#idpconfigurationid">idpConfigurationId</a></span> attribute, but not both.</p></li><li><p><b>For SAML and OIDC-based authentication:</b></p><ul><li><p><b>For new configurations:</b> To assign SAML&nbsp;or OIDC-based authentication, whose configurations were created during or after January 2025,  you must use the <span class="api-command-ref">idpConfigurationId</span> attribute for assigning user authentication.  Skip to <a href="#idpconfigurationid" class="xref">idp-configuration-id</a>.</p></li><li><p><b>For existing configurations:</b> To assign SAML&nbsp;and OIDC-based authentication, whose configurations that Tableau has automatically prefixed with "Initial" (such as "Initial SAML," "Initial Google," "Initial OIDC," or "Initial Salesforce"),  you can continue to use the <span class="api-command-ref">authSetting</span> attribute for assigning user authentication. Alternatively, you can use the <span class="api-command-ref"><a href="#idpconfigurationid">idpConfigurationId</a></span> attribute for assigning user authentication. Do not use both.</p></li></ul></li><p><b>Notes:</b></p><ul><li>In cases where both attributes are supported, you can use the <span class="api-command-ref">authSetting</span> attribute or the <span class="api-command-ref">idpConfigurationId</span> attribute, but not both.</li><li>If neither <span class="api-command-ref">authSetting</span> nor <span class="api-command-ref">idpConfigurationId</span> attribute is specified, then <code>TableauIdWithMFA</code> (or in some cases <code>ServerDefault</code> if that option is still available for your site) is the authentication  assigned to the user.</li><li>If you see "Unspecified" as the authentication method for the user in Tableau Cloud or if the user is unable to sign in, use the <span class="api-command-ref">idpConfigurationId</span> attribute instead. For more information, see <a href="https://help.salesforce.com/s/articleView?id=004693708&amp;type=1" target="_blank">When adding users to Tableau Cloud via Rest API, the user's authentication method is listed as "Unspecified" and the user gets error "Remote IdP entity descriptor is not configured" on login attempt</a> knowledge article or skip to <a href="#idpconfigurationid" class="xref">idp-configuration-id</a>.</li></ul></ul><p>You can assign the following values for the <span class="api-command-ref">authSetting</span> attribute:</p><ul><li><code>SAML</code> - The user signs in using the identity provider (IdP) configured for the site.
											For Tableau Cloud configuration, see
											<a href="https://help.tableau.com/current/server/en-us/saml_site_specific.htm" rel="noreferrer" target="_blank">Enable SAML Authentication on a Site</a>.
											For Tableau Server, see
											<a href="https://help.tableau.com/current/server/en-us/saml_site_specific.htm" rel="noreferrer" target="_blank">Configure Site-Specific SAML</a>.
										</li><li><code>OpenID</code> - <i>Tableau Cloud only</i>: The user signs in using Google, Salesforce or OpenID&nbsp;Connect provider credentials.
											<code>OpenID</code> corresponds to Google, Salesforce, or&nbsp;OIDC&nbsp;authentication configuration in Tableau Cloud authentication settings.</li><li><code>TableauIDWithMFA</code> - <i>Tableau Cloud only</i>:&nbsp;The user signs in using a combination of TableauID credentials and a registered verification method. For more information, see <a href="https://help.tableau.com/current/online/en-us/security_auth.htm#mfa_requirement" target="_blank">About multi-factor authentication and Tableau Cloud</a>.</li><li><code>ServerDefault</code> - The user signs in using the default authentication method that's set for the server.
											For Tableau Cloud, if Tableau hasn't updated your site to require Tableau with MFA yet, you can continue to use this authentication type on a temporary basis. The <code>ServerDefault</code> value corresponds to <span class="api-command-ref">TableauID</span> in authentication
											settings. For Tableau Server, the
											<a href="https://help.tableau.com/current/server/en-us/saml.htm" rel="noreferrer" target="_blank">SAML</a>
											Server help page describes default authentication options.
</li></ul></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">identity-pool-name</span>
                                        </td>
                                        <td>
                              (Optional, Tableau Server only) When identity pools are configured, the name of the identity pool.
                                <p>Starting in API&nbsp;3.19, include the identity pool name when identity pools are configured and you need to add a user to an identity pool that uses the local identity store and OIDC authentication. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_identity_pools.htm" class="xref">Identity Pools Methods</a>.</p></td>
                                    </tr>
                                    <tr>
                                        <td><a name="idpconfigurationid"></a><span class="api-placeholder">idp-configuration-id</span>
                                        </td>
                                        <td>
                                            <p>(Optional, Tableau Cloud only) The configuration to assign for user authentication. Added in API 3.25 (January 2025).</p>
                                            <p>To find the <span class="api-command-ref">idpConfigurationId</span> attribute value, use the <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a> method.</p>
                                            <p><b>Notes:</b>
                                            </p>
                                            <ul>
                                                <li>In cases where both attributes are supported, you can use the <span class="api-command-ref">idpConfigurationId</span> attribute or the <span class="api-command-ref">authSetting</span> attribute, but not both. </li>
                                                <li>If neither <span class="api-command-ref">idpConfigurationId</span> nor <span class="api-command-ref">authSetting</span> attribute is  specified, then <code>TableauIdWithMFA</code> (or in some cases <code>ServerDefault</code> if that option is still available for your site) is the authentication assigned to the user.
</li>
                                            </ul>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">email-address</span>
                                        </td>
                                        <td>(Optional, Tableau Cloud only) The email address where the user can receive notifications. If no value is provided, Tableau Cloud uses the <code>username</code> value to send notifications to.
                                <p>Starting in API 3.26 (July 2025), you can specify an email address that is different from the username.</p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">language</span>
                                        </td>
                                        <td>
                                            <p>(Optional, Tableau Cloud only) Language (ISO 639-1) of the user. </p>
                                            <p>Starting in API&nbsp;3.28 (March 2026), you can set the user's default language in Tableau Cloud to a supported language (ISO 639-1). You can assign <b>one</b> of the following values: <span class="api-command-ref">de</span>, <span class="api-command-ref">en_GB</span>, <span class="api-command-ref">en</span>, <span class="api-command-ref">es</span>,<span class="api-command-ref"> fr_CA</span>, <span class="api-command-ref">fr</span>, <span class="api-command-ref">it</span>, <span class="api-command-ref">nl</span>, <span class="api-command-ref">pt</span>, <span class="api-command-ref">sv</span>, <span class="api-command-ref">th</span>, <span class="api-command-ref">ja</span>, <span class="api-command-ref">zh</span>, <span class="api-command-ref">zh_TW</span>, or <span class="api-command-ref">ko</span>.</p>
                                            <p><b>Important:</b> The language set using this attribute overrides the default site-wide invitation <a href="https://help.tableau.com/current/server/en-us/sites_add.htm#email_language" target="_blank">email language</a> that the site admin can set.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">locale</span>
                                        </td>
                                        <td>
                                            <p>(Optional, Tableau Cloud only) Locale of the user. </p>
                                            <p>Starting in API&nbsp;3.28 (March 2026), you can set the user's default locale to a supported locale. You can assign <b>one</b> of the following values: <span class="api-command-ref">ar_SA</span>, <span class="api-command-ref">ar_AE</span>, <span class="api-command-ref">ar_BH</span>, <span class="api-command-ref">ar_DZ</span>, <span class="api-command-ref">ar_EG</span>, <span class="api-command-ref">ar_IQ</span>, <span class="api-command-ref">ar_JO</span>, <span class="api-command-ref">ar_KW</span>, <span class="api-command-ref">ar_LB</span>, <span class="api-command-ref">ar_LY</span>, <span class="api-command-ref">ar_MA</span>, <span class="api-command-ref">ar_OM</span>, <span class="api-command-ref">ar_QA</span>, <span class="api-command-ref">ar_SD</span>, <span class="api-command-ref">ar_SY</span>, <span class="api-command-ref">ar_TN</span>, <span class="api-command-ref">ar_YE</span>, <span class="api-command-ref">be_BY</span>, <span class="api-command-ref">bg_BG</span>, <span class="api-command-ref">ca_ES</span>, <span class="api-command-ref">cs_CZ</span>, <span class="api-command-ref">da_DK</span>, <span class="api-command-ref">de_DE</span>, <span class="api-command-ref">de_AT</span>, <span class="api-command-ref">de_CH</span>, <span class="api-command-ref">de_LU</span>, <span class="api-command-ref">el_GR</span>, <span class="api-command-ref">el_CY</span>, <span class="api-command-ref">en_US</span>, <span class="api-command-ref">en_AU</span>, <span class="api-command-ref">en_CA</span>, <span class="api-command-ref">en_GB</span>, <span class="api-command-ref">en_IE</span>, <span class="api-command-ref">en_IN</span>, <span class="api-command-ref">en_MT</span>, <span class="api-command-ref">en_NZ</span>, <span class="api-command-ref">en_PH</span>, <span class="api-command-ref">en_SG</span>, <span class="api-command-ref">en_ZA</span>, <span class="api-command-ref">es_ES</span>, <span class="api-command-ref">es_AR</span>, <span class="api-command-ref">es_BO</span>, <span class="api-command-ref">es_CL</span>, <span class="api-command-ref">es_CO</span>, <span class="api-command-ref">es_CR</span>, <span class="api-command-ref">es_DO</span>, <span class="api-command-ref">es_EC</span>, <span class="api-command-ref">es_GT</span>, <span class="api-command-ref">es_HN</span>, <span class="api-command-ref">es_MX</span>, <span class="api-command-ref">es_NI</span>, <span class="api-command-ref">es_PA</span>, <span class="api-command-ref">es_PE</span>, <span class="api-command-ref">es_PR</span>, <span class="api-command-ref">es_PY</span>, <span class="api-command-ref">es_SV</span>, <span class="api-command-ref">es_US</span>, <span class="api-command-ref">es_UY</span>, <span class="api-command-ref">es_VE</span>, <span class="api-command-ref">et_EE</span>, <span class="api-command-ref">fi_FI</span>, <span class="api-command-ref">fr_FR</span>, <span class="api-command-ref">fr_BE</span>, <span class="api-command-ref">fr_CH</span>, <span class="api-command-ref">fr_LU</span>, <span class="api-command-ref">fr_CA</span>, <span class="api-command-ref">ga_IE</span>, <span class="api-command-ref">he_IL</span>, <span class="api-command-ref">hi_IN</span>, <span class="api-command-ref">hr_HR</span>, <span class="api-command-ref">hu_HU</span>, <span class="api-command-ref">id_ID</span>, <span class="api-command-ref">is_IS</span>, <span class="api-command-ref">it_IT</span>, <span class="api-command-ref">it_CH</span>, <span class="api-command-ref">ja_JP</span>, <span class="api-command-ref">ko_KR</span>, <span class="api-command-ref">lt_LT</span>, <span class="api-command-ref">lv_LV</span>, <span class="api-command-ref">mk_MK</span>, <span class="api-command-ref">ms_MY</span>, <span class="api-command-ref">mt_MT</span>, <span class="api-command-ref">nl_NL</span>, <span class="api-command-ref">nl_BE</span>, <span class="api-command-ref">no_NO</span>, <span class="api-command-ref">pl_PL</span>, <span class="api-command-ref">pt_BR</span>, <span class="api-command-ref">pt_PT</span>, <span class="api-command-ref">ro_RO</span>, <span class="api-command-ref">ru_RU</span>, <span class="api-command-ref">sk_SK</span>, <span class="api-command-ref">sl_SI</span>, <span class="api-command-ref">sq_AL</span>, <span class="api-command-ref">sr_RS</span>, <span class="api-command-ref">sr_BA</span>, <span class="api-command-ref">sr_ME</span>, <span class="api-command-ref">sv_SE</span>, <span class="api-command-ref">th_TH</span>, <span class="api-command-ref">tr_TR</span>, <span class="api-command-ref">uk_UA</span>, <span class="api-command-ref">vi_VN</span>, <span class="api-command-ref">zh_CN</span>, <span class="api-command-ref">zh_HK</span>, <span class="api-command-ref">zh_SG</span>, or <span class="api-command-ref">zh_TW</span>.</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:users:create
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

201

#### Response Body

```
<tsResponse>
  <user id="user-id"
   name="user-name"
   siteRole="site-role"
   authSetting="auth-setting"
   identityPoolName="identity-pool-name"
   idpConfigurationId="idp-configuration-id"
   email="email-address"
   language="langauge"
   locale="locale" />
</tsResponse>
```

#### Response Headers

Location: /api/3.29/sites/site-id/users/new-user-id

#### Version

Version 1.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400003</td>
                                        <td>Bad request</td>
                                        <td>The user authentication setting <code>ServerDefault</code> is not supported for you site. Try again using <code>TableauIDWithMFA</code> instead.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400013</td>
                                        <td>Invalid site role</td>
                                        <td>
                                            <p>The value of the <span class="api-command-ref">siteRole</span> attribute must be
											<span class="api-command-ref">Explorer</span>,
											<span class="api-command-ref">ExplorerCanPublish</span>,
											<span class="api-command-ref">SiteAdministratorCreator</span>,
											<span class="api-command-ref">SiteAdministratorExplorer</span>,
											<span class="api-command-ref">Unlicensed</span>,
											or <span class="api-command-ref">Viewer</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400217</td>
                                        <td>Unsupported language</td>
                                        <td>The specified language is not valid or not supported.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400218</td>
                                        <td>Unsupported locale</td>
                                        <td>The specified locale is not valid or not supported.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403193</td>
                                        <td>Forbidden</td>
                                        <td>A non-administrator user called this method or doesn't have permissions to update language for the user. </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403194</td>
                                        <td>Forbidden</td>
                                        <td>A non-administrator user called this method or doesn't have permissions to update locale for the user. </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404002</td>
                                        <td>User not found</td>
                                        <td>
                                    The server is configured to use Active Directory for authentication, and the username specified in the request body
                                    doesn't match an existing user in Active Directory.
                                </td>
                                    </tr>
                                    <tr>
                                        <td>405</td>
                                        <td>405000</td>
                                        <td>Invalid request method</td>
                                        <td>Request type was not <span class="api-command-ref">POST</span>.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409017</td>
                                        <td>User conflict</td>
                                        <td>The specified user already exists on the site.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409005</td>
                                        <td>Guest user conflict</td>
                                        <td>The Tableau Server API doesn't allow adding a user with the guest role to a site.</td>
                                    </tr>
                                    <tr>
                                        <td>500</td>
                                        <td>500109</td>
                                        <td>Internal language error</td>
                                        <td>The language request could not be completed.</td>
                                    </tr>
                                    <tr>
                                        <td>500</td>
                                        <td>500110</td>
                                        <td>Internal locale error</td>
                                        <td>The locale request could not be completed.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @add-user-to-site.xml`

- `MY-SERVER` is the name or IP address of your server.
- `9a8b7c6d5-e4f3-a2b1-c0d9-e8f7a6b5c4d` is the ID of the site to add the user to, as returned by a previous call to [Sign In](#sign_in).
- `12ab34cd56ef78ab90cd12ef34ab56cd` is the authentication returned by a previous call to [Sign In](#sign_in).

**Content of add-user-to-site.xml:**

```
<tsRequest>
  <user name="Adam"
    siteRole="Explorer" />
</tsRequest>
```

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"
    name="Adam"
    siteRole="Explorer"
    authSetting="ServerDefault"  />
</tsResponse>
```

## Create Group

Creates a group on a Tableau Cloud site or Tableau Server.

**Notes:**

- To add users to a group, call [Add User To Group](#add_user_to_group). To make changes to an existing group, call [Update Group](#update_group).
- After you create a group, the server updates its search index. If you make a query immediately to see the new group, the query results might not be up to date.

**Tableau Cloud**

The Create Group response returns information in two ways: in the response header and in the response body. The ID of the new group is always returned as the value of the Location header. If you create a local group immediately, the response body contains the name and ID of the new group.

**Tableau Server**

The Create Group response returns information in two ways: in the response header and in the response body. The ID of the new group is always returned as the value of the Location header. If you create a local group or import an Active Directory group immediately, the response body contains the name and ID of the new group. If you import an Active Directory group using a background process, the response body contains a <job> element that includes a job ID. You can use the job ID to check the status of the operation by calling [Query Job](#query_job).

If Tableau Server is configured to use Active Directory for authentication, this method can create a group and then import users from an Active Directory group. If you use the **Create Group** method to import users from an Active Directory, the import process can be performed immediately (synchronously) or as a background job (asynchronously). If Active Directory contains a large number of users, you should import them asynchronously; otherwise, the process can time out.

#### URI

POST /api/api-version/sites/site-id/groups

POST /api/api-version/sites/site-id/groups?asJob=asJob-value

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site to create the group in.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">asJob-value</span>
                                        </td>
                                        <td>
                                        A Boolean value that is used if you are importing from Active Directory. If you set this to <span class="api-command-ref">false</span> (the default), the import process runs as a synchronous process.
                                        If the Active Directory group contains many
                                        users, the process might time out before it finishes.
                                        <p>
                                        If you set this to <span class="api-command-ref">true</span>, the process runs asynchronously. In that case,
                                        Tableau Server starts a job to perform the import and returns the job ID in the <span class="api-command-ref">Location</span> header.
                                        You can check the status of the import job by calling <a href="#query_job"><span class="api-command-ref">Query Job</span></a>.
                                    </p><p class="note"><strong>Note</strong>: This parameter has no effect if the server is configured to use local authentication.</p><p>This attribute is available for Tableau Server only.</p></td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

**Creating a local group**

```
<tsRequest>
  <group name="new-tableau-server-group-name"
   minimumSiteRole="minimum-site-role"
   externalUserEnabled="on-demand-access"/>
</tsRequest>
```

**Notes:**

- When the request is to create a local group and minimumSiteRole is specified, users are granted a license using the grant license on-login mode by default.

**Importing a group from Active Directory** (Tableau Server only)

```
<tsRequest>
  <group name="active-directory-group-name" >
    <import source="ActiveDirectory"
      domainName="active-directory-domain-name"
      grantLicenseMode="license-mode"
      siteRole="minimum-site-role"/>
  </group>
</tsRequest>
```

**Notes:**

- When the request is to create a group with grantLicenseMode, a siteRole value should also be supplied.

- When the request body contains an <import> element, a Tableau Server configured to authenticate via Active Directory will create the group and modify the set of users in the group to be the same as those in Active Directory. The source attribute of the <import> element must be set to `ActiveDirectory`. If Tableau Server or Tableau Cloud site is configured to use local authentication, including an <import> element has no effect.

- When a group is created by importing from Active Directory, Tableau Server uses the value of the Active Directory `sAMAccountName` attribute as the user name.

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col style="width:32%;">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">new-tableau-server-group-name</span>
                                        </td>
                                        <td>
                                    The name for the new group.
                                </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">active-directory-group-name</span>
                                        </td>
                                        <td>
                                            <p>The name of the Active Directory group to import.</p>
                                            <p>This attribute is available for Tableau Server only.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">active-directory-domain-name</span>
                                        </td>
                                        <td>
                                            <p>The domain of the Active Directory group to import.</p>
                                            <p>This attribute is available for Tableau Server only.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">minimum-site-role</span>
                                        </td>
                                        <td>
                                            <p>Required if an <span class="api-placeholder">import</span> element or <span class="api-placeholder">grantLicenseMode</span>
									attribute are present in the request. For Tableau Server, the site role assigned to users who are imported from Active Directory or granted a
									license automatically using the grant license on-sync or on-login mode.
								</p>
                                            <p>
									If the requested user name matches an existing user in the group, the user either retains their existing role or are granted the one
									specified in the request, based on the role that enables the most capabilities. This is true whether the group the user belongs to is
									imported from Active Directory (Tableau Server only) or local.
								</p>
                                            <p>
									Site roles that can be assigned, listed from the one enabling the least capabilities to
									the most, are as follows.</p>
                                            <ol>
                                                <li value="1"><span class="api-command-ref">Unlicensed</span>
                                                    <br>
                                                </li>
                                                <li value="2"><span class="api-command-ref">Viewer</span>
                                                    <br>
                                                </li>
                                                <li value="3"><span class="api-command-ref">Explorer</span>
                                                    <br>
                                                </li>
                                                <li value="4"><span class="api-command-ref">ExplorerCanPublish</span>
                                                    <br>
                                                </li>
                                                <li value="5"><span class="api-command-ref">Creator</span>
                                                    <br>
                                                </li>
                                                <li value="6"><span class="api-command-ref">SiteAdministratorExplorer</span>
                                                </li>
                                                <li value="7"><span class="api-command-ref">SiteAdministratorCreator</span>
                                                    <br>
                                                </li>
                                            </ol>
                                            <p class="note"><strong>Note</strong>: You cannot use the REST API to set a user to be a Tableau Server administrator
								(<span class="api-command-ref">ServerAdministrator</span> site role).</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">license-mode</span>
                                        </td>
                                        <td>
                                            <p>
									The mode for automatically applying licenses for group members. When the mode is
									<span class="api-command-ref">onLogin</span>, a license is granted for each group member when they log in to a site.
								</p>
                                            <p>
									For local groups, the mode can be either <span class="api-command-ref">onLogin</span> or unset. If the attribute is omitted,
									the default mode is unset, which results in no licenses being granted automatically to group members.
								</p>
                                            <p>
									For groups that import an Active Directory domain, the mode can be either <span class="api-command-ref">onSync</span>
									or <span class="api-command-ref">onLogin</span>.
								</p>
                                            <p>
									The minimum role granted to users through <span class="api-placeholder">grantLicenseMode</span> is specified in the
									<span class="api-placeholder">siteRole</span> attribute. If that role has less permissions than an existing role
									assigned to the user, then the user's permissions remain unchanged.
								</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><a name="oda"></a><span class="api-placeholder">on-demand-access</span>
                                        </td>
                                        <td>
                                            <p>Optional. A boolean value that is used to enable on-demand access for embedded Tableau content when the Tableau Cloud site is licensed with <a href="https://help.tableau.com/current/online/en-us/license_product_keys.htm#embedded-analytics" target="_blank">Embedded Analytics</a> usage-based model or <a href="https://help.tableau.com/current/online/en-us/license_product_keys.htm#capacity" target="_blank">capacity-based model</a> with Cloud+ or Tableau+ edition. </p>
                                            <p>Set to <span class="api-command-ref">true</span> to enable the capability for the group or set to <span class="api-command-ref">false</span> to disable the capability for the group.  For more information about on-demand access, see <a href="https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html#on-demand-access-for-users" target="_blank">On-demand access for users</a> in the Tableau Embedding API v3 Help.</p>
                                            <p>This attribute is available for Tableau Cloud only starting from API version 3.21 (October 2023).
</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by Tableau Server administrators or Tableau Cloud site admins.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:create
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

201, for creating a local group and for importing immediately

202, for importing using a background process

#### Response Headers

Location: /api/3.29/sites/site-id/groups/new-group-id

#### Response Body

**Creating a local group:**

```
<tsResponse>
  <group id="new-group-id"
	name="group-name"
	minimumSiteRole="minimum-site-role"
	externalUserEnabled="true" />
	<import domainName="local" siteRole="default-site-role" grantLicenseMode="license-mode" />
  </group>
</tsResponse>
```

**Creating a group and importing from Active Directory immediately (Tableau Server only):**

```
<tsResponse>
  <group id="new-group-id"
    name="group-name">
	  <import domainName="active-directory-domain-name”
        siteRole="default-site-role"
	 grantLicenseMode="onLogin" />
  </group>
</tsResponse>
```

**Importing as a background process:**

```
<tsResponse>
  <job id="job-id" mode="Asynchronous" type="GroupImport"
    progress="0" createdAt="time-job-created" />
</tsResponse>
```

#### Version

Version 3.9 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400013</td>
                                        <td>Invalid site role</td>
                                        <td>
                                            <p>The value of the <span class="api-command-ref">minimumSiteRole</span> or <span class="api-command-ref">siteRole</span> attribute must be
									<span class="api-command-ref">Creator</span>,
									<span class="api-command-ref">Explorer</span>,
									<span class="api-command-ref">ExplorerCanPublish</span>,
									<span class="api-command-ref">SiteAdministratorCreator</span>,
									<span class="api-command-ref">SiteAdministratorExplorer</span>,
									<span class="api-command-ref">Unlicensed</span>,
									or <span class="api-command-ref">Viewer</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400019</td>
                                        <td>Malformed import element</td>
                                        <td>
                                When the <span class="api-command-ref">&lt;import&gt;</span> element is present in the request body, the following attributes must be specified:
                                <span class="api-command-ref">source</span> with the value <span class="api-command-ref">ActiveDirectory</span>;
								<span class="api-command-ref">domainName</span>;
								and  <span class="api-command-ref">siteRole</span>
								If any of these is missing, the element is malformed.
                             </td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400984</td>
                                        <td>Not licensed</td>
                                        <td>On-demand access can't be enabled if your site is not licensed with the usage-based model or capacity-based usage model with Tableau+ or Cloud+. </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403011</td>
                                        <td>Active Directory is not configured</td>
                                        <td>The <span class="api-command-ref">&lt;import&gt;</span> element is present, but Tableau Server is configured for local authentication.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404016</td>
                                        <td>Domain not found</td>
                                        <td>
                                    The request body includes an <span class="api-command-ref">&lt;import&gt;</span> element, but the specified domain name doesn't exist
                                    in Active Directory.
                                </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404017</td>
                                        <td>Active Directory group not found</td>
                                        <td>
                                    The request body includes an <span class="api-command-ref">&lt;import&gt;</span> element, but no group exists in
                                    Active Directory that matches the specified group name.
                                </td>
                                    </tr>
                                    <tr>
                                        <td>405</td>
                                        <td>405000</td>
                                        <td>Invalid request method</td>
                                        <td>Request type was not <span class="api-command-ref">POST</span>.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409009</td>
                                        <td>Group name conflict</td>
                                        <td>The group name in the request already belongs to the specified site.  For the purpose of uniqueness checks, group names are case-insensitive.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example: Local Group

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @create-local-group.xml`

**Content of create-local-group.xml:**

```
<tsRequest>
  <group name="marketing-group" externalUserEnabled="true" />
</tsRequest>
```

**Response header:**

`Location: /api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d5-e6f7-a8b9-c0d1-e2f3a4b5c6d`

**Response body:**

```
<tsResponse version-and-namespace-settings>
  <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" name="marketing-group" externalUserEnabled="true"/>
</tsResponse>
```

#### Example: Active Directory Group

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @create-ad-group.xml`

**Content of create-ad-group.xml:**

```
<tsRequest>
  <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" name="marketing-group">
    <import domainName="MY-DOMAIN" siteRole="Viewer" grantLicenseMode="onLogin" />
  </group>
</tsRequest>
```

**Response header:**

`Location: /api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d5-e6f7-a8b9-c0d1-e2f3a4b5c6d`

**Response body:**

```
<tsResponse version-and-namespace-settings>
  <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" name="marketing-group">
	  <import domainName="MY-DOMAIN" siteRole="Viewer" grantLicenseMode="onLogin" />
  </group>
</tsResponse>
```

## Create Group Set

Creates a group set with a specified name.

**Note**: You can't use this method to populate the group set with groups. After you create a group set and its ID is available, you can add a group to the group set by calling [Add Group to Group Set](#add_group_to_groupset).

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:create

- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

POST /api/api-version/sites/site-id/groupsets

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site to create the group in.</td></tr></tbody></table>

#### Request Body

Copy

```
<tsRequest>  <groupSet name="newGroupSet" /></tsRequest
```

Copy

```
{  "groupSet": {    "@name": "marketing-group"  }}
```

#### Request Attributes

<table class="api-parameters-table">
                            <colgroup>
                                <col class="api-parameters-table-col-1">
                                <col>
                            </colgroup>
                            <tbody>
                                <tr>
                                    <td><code>name</code>
                                    </td>
                                    <td>
                                        <p>
								(Required) Name of the new group set.</p>
                                    </td>
                                </tr>
                            </tbody>
                        </table>

#### cURL Request Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groupsets/" --header "Content-Type: application/xml" --header "X-Tableau-Auth: YqB9_MHoTHO26HGsFBFEBg|bQDOIH4MsqFGvUDYTrRYh633vrZHBt6d|a946d998-2ead-4894-bb50-1054a91dcab3" --data "<tsRequest> <groupSet name='marketing-group' /> </tsRequest>"`

#### Response Code

201, for creating a group set.

#### Response Body

Copy

```
<tsRequest>  <groupSet id="4123e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6234"     name="marketing-group"     groupCount="0" /></tsRequest>
```

Copy

```
{  "groupSet": {    "id": "4123e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6234",    "name": "marketing-group",    "groupCount": "0"  }}
```

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400013</td>
                                        <td>Invalid site role</td>
                                        <td>
                                            <p>The value of the <span class="api-command-ref">minimumSiteRole</span> or <span class="api-command-ref">siteRole</span> attribute must be
<span class="api-command-ref">SiteAdministratorCreator</span> or
									<span class="api-command-ref">SiteAdministratorExplorer</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>405</td>
                                        <td>405000</td>
                                        <td>Invalid request method</td>
                                        <td>The request type wasn’t <span class="api-command-ref">POST</span>.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409121</td>
                                        <td>Group set name conflict</td>
                                        <td>The group set name in the request already belongs to another group set.  For the purpose of uniqueness checks, group set names are case-insensitive.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Create SCIM Configuration

Creates the System for Cross-domain Identity Management Configuration (SCIM) configuration on the Tableau Cloud site.

The SCIM capability requires that you configure authentication for your Tableau Cloud site and associate the SCIM configuration with the authentication configuration. For more information about the SCIM capability in Tableau, see [SCIM](https://help.tableau.com/current/online/en-us/scim_config_online.htm) in the Tableau Cloud Help.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: `tableau:scim_configurations:create`

- Scope added in API 3.27 (Tableau Cloud December 2025)

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_, [access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps:_ [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

POST /api/api-version/sites/site-luid/scimConfigurations

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <scimConfiguration>
    <name>SCIM Contractors</name>
    <idpConfigurationId>d3b782da-0787-44ca-8585-6fd48dbfc658d3b782da-0787-44ca-8585-6fd48dbfc658</idpConfigurationId>
  </scimConfiguration>
</tsRequest>
```

```
{
"scimConfiguration": {
  "name": "SCIM Contractors",
  "idpConfigurationId": "d3b782da-0787-44ca-8585-6fd48dbfc658d3b782da-0787-44ca-8585-6fd48dbfc658"
  }
}
```

#### cURL Request Example

```
POST request: curl --location 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations \ --data '{ "scimConfiguration":{ "name": "SCIM Contractors","idpConfigurationId": "d3b782da-0787-44ca-8585-6fd48dbfc658d3b782da-0787-44ca-8585-6fd48dbfc658" } }'
```

#### Attribute Values

<table class="api-parameters-table">
                            <colgroup>
                                <col class="api-parameters-table-col-1-wide" style="width: 264px;">
                                <col>
                            </colgroup>
                            <tbody>
                                <tr>
                                    <td><span class="api-placeholder">name</span>
                                    </td>
                                    <td>(Required) Name of the SCIM&nbsp;configuration.</td>
                                </tr>
                                <tr>
                                    <td><span class="api-placeholder">idpConfigurationId</span>
                                    </td>
                                    <td>
                                        <p>(Required) Authentication configuration to associate with the SCIM&nbsp;configuration.
</p>
                                        <p>Starting in API 3.26, you can have  multiple SCIM&nbsp;configurations. Include the <span class="api-command-ref">idpConfigurationId</span> to identify which SAML&nbsp;authentication configuration to associate with this SCIM&nbsp;configuration. To get the <span class="api-command-ref">idpConfigurationId</span>, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a>.</p>
                                        <p>Starting in API&nbsp;3.28, you can associate OIDC or Google authentication with SCIM.</p>
                                    </td>
                                </tr>
                            </tbody>
                        </table>

#### Response Code

201

#### Response Body

```
<tsResponse>
  <scimConfiguration>
    <id>065693d8-436a-4738-a8f1-375953a2a888</id>
    <idpConfigurationId>95dcdf3b-30eb-42ae-b938-7ffca3e11fdc</idpConfigurationId>
    <isApiTokenActive>false</isApiTokenActive>
    <isOwner>true</isOwner>
    <name>SCIM Contractors</name>
    <createdAt>Tue Apr 01 06:31:47 UTC 2025</createdAt>
  </scimConfiguration>
</tsResponse>
```

```
{
  "scimConfiguration": {
    "id": "065693d8-436a-4738-a8f1-375953a2a888",
    "idpConfigurationId": "95dcdf3b-30eb-42ae-b938-7ffca3e11fdc",
    "isApiTokenActive": false,
    "isOwner": true,
    "name": "SCIM Contractors",
    "createdAt": "Tue Apr 01 06:31:47 UTC 2025"
  }
}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, contains malformed XML, or the <code>idpConfigurationId</code> is not valid.</td></tr><tr><td>400</td><td>400008</td><td>Bad Request</td><td>The content of the request body is missing the SCIM configuration name, contains unsupported attributes, or the <code>idpConfigurationId</code> is missing.</td></tr><tr><td>400</td><td>400802</td><td>Bad Request</td><td>The maximum number of 20 SCIM configurations for the site has been reached.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Create SCIM Token

Generates the System for Cross-domain Identity Management (SCIM) token and secret.

You must be the user who created the SCIM configuration to generate the associated SCIM token. After the SCIM token is generated, ensure the SCIM token's secret is added to the identity provider's (IdP's) SCIM settings.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: Not available

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_, and access scopes for_ [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

POST /api/api-version/sites/site-luid/scimConfigurations/scim-configuration-id/apiToken

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">scim-configuration-id</span></td><td>The UUID of the SCIM configuration. To get the SCIM&nbsp;configuration UUID, see <a href="#list_scim_configurations">List SCIM Configurations</a>.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

```
POST request: curl --location 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations/065693d8-436a-4738-a8f1-375953a2a888/apiToken' 
```

#### Response Code

201

#### Response Body

```
<tsResponse>
  <id>065693d8-436a-4738-a8f1-375953a2a888</id>
  <clientName>SCIM_CLIENT_API_TOKEN:d3b782da-0787-44ca-8585-6fd48dbfc658</clientName>
  <secret>hqh8YEoYQ1enO9t9Z3h1xA==:X_jndRxNXuWKIXIUbvSGEvysnnSK6B7pt62GiWd8Vuw=</secret>
</tsResponse>
```

```
{
  "apiToken": {
    "id": "065693d8-436a-4738-a8f1-375953a2a888",
    "clientName": "SCIM_CLIENT_API_TOKEN:d3b782da-0787-44ca-8585-6fd48dbfc658",
    "secret": "hqh8YEoYQ1enO9t9Z3h1xA==:X_jndRxNXuWKIXIUbvSGEvysnnSK6B7pt62GiWd8Vuw="
  }
}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad Request</td><td>The content of the request body is missing or incomplete, or contains malformed XML.</td></tr><tr><td>400</td><td>400802</td><td>Bad Request</td><td>The SCIM&nbsp;configuration is already associated with a SCIM&nbsp;token. To generate a new token for the SCIM configuration, first delete the associated SCIM&nbsp;token and try again.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr><tr><td>403</td><td>403182</td><td>Forbidden</td><td>A SCIM token can only be generated by the user who created the SCIM&nbsp;configuration.</td></tr><tr><td>404</td><td>404057</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration ID is not valid.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete Group

Deletes the group on a specific site. Deleting a group does not delete the users in group, but users are no longer members of the group. Any permissions that were previously assigned to the group no longer apply.

**Note**: You cannot delete the All Users group.

#### URI

DELETE /api/api-version/sites/site-id/groups/group-id

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the project.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The ID of the group to delete.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can be called by site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 2.1 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID or URL namespace in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the URI doesn't correspond to an existing group or the group is not part of the specified site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

The response contains no body (data) for a successful delete operation. The HTTP response code is 204 if the delete operation succeeded.

## Delete Group Set

Deletes the group set on a specific site. Deleting a group set doesn’t delete the users in the group set, but users are no longer members of the group set. Any permissions that were previously assigned to the group set no longer apply.

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:delete

- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

DELETE /api/api-version/sites/site-id/groupsets/group-set-id

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the project.</td></tr><tr><td><span class="api-placeholder">group-set-id</span></td><td>The ID of the group set to delete.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groupsets/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

The response contains no body (data) for a successful delete operation. The HTTP response code is 204 if the delete operation succeeded.

#### Response Code

204

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID or URL namespace in the URI doesn't correspond to an existing site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type wasn’t <span class="api-command-ref">DELETE</span>.</td></tr><tr><td>409</td><td>409120</td><td>Group set not found</td><td>The group set ID in the URI doesn't correspond to an existing group set or the group set isn’t part of the specified site.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete SCIM Configuration

Permanently removes the System for Cross-domain Identity Management (SCIM) configuration from the Tableau Cloud site.

Deleting the SCIM configuration deletes the associated SCIM token. You must be the user who created the SCIM configuration to delete the SCIM configuration unless the creator of the SCIM configuration is no longer a member of the site. After the SCIM configuration is deleted, ensure the SCIM token's secret is also removed from the identity provider's (IdP's) SCIM settings.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: `tableau:scim_configurations:delete`

- Scope added in API 3.27 (Tableau Cloud December 2025)

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_, [access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps:_[Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

DELETE /api/api-version/sites/site-luid/scimConfigurations/scim-configuration-id

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">scim-configuration-id</span></td><td>The UUID of the SCIM configuration. To get the SCIM&nbsp;configuration UUID, see <a href="#list_scim_configurations">List SCIM Configurations</a>.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

```
DELETE request: curl --location --request DELETE 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations/065693d8-436a-4738-a8f1-375953a2a888'
```

#### Response Code

204

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr><tr><td>403</td><td>403182</td><td>Forbidden</td><td>The SCIM&nbsp;configuration can only be deleted by the user who created the SCIM&nbsp;configuration.</td></tr><tr><td>404</td><td>404057</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration cannot be deleted because it does not exist on this site.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete SCIM Token

Permanently removes the System for Cross-domain Identity Management (SCIM) token.

You must be the user that created the SCIM configuration to delete the associated SCIM token unless the creator of the SCIM configuration is no longer a member of the site. After the SCIM token is deleted, ensure the SCIM token's secret is also removed from the identity provider's (IdP's) SCIM settings.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: `tableau:scim_api_tokens:delete`

- Scope added in API 3.27 (Tableau Cloud December 2025)

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_, [access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps:_[Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

DELETE /api/api-version/sites/site-luid/scimConfigurations/scim-configuration-id/apiToken

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">scim-configuration-id</span></td><td>The UUID of the SCIM configuration. To get the SCIM&nbsp;configuration UUID, see <a href="#list_scim_configurations">List SCIM Configurations</a>.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

```
DELETE request: curl --location --request DELETE 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations/065693d8-436a-4738-a8f1-375953a2a888/apiToken'
```

#### Response Code

204

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr><tr><td>404</td><td>404050</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration does not have an associated SCIM&nbsp;token.</td></tr><tr><td>404</td><td>404057</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration ID is not valid.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Delete Users from Site with CSV

Creates a job to remove a list of users, specified in a .csv file, from a site.

The .csv file should comply with the rules described in one of the following topics:

- For Tableau Cloud - [CSV Import File Guidelines](https://help.tableau.com/current/online/en-us/csvguidelines.htm)
- For Tableau Server - [CSV Import File Guidelines](https://help.tableau.com/current/server/en-us/csvguidelines.htm)

#### URI

POST /api/_api-version_/sites/_site-id_/users/delete

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><i>api-version</i></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><i>site-id</i></td><td>The ID of the site that users are being deleted from.</td></tr></tbody></table>

#### Request Body

Because this method involves a file that is external to Tableau a multi-part request is required. For more information on multi-part requests, See [Importing CSV files with Multipart Requests](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_fundamentals.htm#multipart_requests).

```
--boundary-string
Content-Disposition: form-data; name=\"tableau_user_delete\"; filename=\"users.csv\"
Content-Type: text/csv
--boundary-string--
```

#### Permissions

This method can only be called by server and site administrators.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:users:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 3.15 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request payload is missing or incomplete, or contains malformed XML.</td></tr><tr><td>500</td><td>500000</td><td>Internal Server Error</td><td>The request could not be completed.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

```
curl -X POST \
http://10.108.21.238//api/3.15/sites/8aa3291f-1b5a-4f52-a3be-6512661f574d/users/delete \
-H 'cache-control: no-cache' \
-H 'content-type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW' \
-H 'x-tableau-auth: AVjAKZb3SQimzoqyMmQXEg|9OSHQrwCXF83SIR2XCuDEK91AM7v3FZr' \
-F tableau_user_delete=@users.csv
```

## Download User Credentials

Gets credentials for a user who is being migrated to another Tableau Cloud or Tableau Server site.

Before you use this method, you must create public and private keys for resources with embedded credentials. For more information, see [Migrate Workbooks and Data Sources with Embedded Credentials](https://help.tableau.com/current/server/en-us/cmt-migration_embedded_credentials.htm).

**Version:** Available in API 3.23 (Tableau Cloud June 2024/ Tableau Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Cloud and Tableau Server admins.   _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:oauth\_credentials:download

- Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).
- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

POST /api/api-version/sites/site-luid/users/user-luid/retrieveSavedCreds

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">user-luid</span></td><td>The LUID of the user whole credentials you want to download.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <destinationSiteUrlNamespace>site1</destinationSiteUrlNamespace>
  <destinationSiteLuid>d56023b5-8f8b-4241-aa74-8974ced85827</destinationSiteLuid>
  <destinationServerUrl>http://example.com</destinationServerUrl>
</tsRequest>
```

```
{
  "destinationSiteUrlNamespace": "site1",
  "destinationSiteLuid": "d56023b5-8f8b-4241-aa74-8974ced85827",
  "destinationServerUrl": "http://localhost"
}
```

#### Request Attributes

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><code>destinationSiteUrlNamespace</code>
                                        </td>
                                        <td>
                                            <p>
								(Required) The site name on Tableau Cloud.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><code>destinationSiteLuid</code>
                                        </td>
                                        <td>(Required) &nbsp;The site ID on Tableau Cloud.</td>
                                    </tr>
                                    <tr>
                                        <td><code>destinationServerUrl</code>
                                        </td>
                                        <td>
                                            <p>(Required) The destination Tableau Cloud URL.</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### cURL Request Example

```
curl --location "https://example.org/api/3.24/sites/7a2f773d-4a9f-496e-afc6-a60517cb1b86/workbooks/1a1b1c1d-2e2f-2a2b-3c3d-3e3f4a4b4c4d/retrieveKeychain"  --header "Content-Type: application/xml"  --header "X-Tableau-Auth: nbQAstTxTHuBlcMlXZ3QKg|LXn5aiYcffck999kgpOPrQft5JkvRsYg|7a2f773d-4a9f-496e-afc6-a60517cb1b86"  --data "<tsRequest>   <destinationSiteUrlNamespace>site1</destinationSiteUrlNamespace>    <destinationSiteLuid>9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d</destinationSiteLuid>   <destinationServerUrl>http://example.com</destinationServerUrl>  </tsRequest>"
```

#### Response Code

200

#### Response Body

```
<tsResponse xmlns="http://tableau.com/api" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://tableau.com/api https://help.tableau.com/samples/en-us/rest_api/ts-api_3_24.xsd">
    <associatedUserLuidList/>
    <encryptedKeychainList>
        <encryptedKeychain>BADsJ5lBKho2Tdqqbo7txS8IyGlBu9LiRyb8etCHJLhBUurgIRHk3g5AeMQg6KHBw+6nwNIDEd65MKi76DLd5aIMhQC5aLCR4NE7R2gp7JbxLo+nOMGnfDQm5XekJVpLQGfY53GIX52ED2iTfOQ0yRNbnPV4djT0z23rosG0gpmqXV/GlBu9LiRyb8wx8RisnZdvv+SAlv222jVhksX1w5A6HB3Bs45BeWfpwrOnHwnNoWUGwHuu4iGlyE7m65RlATZN+fvDGOFN1zU2lXaSZyWqRKiWkD+oGlBu9LiRyb8Gz7RnesKvH6QEL9sT8cXA1ZOEA531xNAv9rjazEP5BssIdA1GcJ5J7zar5xxC68qm3cz3MkndyqWXZrf0vWPgwysUHEpWn60oDG/8/xG6c0Eigh4gwE+dA+NF1GlBu9LiRyb8+AzJ7vatf95LDwAuRT43G3Q+WApx9qBPXco15pKjwy00rHPgn4cRtu+unwh6d3gIh6AbK6X++U/vV/Ktpe31lSZmV8eHPeTNfdCrGOT9ozZhF5oKGlBu9LiRyb8tf1YcXawh3bvtZxg9d8a2mKNXDeaF+uJrpI43aFa4KrJKdfvDpq2k0aJhL1QNxWSFBYw0tPJX/rhKAeOHHY2K44Wh5JNWwL+x1uYap93IK303sJ1GlBu9LiRyb8UhfIW7o5iUtbYWrpCvVwubZLf4U5Y=
        <encryptedKeychain>
	</encryptedKeychainList>
</tsResponse>
```

```
{
  "associatedUserLuidList": [],
  "encryptedKeychainList": {
    "encryptedKeychain": "BADsJ5lBKho2Tdqqbo7txS8IyGlBu9LiRyb8etCHJLhBUurgIRHk3g5AeMQg6KHBw+6nwNIDEd65MKi76DLd5aIMhQC5aLCR4NE7R2gp7JbxLo+nOMGnfDQm5XekJVpLQGfY53GIX52ED2iTfOQ0yRNbnPV4djT0z23rosG0gpmqXV/GlBu9LiRyb8wx8RisnZdvv+SAlv222jVhksX1w5A6HB3Bs45BeWfpwrOnHwnNoWUGwHuu4iGlyE7m65RlATZN+fvDGOFN1zU2lXaSZyWqRKiWkD+oGlBu9LiRyb8Gz7RnesKvH6QEL9sT8cXA1ZOEA531xNAv9rjazEP5BssIdA1GcJ5J7zar5xxC68qm3cz3MkndyqWXZrf0vWPgwysUHEpWn60oDG/8/xG6c0Eigh4gwE+dA+NF1GlBu9LiRyb8+AzJ7vatf95LDwAuRT43G3Q+WApx9qBPXco15pKjwy00rHPgn4cRtu+unwh6d3gIh6AbK6X++U/vV/Ktpe31lSZmV8eHPeTNfdCrGOT9ozZhF5oKGlBu9LiRyb8tf1YcXawh3bvtZxg9d8a2mKNXDeaF+uJrpI43aFa4KrJKdfvDpq2k0aJhL1QNxWSFBYw0tPJX/rhKAeOHHY2K44Wh5JNWwL+x1uYap93IK303sJ1GlBu9LiRyb8UhfIW7o5iUtbYWrpCvVwubZLf4U5Y="
  }
}
```

#### Errors

<table class="api-error-table">
                        <colgroup>
                            <col class="api-error-table-col-1">
                            <col class="api-error-table-col-2">
                            <col class="api-error-table-col-3">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <th>HTTP status</th>
                                <th><code>error</code> Code</th>
                                <th>Condition</th>
                                <th>Details</th>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400000</td>
                                <td>Bad Request</td>
                                <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                            </tr>
                            <tr>
                                <td>401</td>
                                <td>401002</td>
                                <td>Unauthorized Access</td>
                                <td>
                                    <p>The authentication token provided in the request header was invalid or has expired.</p>
                                </td>
                            </tr>
                            <tr>
                                <td>403</td>
                                <td>403054</td>
                                <td>Unauthorized Access</td>
                                <td>A non-administrator user attempted to get data source revision information, but the caller doesn't have sufficient permissions.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404000</td>
                                <td>Site not found</td>
                                <td>The site ID in the URI doesn't correspond to an existing site.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404002
                    </td>
                                <td>User not found</td>
                                <td>The user ID in the URI doesn't correspond to an existing user.</td>
                            </tr>
                            <tr>
                                <td>405</td>
                                <td>405000</td>
                                <td>Invalid request method</td>
                                <td>Request type was not <span class="api-command-ref">POST</span>.</td>
                            </tr>
                        </tbody>
                    </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Get Groups for a User

Gets a list of groups of which the specified user is a member.

#### URI

GET /api/api-version/sites/site-id/users/user-id/groups

GET /api/api-version/sites/site-id/users/user-id/groups?pageSize=page-size&pageNumber=page-number

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group.</td></tr><tr><td><span class="api-placeholder">user-id</span></td><td>The ID of the user whose group memberships are listed.</td></tr><tr><td><span class="api-placeholder">page-size</span></td><td>(Optional) The number of items to return in one response. The minimum is 1. The maximum is 1000. The default is 100. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">page-number</span></td><td>(Optional) The offset for paging. The default is 1. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:users:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
  <pagination pageNumber="pageNumber"
    pageSize="page-size"
    totalAvailable="total-available" />
  <groups>
    <group id="group-id" name="group-name" >
    	<domain name="group-domain-name"/>
	</group>
    <!--      . . . additional groups ...      -->
  </groups>
</tsResponse>
```

**Notes:**

- Starting in July 2026 (version 3.29), the externalUserEnabled attribute (Tableau Cloud only) is omitted from the <group> element in the response if the site isn't licensed for on-demand access.

#### Version

Version 3.7 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400006</td><td>Invalid page number</td><td>The page number parameter is not an integer, is less than one, or is greater than the final page number for data sources at the requested page size.</td></tr><tr><td>400</td><td>400007</td><td>Invalid page size</td><td>The page size parameter is not an integer, or is less than one.</td></tr><tr><td>403</td><td>403014</td><td>Page size limit exceeded</td><td>The specified page size is larger than the maximum page size.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404012</td><td>User not found</td><td>The group ID in the URI doesn't correspond to an existing user.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/groups" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <pagination pageNumber="1" pageSize="100" totalAvailable="2"/>
  <groups>
    <group id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" name="All Users" >
	  <domain name="mydomain"/>
	</group>
	<group id="4123e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6234" name="Researchers" >
	  <domain name="mydomain"/>
    </group>
  </groups>
</tsResponse>
```

## Get Group Set

Returns information about the specified group set including ID, name, and member groups.

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:read

- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

GET /api/api-version/sites/site-id/groupsets/group-set-id

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group.</td></tr><tr><td>group-set-id</td><td>The ID&nbsp;of the group set you want information for.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groupsets/8cf3b6c1-839f-4eae-b41f-2144165193f2" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Code

200

#### Response Body

Copy

```
<tsResponse version-and-namespace-settings>  <groupSet id="8cf3b6c1-839f-4eae-b41f-2144165193f2" name="All Users" groupCount="2">    <group id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d"        name="All Users" >    </group>    <group id="4123e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6234"       name="Researchers" >    </group>  </groupSet></tsResponse>
```

Copy

```
{  "groupSet": {    "id": "8cf3b6c1-839f-4eae-b41f-2144165193f2",    "name": "All Users",    "groupCount": "2",    "group": [      {        "id": "9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d",        "name": "All Users"      },      {        "id": "4123e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6234",        "name": "Researchers"      }    ]  }}
```

#### Version

Version 3.22 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>The request type wasn’t <span class="api-command-ref">GET</span>.</td></tr><tr><td>409</td><td>409120</td><td>Group set not found</td><td>The group set ID in the request body doesn't correspond to an existing group set.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Get SCIM Configuration

Gets the System for Cross-domain Identity Management (SCIM) configuration on the Tableau Cloud site.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: `tableau:scim_configurations:read`

- Scope added in API 3.27 (Tableau Cloud December 2025)

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_, [access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps_[Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

GET /api/api-version/sites/site-luid/scimConfigurations/scim-configuration-id

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">scim-configuration-id</span></td><td>The UUID of the SCIM configuration. To get the SCIM&nbsp;configuration UUID, see <a href="#list_scim_configurations">List SCIM Configurations</a>.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

```
GET request: curl --location 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations/065693d8-436a-4738-a8f1-375953a2a888'
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <scimConfiguration>
    <id>065693d8-436a-4738-a8f1-375953a2a888</id>
    <idpConfigurationId>95dcdf3b-30eb-42ae-b938-7ffca3e11fdc</idpConfigurationId>
    <isApiTokenActive>false</isApiTokenActive>
    <isOwner>false</isOwner>
    <name>SCIM Contractors</name>
    <createdAt>2025-03-27 11:07:49.129</createdAt>
    </scimConfiguration>
</tsResponse>
```

```
{
  "scimConfiguration": {
    "id": "065693d8-436a-4738-a8f1-375953a2a888",
    "idpConfigurationId": "95dcdf3b-30eb-42ae-b938-7ffca3e11fdc",
    "isApiTokenActive": false,
    "isOwner": false,
    "name": "SCIM Contractors",
    "createdAt": "2025-03-27 11:07:49.129"
  }
}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr><tr><td>404</td><td>404057</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration UUID is not valid.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Get Users in Group

Gets a list of users in the specified group.

#### URI

GET /api/api-version/sites/site-id/groups/group-id/users

GET /api/api-version/sites/site-id/groups/group-id/users?pageSize=page-size&pageNumber=page-number

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The ID of the group to get the users for.</td></tr><tr><td><span class="api-placeholder">page-size</span></td><td>(Optional) The number of items to return in one response. The minimum is 1. The maximum is 1000. The default is 100. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">page-number</span></td><td>(Optional) The offset for paging. The default is 1. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
  <pagination pageNumber="pageNumber"
    pageSize="page-size"
      totalAvailable="total-available" />
	    <users>
	      <user id="user-id"
	    name="user-name"
	    siteRole="site-role"
	    lastLogin="last-login-date-time"
	    externalAuthUserId="authentication-id-from-external-provider"
		language="language-code"
		locale="locale-code" />
	    ... additional user information ...
   </users>
</tsResponse>
```

The siteRole value is returned as one of the following values: Creator, Explorer, ExplorerCanPublish, ServerAdministrator, SiteAdministratorExplorer, SiteAdministratorCreator, Unlicensed, ReadOnly, or Viewer.

The externalAuthUserId value is returned for Tableau Cloud; it represents ID stored in Tableau's single sign-on (SSO) system. For other server configurations, this field contains null, and the value of lastLogin is an empty string.

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400006</td><td>Invalid page number</td><td>The page number parameter is not an integer, is less than one, or is greater than the final page number for data sources at the requested page size.</td></tr><tr><td>400</td><td>400007</td><td>Invalid page size</td><td>The page size parameter is not an integer, or is less than one.</td></tr><tr><td>403</td><td>403014</td><td>Page size limit exceeded</td><td>The specified page size is larger than the maximum page size.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the URI doesn't correspond to an existing group.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/users" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <pagination pageNumber="1" pageSize="100" totalAvailable="2"/>
  <users>
    <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" name="Adam" siteRole="Explorer" />
    <user id="59a8a7b6-be3a-4d2d-1e9e-08a7b6b5b4ba" name="Bob" siteRole="ExplorerCanPublish"
	language="en-GB" locale="GB" />
  </users>
</tsResponse>
```

## Get Users on Site

Returns the users associated with the specified site.

#### URI

GET /api/api-version/sites/site-id/users

GET /api/api-version/sites/site-id/users?filter=filter-expression

GET /api/api-version/sites/site-id/users?sort=sort-expression

GET /api/api-version/sites/site-id/users?pageSize=page-size&pageNumber=page-number

GET /api/api-version/sites/site-id/users?fields=field-expression

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the users.</td></tr><tr><td><span class="api-placeholder">filter-expression</span></td><td>(Optional) An expression that lets you specify a subset of users to return. You can filter on predefined fields such as <code>name</code> and <code>lastLogin</code>. You can include multiple filter expressions. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_filtering_and_sorting.htm">Filtering and Sorting</a>.</td></tr><tr><td><span class="api-placeholder">sort-expression</span></td><td>(Optional) An expression that lets you specify the order in which user information is returned. If you do not specify a sort expression, the sort order of the information that's returned is undefined. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_filtering_and_sorting.htm">Filtering and Sorting</a>.</td></tr><tr><td><span class="api-placeholder">page-size</span></td><td>(Optional) The number of items to return in one response. The minimum is 1. The maximum is 1000. The default is 100. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">page-number</span></td><td>(Optional) The offset for paging. The default is 1. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">field-expression</span></td><td>(Optional) An expression that lets you specify the set of available fields to return. You can qualify the return values based upon predefined keywords such as <code>_all_</code> or <code>_default_</code>, and you can specify individual fields for the views or other supported resources. You can include multiple field expressions in a request. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_fields.htm">Using Fields in the REST API</a>.</td></tr></tbody></table>

**Note**: The filter and sort parameters can be combined with each other and with paging parameters and fields parameters using an ampersand **`&`**.

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:users:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
   <pagination pageNumber="page-number"
     pageSize="page-size"
     totalAvailable="total-available" />
   <users>
    <user email="email"
      id="user-id"
      fullName="full-name"
      name="user-name"
      siteRole="site-role"
      lastLogin="date-time"
      externalAuthUserId="authentication-id-from-external-provider"
      authSetting="auth-setting"
	   idpConfigurationId="idp-configuration-id"
      language="language-code"
      locale="locale-code">
        <domain name="domain-name" />
    </user>
    <user email="email"
      id="user-id"
      fullName="full-name"
      name="user-name"
      siteRole="site-role"
      lastLogin="date-time"
      externalAuthUserId="authentication-id-from-external-provider"
      authSetting="auth-setting"
	   idpConfigurationId="idp-configuration-id"
      language="language-code"
      locale="locale-code">
        <domain name="domain-name"/>
    </user>

  </users>
</tsResponse>
```

**Notes:**

- The siteRole value is returned as one of the following values: Creator, Explorer, ExplorerCanPublish, ServerAdministrator, SiteAdministratorExplorer, SiteAdministratorCreator, Unlicensed, ReadOnly, or Viewer.
- The externalAuthUserId value is returned for Tableau Cloud only; it represents ID stored in Tableau's single sign-on (SSO) system. For other server configurations, this field contains null, and the value of lastLogin is an empty string.
- The authSetting attribute is only returned if you are using Tableau Server with site-specific SAML enabled, or Tableau Cloud with either SAML or OpenID Connect enabled.
- Starting in API 3.24, **idpConfigurationId** indicates the authentication method assigned to the user in Tableau Cloud only.
- When Tableau Cloud returns domain name, it indicates the authentication type of the user. When Tableau Server returns domain name, it indicates the domain of the user.

#### Version

Version 1.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400006</td><td>Invalid page number</td><td>The page number is not an integer, is less than one, or is greater than the final page number for users at the requested page size.</td></tr><tr><td>400</td><td>400007</td><td>Invalid page size</td><td>The page size parameter is not an integer, or is less than one.</td></tr><tr><td>403</td><td>403014</td><td>Page size limit exceeded</td><td>The specified page size is larger than the maximum page size.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <pagination pageNumber="1" pageSize="100" totalAvailable="161"/>
  <users>
    <user email="alex@example.com"
      id="9f9e9d9c8-b8a8-f8e7-d7c7-b7a6f6d6e6d"
      fullName="Alex Smith" name="Alex"
      siteRole="Viewer" language="en-GB" locale="GB">
        <domain name="tsi.lan" />
    </user>
    <user email="jannaj@example.org"
      id="12ab34cd5-6ef7-8ab9-0cd1-2ef34ab56cd"
      fullName="Janna Johnson" name="Janna"
      siteRole="Unlicensed"  language="en-GB" locale="GB" idpConfigurationId="00000000-0000-0000-0000-0000000000">
        <domain name="tsi.lan" />
    </user>
    <user email="fred.zuzuki@example.net"
      id="9a8a7b6b5-c4c3-d2d1-e0e9-a8a7b6b5b4b"
      fullName="Fred Suzuki" name="Fred"
      siteRole="ExplorerCanPublish" language="en-GB" locale="GB" idpConfigurationId="b2207590-024c-4a6e-ac4a-eca6eefabb2e">
        <domain name="tsi.lan" />
    </user>

    ... more users ...
  </users>
</tsResponse>
```

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users?filter=siteRole:eq:Unlicensed&sort=name:asc" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

This example includes a filter to return the users whose site role is Unlicensed and specifies that the results should be sorted by the name value.

## Import Users to Site from CSV

Creates a job to import the users listed in a specified .csv file to a site, and assign their roles and authorization settings.

The .csv file should comply with the rules described in one of the following topics:

- For Tableau Cloud - [CSV Import File Guidelines](https://help.tableau.com/current/online/en-us/csvguidelines.htm)
- For Tableau Server - [CSV Import File Guidelines](https://help.tableau.com/current/server/en-us/csvguidelines.htm)

#### URI

POST api/_api-version_/sites/_site-id_/users/import

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The unique ID of the site asset.</td></tr></tbody></table>

#### Request Body

Because this method involves a file that is external to Tableau a multi-part request is required. For more information on multi-part requests, See [Importing CSV files with Multipart Requests](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_fundamentals.htm#multipart_requests).

```
--boundary-string
Content-Disposition: name="tableau_user_import"
Content-Type: file
path_to_csv
--boundary-string
Content-Disposition: name="request_payload"
Content-Type: text/xml
<tsRequest>
  <user
    name="user-name"
	authSetting="auth-setting"
	idpConfigurationId="idp-configuraion-id" />
  <!--    more users    -->
</tsRequest>
--boundary-string--
```

A `request-payload` without user name or authSetting is valid, but must be present in the request in the form: `<tsRequest><user /></tsRequest>`.

#### Attribute Values

<table class="api-parameters-table">
                        <colgroup>
                            <col class="api-parameters-table-col-1-extra-wide">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <td><span class="api-placeholder">path-to-csv</span>
                                </td>
                                <td>The file path to the .csv list users to be imported.</td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">user-name</span>
                                </td>
                                <td>
                                    <p>(Optional) The name of the user. If the server uses local authentication, this can be any name. If you are using
							Active Directory authentication, or if you are using Tableau Cloud, there are specific requirements for the name.</p>
                                    <p><b>Tableau Server</b>
                                        <br>If Tableau Server uses Active Directory authentication, this must be the name of an existing
							user in Active Directory. If the user name is not unique across domains, you must include the
							domain as part of the user name (for example, <span class="uicontrol">example\Adam</span> or
							<span class="uicontrol">adam@example.com</span>).</p>
                                    <p class="note"><strong>Note:</strong> Active Directory specifies a user name using two attributes: <code>sAMAccountName</code>
							and <code>userPrincipalName</code> (UPN) prefix. For most Active Directory users, these attributes are the same. By default,
							if you are adding a user from Active Directory, the name that you provide in the <span class="api-placeholder">user-name</span>
							is matched against the Active Directory <code>sAMAccountName</code> attribute, which becomes the name that the user signs in to
							Tableau Server with.

						<br><br>Two exceptions are when the name that you provide: is longer than 20 characters; and includes an <code>@</code> character.
							In these cases, Tableau imports the user using the Active Directory UPN. For more information, see
			<a href="https://msdn.microsoft.com/en-us/library/ms677605(v=vs.85).aspx" rel="noopener" target="_blank">User Naming Attributes</a> on
							the MSDN site.	</p>
                                    <p><b>Tableau Cloud</b>
                                        <br>The <span class="api-placeholder">user-name</span> is the email address that the
							user will use to sign in to Tableau Cloud. When you add a user to the site, Tableau Cloud sends an  email invitation.
							The user can click the link in the invitation to sign in and update their full name and password.</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">auth-setting</span>
                                </td>
                                <td>
                                    <p><b>Tableau Server</b>
                                    </p>
                                    <p>The <span class="api-command-ref">authSetting</span> attribute only applies when updating users on sites with site-specific SAML-enabled settings.</p>
                                    <p><b>Tableau Cloud</b>
                                    </p>
                                    <p>The ability to create and enable multiple authentication methods simultaneously was introduced in API 3.25 (January 2025). As a result of this capability, consider the following:</p>
                                    <ul>
                                        <li>
                                            <p><b>For Tableau with MFA (or Tableau) authentication:</b> To assign Tableau with MFA&nbsp;authentication (or Tableau authentication if still available for your site), you can use the <span class="api-command-ref">authSetting</span> or <span class="api-command-ref"><a href="#idpconfigurationid">idpConfigurationId</a></span> attribute, but not both.</p>
                                        </li>
                                        <li>
                                            <p><b>For SAML and OIDC-based authentication:</b>
                                            </p>
                                            <ul>
                                                <li>
                                                    <p><b>For new configurations:</b> To assign SAML&nbsp;or OIDC-based authentication, whose configurations were created during or after January 2025,  you must use the <span class="api-command-ref">idpConfigurationId</span> attribute for assigning user authentication.  Skip to <a href="#idpconfigurationid" class="xref">idp-configuration-id</a>.</p>
                                                </li>
                                                <li>
                                                    <p><b>For existing configurations:</b> To assign SAML&nbsp;and OIDC-based authentication, whose configurations that Tableau has automatically prefixed with "Initial" (such as "Initial SAML," "Initial Google," "Initial OIDC," or "Initial Salesforce"),  you can continue to use the <span class="api-command-ref">authSetting</span> attribute for assigning user authentication. Alternatively, you can use the <span class="api-command-ref"><a href="#idpconfigurationid">idpConfigurationId</a></span> attribute for assigning user authentication. Do not use both.</p>
                                                </li>
                                            </ul>
                                        </li>
                                        <p><b>Notes:</b>
                                        </p>
                                        <ul>
                                            <li>In cases where both attributes are supported, you can use the <span class="api-command-ref">authSetting</span> attribute or the <span class="api-command-ref">idpConfigurationId</span> attribute, but not both.</li>
                                            <li>If neither <span class="api-command-ref">authSetting</span> nor <span class="api-command-ref">idpConfigurationId</span> attribute is specified, then <code>TableauIdWithMFA</code> (or in some cases <code>ServerDefault</code> if that option is still available for your site) is the authentication  assigned to the user.</li>
                                            <li>If you see "Unspecified" as the authentication method for the user in Tableau Cloud or if the user is unable to sign in, use the <span class="api-command-ref">idpConfigurationId</span> attribute instead. For more information, see <a href="https://help.salesforce.com/s/articleView?id=004693708&amp;type=1" target="_blank">When adding users to Tableau Cloud via Rest API, the user's authentication method is listed as "Unspecified" and the user gets error "Remote IdP entity descriptor is not configured" on login attempt</a> knowledge article or skip to <a href="#idpconfigurationid" class="xref">idp-configuration-id</a>.</li>
                                        </ul>
                                    </ul>
                                    <p>You can assign the following values for the <span class="api-command-ref">authSetting</span> attribute:</p>
                                    <ul>
                                        <li><code>SAML</code> - The user signs in using the identity provider (IdP) configured for the site.
											For Tableau Cloud configuration, see
											<a href="https://help.tableau.com/current/server/en-us/saml_site_specific.htm" rel="noreferrer" target="_blank">Enable SAML Authentication on a Site</a>.
											For Tableau Server, see
											<a href="https://help.tableau.com/current/server/en-us/saml_site_specific.htm" rel="noreferrer" target="_blank">Configure Site-Specific SAML</a>.
										</li>
                                        <li><code>OpenID</code> - <i>Tableau Cloud only</i>: The user signs in using Google, Salesforce or OpenID&nbsp;Connect provider credentials.
											<code>OpenID</code> corresponds to Google, Salesforce, or&nbsp;OIDC&nbsp;authentication configuration in Tableau Cloud authentication settings.</li>
                                        <li><code>TableauIDWithMFA</code> - <i>Tableau Cloud only</i>:&nbsp;The user signs in using a combination of TableauID credentials and a registered verification method. For more information, see <a href="https://help.tableau.com/current/online/en-us/security_auth.htm#mfa_requirement" target="_blank">About multi-factor authentication and Tableau Cloud</a>.</li>
                                        <li><code>ServerDefault</code> - The user signs in using the default authentication method that's set for the server.
											For Tableau Cloud, if Tableau hasn't updated your site to require Tableau with MFA yet, you can continue to use this authentication type on a temporary basis. The <code>ServerDefault</code> value corresponds to <span class="api-command-ref">TableauID</span> in authentication
											settings. For Tableau Server, the
											<a href="https://help.tableau.com/current/server/en-us/saml.htm" rel="noreferrer" target="_blank">SAML</a>
											Server help page describes default authentication options.
</li>
                                    </ul>
                                    <p class="note"><strong>Assigning user auth settings with this method</strong>
                                        <br>
                                        <br>The request payload enables you to set auth settings for individual users, or all users in the .csv file. To
							prevent the payload from having any impact on auth settings, omit the
							<code>name</code> and <code>authSetting</code> attributes of the <code>user</code> object:
						<br><code>&lt;tsrequest&gt;&lt;user /&gt;&lt;/tsrequest&gt;</code>.

							<br><br>To set the default auth settings for all users being imported,
							omit the <code>name</code> attribute and specify the <code>authSetting</code> attribute of the
							<code>user</code> object:
						<br><code>&lt;tsRequest&gt;&lt;user  authSetting="OpenID"/&gt;&lt;tsRequest&gt;</code><br><br>If the auth setting for a user is defined in both the imported .csv and in a request payload,
							the setting in the .csv will take precedence.

							<br><br>If no auth setting is defined for a user in either the .csv and the request payload, then the
							default setting of the site is assigned.
						</p>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">idp-configuration-id</span>
                                </td>
                                <td>
                                    <p>(Optional, Tableau Cloud only) The configuration to assign for user authentication. Added in API 3.25 (January 2025).</p>
                                    <p>To find the <span class="api-command-ref">idpConfigurationId</span> attribute value, use the <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a> method.</p>
                                    <p><b>Notes:</b>
                                    </p>
                                    <ul>
                                        <li>In cases where both attributes are supported, you can use the <span class="api-command-ref">idpConfigurationId</span> attribute or the <span class="api-command-ref">authSetting</span> attribute, but not both. </li>
                                        <li>If neither <span class="api-command-ref">idpConfigurationId</span> nor <span class="api-command-ref">authSetting</span> attribute is  specified, then <code>TableauIdWithMFA</code> (or in some cases <code>ServerDefault</code> if that option is still available for your site) is the authentication assigned to the user.
</li>
                                    </ul>
                                </td>
                            </tr>
                            <tr>
                                <td><span class="api-placeholder">isVerbose</span>
                                </td>
                                <td><i>Tableau Cloud only</i> When set to <code>false</code>, this method only returns the top three errors in a batch of users. When set to <code>true</code>, the method displays a full list of errors during CSV upload.
						<p>Available in REST API 3.22 (Tableau Cloud February 2024)</p></td>
                            </tr>
                        </tbody>
                    </table>

#### Permissions

Tableau Server admins or Tableau Cloud site admins only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:users:create
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

201

#### Version

REST API version 3.15 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Response Body

```
<tsResponse>
  <job id="job-luid"
	mode="Asynchronous"
	type="UserImport"
	progress="progress-status-code"
	createdAt="created-date"
  finishCode="job-finish-status-code" />
</tsResponse>
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Bad request</td><td>The content of the request payload is missing or incomplete, or contains malformed XML.</td></tr><tr><td>500</td><td>500000</td><td>Internal Server Error</td><td>The request could not be completed.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

```
curl -X POST \
http://10.108.21.238//api/3.15/sites/8aa3291f-1b5a-4f52-a3be-6512661f574d/users/import \
-H 'cache-control: no-cache' \
-H 'content-type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW' \
-H 'x-tableau-auth: AVjAKZb3SQimzoqyMmQXEg|9OSHQrwCXF83SIR2XCuDEK91AM7v3FZr' \
-F tableau_user_import=@users.csv \
-F 'request_payload=<tsRequest><user name="jdoe" idpConfigurationId="00000000-0000-0000-0000-0000000000"/></tsRequest>'
```

#### Response

```
<tsResponse>
<job id=">c8c2ee06-624f-4c11-a88d-8c9ec3b5813d"
  mode="Asynchronous"
  type="UserImport"
  progress="0"
  createdAt="2022-02-10T18:46:04Z"
  finishCode="1" />
</tsResponse>
```

## List Group Sets

Lists all group sets matching optional filter and ordered by optional sort expression.

**Note**: After you create a resource, the server updates its search index. If you make a query immediately to see a new resource, the query results might not be up to date.

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:read

- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

GET /api/api-version/sites/site-id/groupsets?pageSize\=page-size&pageNumber\=page-number

GET /api/api-version/sites/site-id/groupsets?filter=filter-expression

GET /api/api-version/sites/site-id/groupsets?sort=sort-expression

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group sets.</td></tr><tr><td><span class="api-placeholder">page-size</span></td><td>(Optional) The number of items to return in one response. The minimum is 1. The maximum is 1000. The default is 100. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">page-number</span></td><td>(Optional) The offset for paging. The default is 1. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">filter-expression</span></td><td>(Optional) An expression that lets you specify a subset of group sets to return. You can filter on predefined fields such as <code>name</code>. You can include multiple filter expressions. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_filtering_and_sorting.htm">Filtering and Sorting</a>.</td></tr><tr><td><span class="api-placeholder">sort-expression</span></td><td>(Optional) An expression that lets you specify the order in which group set information is returned. If you don’t specify a sort expression, the sort order of the information that's returned is undefined. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_filtering_and_sorting.htm">Filtering and Sorting</a>.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groupsets&[resultlevel=[members,local]]" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Code

200

#### Response Body

Copy

```
<tsResponse version-and-namespace-settings>  <pagination pageNumber="1" pageSize="100" totalAvailable="3"/>  <groupSets>    <groupSet id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" name="All Users" groupCount="1" />    <groupSet id="9a8a7b6b-5c4c-3d2d-1e0e-9a8a7b6b5b4b" name="active-directory-group-import" groupCount="2" />    <groupSet id="7b6b59a8-ac3c-4d1d-2e9e-0b5b4ba8a7b6" name="local-group-license-on-login" groupCount="3" />  </groupSets></tsResponse>
```

Copy

```
{  "pagination": {    "pageNumber": "1",    "pageSize": "100",    "totalAvailable": "3"  },  "groupSets": [    {      "id": "1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",      "name": "All Users",      "groupCount": "1",      "group": {        "id": "gs-1",        "name": "group-one"      }    },    {      "id": "9a8a7b6b-5c4c-3d2d-1e0e-9a8a7b6b5b4b",      "name": "active-directory-group-import",      "group": {        "id": "gs21",        "name": "group-two"      }    },    {      "id": "7b6b59a8-ac3c-4d1d-2e9e-0b5b4ba8a7b6",      "name": "local-group-license-on-login",      "group": {        "id": "gs-3",        "name": "group-three"      }    }  ]}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400006</td><td>Invalid page number</td><td>The page number parameter isn’t an integer, is less than one, or is greater than the final page number for data sources at the requested page size.</td></tr><tr><td>400</td><td>400007</td><td>Invalid page size</td><td>The page size parameter isn’t an integer, or is less than one.</td></tr><tr><td>403</td><td>403014</td><td>Page size limit exceeded</td><td>The specified page size is larger than the maximum page size.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>The request type wasn’t <span class="api-command-ref">GET</span>.</td></tr><tr><td>409</td><td>409120</td><td>Group set not found</td><td>The group set ID in the URI doesn't correspond with an existing group set.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## List SCIM Configurations

Returns the System for Cross-domain Identity Management Configuration (SCIM) configurations on the Tableau Cloud site.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: `tableau:scim_configurations:read`

- Scope added in API 3.27 (Tableau Cloud December 2025)

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_; [access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps:_[Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

GET /api/api-version/sites/site-luid/scimConfigurations

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr></tbody></table>

#### Request Body

None

#### cURL Request Example

```
GET request: curl --location 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations'
```

#### Response Code

200

#### Response Body

```
<tsResponse>
  <scimConfigurations>
    <scimConfiguration>
    <id>3400f62c-7569-4608-89c9-98c4194390ee</id>
    <idpConfigurationId>cf73f5a0-8483-42f8-89ac-91a5aeed0bcc</idpConfigurationId>
    <isApiTokenActive>true</isApiTokenActive>
    <isOwner>true</isOwner>
    <name>SCIM Employees</name>
    <createdAt>2025-08-09 15:15:02.100</createdAt>
  </scimConfiguration>
  <scimConfiguration>
    <id>065693d8-436a-4738-a8f1-375953a2a888</id>
    <idpConfigurationId>95dcdf3b-30eb-42ae-b938-7ffca3e11fdc</idpConfigurationId>
    <isApiTokenActive>false</isApiTokenActive>
    <isOwner>false</isOwner>
    <name>SCIM Contractors</name>
    <createdAt>2025-03-27 11:07:49.129</createdAt>
    </scimConfiguration>
  </scimConfigurations>
<tsResponse>
```

```
{
  "scimConfigurations": {
    "scimConfiguration": [
    {
      "id": "3400f62c-7569-4608-89c9-98c4194390ee",
      "idpConfigurationId": "cf73f5a0-8483-42f8-89ac-91a5aeed0bcc",
      "isApiTokenActive": true,
      "isOwner": true,
      "name": "SCIM Employees",
      "createdAt": "2025-08-09 15:15:02.100"
    },
    {
      "id": "065693d8-436a-4738-a8f1-375953a2a888",
      "idpConfigurationId": "95dcdf3b-30eb-42ae-b938-7ffca3e11fdc",
      "isApiTokenActive": false,
      "isOwner": false,
      "name": "SCIM Contractors",
      "createdAt": "2025-03-27 11:07:49.129"
     }
   ]
 }
}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Query Groups

Returns a list of groups on the specified site, with optional parameters for specifying the paging of large results.

**Note**: After you create a resource, the server updates its search index. If you make a query immediately to see a new resource, the query results might not be up to date.

#### URI

GET /api/api-version/sites/site-id/groups

GET /api/api-version/sites/site-id/groups?pageSize\=page-size&pageNumber\=page-number

GET /api/api-version/sites/site-id/groups?filter=filter-expression

GET /api/api-version/sites/site-id/groups?sort=sort-expression

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the groups.</td></tr><tr><td><span class="api-placeholder">page-size</span></td><td>(Optional) The number of items to return in one response. The minimum is 1. The maximum is 1000. The default is 100. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">page-number</span></td><td>(Optional) The offset for paging. The default is 1. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_paging.htm">Paginating Results</a>.</td></tr><tr><td><span class="api-placeholder">filter-expression</span></td><td>(Optional) An expression that lets you specify a subset of groups to return. You can filter on predefined fields such as <code>name</code>. You can include multiple filter expressions. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_filtering_and_sorting.htm">Filtering and Sorting</a>.</td></tr><tr><td><span class="api-placeholder">sort-expression</span></td><td>(Optional) An expression that lets you specify the order in which user information is returned. If you do not specify a sort expression, the sort order of the information that's returned is undefined. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_filtering_and_sorting.htm">Filtering and Sorting</a>.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
  <pagination pageNumber="pageNumber"
    pageSize="page-size"
    totalAvailable="total-available" />
  <groups>
    <group id="group-id"
      name="group-name">
        <domain name="domain-for-group" />
    </group>
    <group id="group-id"
      name="group-name">
        <domain name="domain-for-group" />
		<import source="import-source"
		  domainName="active-directory-domain-name"
		  siteRole="minimum-site-role"
		  grantLicenseMode="license-mode" />
    </group>
    ... additional groups ...
  </groups>
</tsResponse>
```

Notes:

- If the group was imported from Active Directory, the name attribute of the <domain> element contains the group's Active Directory domain. For a group that uses local authentication, the value of that attribute is `local`.
- The response body for a local group that has enabled onLogin for its grant license mode will have an import element with a domain name of `local`. Local groups with grant license mode unset, have no import element in their response.
- Starting in July 2026 (version 3.29), the externalUserEnabled attribute (Tableau Cloud only) is omitted from the <group> element in the response if the site isn't licensed for on-demand access.

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400006</td><td>Invalid page number</td><td>The page number parameter is not an integer, is less than one, or is greater than the final page number for data sources at the requested page size.</td></tr><tr><td>400</td><td>400007</td><td>Invalid page size</td><td>The page size parameter is not an integer, or is less than one.</td></tr><tr><td>403</td><td>403014</td><td>Page size limit exceeded</td><td>The specified page size is larger than the maximum page size.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/" -X GET -H "X-Tableau-Auth:e35Z608JMPHgZfVyJncnedlUeXSX8bmb"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <pagination pageNumber="1" pageSize="100" totalAvailable="3"/>
  <groups>
    <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d" name="All Users">
      <domain name="local"/>
    </group>
    <group id="9a8a7b6b-5c4c-3d2d-1e0e-9a8a7b6b5b4b" name="active-directory-group-import">
      <domain name="MYDOMAIN.net"/>
	  <import domainName="MYDOMAIN.net" siteRole="ExplorerCanPublish" grantLicenseMode="onLogin"/>
    </group>
    <group id="7b6b59a8-ac3c-4d1d-2e9e-0b5b4ba8a7b6" name="local-group-license-on-login">
      <domain name="local"/>
      <import domainName="local" siteRole="ExplorerCanPublish" grantLicenseMode="onLogin"/>
    </group>
  </groups>
</tsResponse>
```

## Query User On Site

Returns information about the specified user.

**Note**: After you create a resource, the server updates its search index. If you make a query immediately to see a new resource, the query results might not be up to date.

#### URI

GET /api/api-version/sites/site-id/users/user-id

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the user.</td></tr><tr><td><span class="api-placeholder">user-id</span></td><td>The ID of the user to get information for.</td></tr></tbody></table>

#### Request Body

None

#### Permissions

Using this method server administrators and site administrators can view user information directly or through the various ways that data is used throughout Tableau. Use of this method by non-administrator users to view their own information depends on the visibility settings of a site. Using the Visibility Setting in the server UI, or the [Create Site](#create_site) or [Update Site](#update_site) methods, you can change user visibility settings of a Site. For more information, see [Manage Site User Visibility](https://help.tableau.com/current/server/en-us/user_visibility.htm).

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:users:read
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
  <user id="user-id"
        name="user-name"
        siteRole="site-role"
        lastLogin="last-login-date"
        externalAuthUserId="authentication-id-from-external-provider"
		 fullName="user-full-name"
		 authSetting="auth-setting"
		 language="language-code"
        locale="locale-code"
		 idpConfigurationId="idp-configuration-id"
		 email="email-address"
        domain name="user-domain" />
</tsResponse>
```

**Notes:**

- The lastLogin attribute value is returned as a date in UTC format (YYYY-MM-DDTHH:MM:SSZ).
- The siteRole value is returned as one of the following values: Creator, Explorer, ExplorerCanPublish, ServerAdministrator, SiteAdministratorExplorer, SiteAdministratorCreator, Unlicensed, ReadOnly, or Viewer.
- The externalAuthUserId value represents an ID for the user for single sign-on (SSO) with an external identity provider. If the user is not configured to use external authentication, this value is an empty string.
- In Tableau Server version 9.0.1 or API version 2.0.1 and later - if SAML is enabled, and the user was imported from Active Directory, the name attribute of the <domain> element contains the user's Active Directory domain.
- Starting in API 3.24, **idpConfigurationId** indicates the authentication configuration assigned to the user in Tableau Cloud only.
- Starting in API 3.26 (July 2025), email indicates an email address that is different from the username.

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>403</td><td>403133</td><td>Query user permissions forbidden</td><td>The user does not have permissions to query user information for other users.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user ID in the URI doesn't correspond to an existing user.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">GET</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

**Example response:**

```
<tsResponse version-and-namespace-settings>
  <user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" name="Alan"
    siteRole="ExplorerCanPublish"
    fullName="Alan Wang"
    authSetting="ServerDefault"
    lastLogin="2015-01-05T03:24:36Z"
	language="en-GB"
	locale="GB"
	idpConfigurationId="00000000-0000-0000-0000-0000000000" />
</tsResponse>
```

## Remove Group from Group Set

Removes a group from the specified group set.

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:delete

- Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).
- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

DELETE /api/api-version/sites/site-id/groupsets/group-set-id/groups/group-id

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group set.</td></tr><tr><td><span class="api-placeholder">group-set-id</span></td><td>The ID of the group set to remove the group from.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The ID of the group to remove.</td></tr></tbody></table>

#### Request Body

None

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groupsets/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/groups/9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

#### Response Body

None

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400032</td><td>Deletion failed</td><td>A problem arose that prevented the group from being removed from the group set.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group ID in the URI doesn't correspond to an existing group.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type wasn’t <span class="api-command-ref">DELETE</span>.</td></tr><tr><td>409</td><td>409120</td><td>Group set not found</td><td>The group set ID in the URI doesn't correspond to an existing user.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Remove User from Site

Removes a user from the specified site. The user will be deleted if they do not own any other assets other than subscriptions. If a user still owns content (assets) on Tableau Server, the user cannot be deleted unless the ownership is reassigned first.

You can’t remove a user from the server if they own content on any site on that server. You can remove a user from a site if they no longer own content on the site.

If a user is removed from all sites that the user is a member of, the user is deleted.

#### URI

DELETE /api/api-version/sites/site-id/users/user-id

DELETE /api/api-version/sites/site-id/users/user-id?mapAssetsTo=new-user-id

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the user.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>The ID of the user to remove.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">mapAssetsTo</span>
                                        </td>
                                        <td>
								Optional. When included in the URI path, the contents owned by the user being removed are transferred to another user. If the user owns subscriptions and no <span class="api-placeholder">mapAssetsTo</span> is provided, the value of the owner is changed to <span class="api-placeholder">unknown user</span>. If a user owns only subscriptions, you can delete them from either server or site without having to set  <span class="api-placeholder">mapAssetsTo</span> a different user.
								<p>If a user owns only subscriptions, you can delete the user from the server or site without setting this value.</p><p class="note"><strong>Note</strong>:&nbsp;Even though both server administrators and site administrators can call this method, only server administrators can use the <span class="api-placeholder">mapAssetsTo</span> parameter to reassign content ownership. Site administrators can't use this parameter value. You must be a server administrator to remove a user who still owns content on Tableau Server.</p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">new-user-id</span>
                                        </td>
                                        <td>The ID of a user that receives ownership of contents of the user being remove.</td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

None

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:users:delete
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 1.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400000</td><td>Deletion failed</td><td>Some other problem arose that prevented the user from being removed from the site.</td></tr><tr><td>403</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user ID in the URI doesn't correspond to an existing user.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr><tr><td>409</td><td>409003</td><td>User asset conflict</td><td>The specified user still owns content on Tableau Server and cannot be deleted.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

The response contains no body (data) if the user is successfully removed from the site. The HTTP response code is 204 if the delete operation succeeded.

## Remove User from Group

Removes a user from the specified group.

Beginning in API 3.21, you can bulk remove users from a group by specifying multiple user IDs.

#### URI

**Remove a single user from a group**

DELETE /api/api-version/sites/site-id/groups/group-id/users/user-id

**Bulk remove users from a group** (beginning in API 3.21)

PUT /api/api-version/sites/site-id/groups/group-id/users/remove

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group.</td></tr><tr><td><span class="api-placeholder">group-id</span></td><td>The ID of the group to remove the user from.</td></tr><tr><td><span class="api-placeholder">user-id</span></td><td>The ID of the user to remove.</td></tr></tbody></table>

#### Request Body

**Remove a single user from a group**

None

**Bulk remove users from a group** (beginning in API 3.21)

```
<tsRequest>
  <users>
	<user id="user-id1" />
	<user id="user-id2" />
	<user id="user-id2" />
  </users>
</tsRequest>
```

#### Attribute Values (bulk remove users only)

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">user-id</span>
                                        </td>
                                        <td>
                                            <p>
                                    The ID (not name) of the user to add. You can get the user ID by calling <a href="#get_users_on_site">Get Users on Site</a> .
</p>
                                            <p>Beginning in API 3.21, you can bulk remove users from a group by specifying multiple user IDs. </p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by server administrators and site administrators.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

204

#### Response Body

None

#### Version

Version 2.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400032</td><td>Deletion failed</td><td>A problem arose that prevented the user from being removed from the site.</td></tr><tr><td>404</td><td>404000</td><td>Site not found</td><td>The site ID in the URI doesn't correspond to an existing site.</td></tr><tr><td>404</td><td>404002</td><td>User not found</td><td>The user name in the URI doesn't correspond to an existing user.</td></tr><tr><td>404</td><td>404012</td><td>Group not found</td><td>The group name in the URI doesn't correspond to an existing group.</td></tr><tr><td>405</td><td>405000</td><td>Invalid request method</td><td>Request type was not <span class="api-command-ref">DELETE</span>.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

#### Example

##### Remove a single user from a group

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/users/9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"`

##### Bulk remove users from a group (beginning in API 3.21)

`curl "http://MY-SERVER/api/3.29/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/groups/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d/users/9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" -X PUT -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd" -d @bulk-remove-users-from-group.xml`

**Content of bulk-remove-users-from-group.xml:**

```
<tsRequest>
  <users>
	<user id="9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" />
	<user id="1z4e8n7q-6t8t-8f8e-7d7c-1b1a2f2d2e2d" />
  </users>
</tsRequest>
```

**Example response:**

The response contains no body (data) if the user (or users) is successfully removed from the group. The HTTP response code is 204 if the delete operation succeeded.

## Update Group

Updates a group on a Tableau Cloud site or Tableau Server.

**Tableau Cloud**

If the Tableau Cloud site is configured to use local authentication, the method lets you update the group name.

**Tableau Server**

If Tableau Sever is configured to use local authentication, the method lets you update the group name.

If Tableau Server is configured to use Active Directory authentication, the method synchronizes the group with Active Directory.

During synchronization, the method updates the group and modifies the set of users in the group to be the same as those in Active Directory. Users in Active Directory that are not in the group on Tableau Server are added to the group, and users that are not in the Active Directory group are removed from the group. Users that are no longer in Active Directory at all are unlicensed.

If the update synchronizes with Active Directory, Tableau Server can perform the update either immediately (synchronously) or by using a background job (asynchronously). If Active Directory contains a large number of users, you should perform the synchronization process as a background job so that the process doesn't time out. By default, synchronizing with Active Directory is performed immediately (synchronously).

#### URI

PUT /api/api-version/sites/site-id/groups/group-id

PUT /api/api-version/sites/site-id/groups/group-id?asJob=asJob-value

#### Parameter Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">api-version</span>
                                        </td>
                                        <td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">site-id</span>
                                        </td>
                                        <td>The ID of the site that contains the group.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">group-id</span>
                                        </td>
                                        <td>The ID of the group to update.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">AsJob-value</span>
                                        </td>
                                        <td>A Boolean value that is used if you are importing from Active Directory. Set this value to <span class="api-command-ref">true</span> to synchronize with Active Directory as a background task, or set this value to
                                <span class="api-command-ref">false</span> to synchronize immediately (synchronously). The default is <span class="api-command-ref">false</span>.
                                <p class="note"><strong>Note</strong>: This parameter has no effect if the server is configured to use local authentication.</p><p>This attribute is available for Tableau Server only.</p></td>
                                    </tr>
                                </tbody>
                            </table>

#### Request Body

**Updating a local group**

```
<tsRequest>
  <group name="new-group-name"
    minimumSiteRole="minimum-site-role"
    externalUserEnabled="on-demand-access" />
</tsRequest>
```

When the request is to update a local group and minimumSiteRole is specified, users are granted a license using the grant license on-login mode by default.

**Updating an Active Directory group** (Tableau Server only)

```
<tsRequest>
  <group name="AD-group-name">
    <import source="ActiveDirectory" domainName="AD-domain"
      siteRole="minimum-site-role"
      grantLicenseMode="license-mode" />
  </group>
</tsRequest>
```

When the request body contains an <import> element, and if Tableau Server or Tableau Cloud site is configured to authenticate via Active Directory, the Update Group method synchronizes with Active Directory. If Tableau Server is configured to use local authentication, including an <import> element has no effect.

#### Attribute Values

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">new-group-name</span>
                                        </td>
                                        <td>The new name for the group.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">AD-group-name</span>
                                        </td>
                                        <td>
                                            <p>The name of the Active Directory group to synchronize with.</p>
                                            <p>This attribute is available for Tableau Server only.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">AD-domain</span>
                                        </td>
                                        <td>
                                            <p>The domain for the Active Directory group.</p>
                                            <p>This attribute is available for Tableau Server only.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">minimum-site-role</span>
                                        </td>
                                        <td>
                                            <p>Required if an <span class="api-placeholder">import</span> element or <span class="api-placeholder">grantLicenseMode</span>
									attribute are present in the request. The site role assigned to users who are imported from Active Directory (Tableau Server only) or granted a
									license automatically using the grant license on-sync or on-login mode.
								</p>
                                            <p>
									If the requested user name matches an existing user in the group, the user either retains their existing role or are granted the one
									specified in the request, based on the role that enables the most capabilities. This is true whether the group the user belongs to is
									imported from Active Directory (Tableau Server only) or local.
								</p>
                                            <p>
									Site roles that can be assigned, listed from the one enabling the least capabilities to
								the most, are as follows.</p>
                                            <ol>
                                                <li value="1"><span class="api-command-ref">Unlicensed</span>
                                                    <br>
                                                </li>
                                                <li value="2"><span class="api-command-ref">Viewer</span>
                                                    <br>
                                                </li>
                                                <li value="3"><span class="api-command-ref">Explorer</span>
                                                    <br>
                                                </li>
                                                <li value="4"><span class="api-command-ref">ExplorerCanPublish</span>
                                                    <br>
                                                </li>
                                                <li value="5"><span class="api-command-ref">Creator</span>
                                                    <br>
                                                </li>
                                                <li value="6"><span class="api-command-ref">SiteAdministratorExplorer</span>
                                                </li>
                                                <li value="7"><span class="api-command-ref">SiteAdministratorCreator</span>
                                                    <br>
                                                </li>
                                            </ol>
                                            <p class="note"><strong>Note</strong>: You cannot use the REST API to set a user to be a Tableau Server administrator
								(<span class="api-command-ref">ServerAdministrator</span> site role).</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">license-mode</span>
                                        </td>
                                        <td>
                                            <p>
									Optional. The mode for automatically applying licenses for group members. When the mode is
									<span class="api-command-ref">onLogin</span>, a license is granted for each group member when they log in to a site.
								</p>
                                            <p>
									For local groups, the mode can be either <span class="api-command-ref">onLogin</span> or unset. If the attribute is omitted
									during an update, the group will use the license grant mode configured prior to the update. A local group configured
									to use <span class="api-command-ref">onLogin</span> can switch the mode to unset by updating the group using:

									</p><pre><code>minimumSiteRole="UNLICENSED"</code></pre><p></p>
                                            <p>
									For groups that import an Active Directory domain (Tableau Server only), the <span class="api-command-ref">grantLicenseMode</span>
									can be updated to either <span class="api-command-ref">onSync</span>
									or <span class="api-command-ref">onLogin</span>. If the attribute is omitted during an update, the group will use the license grant mode
									configured  prior to the update.
								</p>
                                            <p>
									The minimum role granted to users through <span class="api-placeholder">grantLicenseMode</span> is specified in the
									<span class="api-placeholder">siteRole</span> attribute of the <span class="api-placeholder">import</span> element.
									If that role has less permissions than an existing role assigned to the user, then the user's permissions remain unchanged.
								</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><a name="oda"></a><span class="api-placeholder">on-demand-access</span>
                                        </td>
                                        <td>
                                            <p>Optional. A boolean value that is used to enable on-demand access for embedded Tableau content when the Tableau Cloud site is licensed with <a href="https://help.tableau.com/current/online/en-us/license_product_keys.htm#embedded-analytics" target="_blank">Embedded Analytics</a> usage-based model or <a href="https://help.tableau.com/current/online/en-us/license_product_keys.htm#capacity" target="_blank">capacity-based model</a> with Cloud+ or Tableau+ edition. </p>
                                            <p>Set to <span class="api-command-ref">true</span> to enable the capability for the group or set to <span class="api-command-ref">false</span> to disable the capability for the group.  For more information about on-demand access, see <a href="https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html#on-demand-access-for-users" target="_blank">On-demand access for users</a> in the Tableau Embedding API v3 Help.</p>
                                            <p>This attribute is available for Tableau Cloud only starting from API version 3.21 (October 2023).
</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by Tableau Server administrators or Tableau Cloud site admins.

#### Required scope for JWT authorization

Introduced in Tableau Cloud June 2022 (API 3.16) and Tableau Server 2022.3 (API 3.17).

```
tableau:groups:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200 (immediate update)

202 (background update)

#### Response Body

**Updating a local group:**

```
<tsResponse>
  <group id="new-group-id"
	name="group-name"
	externalUserEnabled="true"
	minimumSiteRole="minimum-site-role">
         <import domainName="local" siteRole="default-site-role" grantLicenseMode="license-mode"/>
</tsResponse>
```

**Updating an Active Directory group (Tableau Server only):**

```
<tsResponse>
  <group id="new-group-id"
	name="group-name">
 	  <import domainName="active-directory-domain-name”
           grantLicenseMode="license-mode"
	    minimumSiteRole="default-site-role" />
  </group>
</tsResponse>
```

**Background update:**

```
<tsResponse>
  <job id="job-id"
    mode="Asynchronous"
    type="GroupSync"
    progress="0"
    createdAt="time-job-created" />
</tsResponse>
```

**Notes:** 

- If the operation is performed asynchronously, the response body contains a <job> element that includes a job ID. You can check the status of the operation by using the [Query Job](#query_job) method, which returns status information about the job. A typical approach is to periodically call Query Job method and get the value of the progress attribute from the response body; when this value returns 100, the import process is complete.

#### Version

Version 3.9 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400984</td>
                                        <td>Not licensed</td>
                                        <td>On-demand access can't be enabled if your site is not licensed with the usage-based model or capacity-based usage model with Tableau+ or Cloud+ edition. </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>400013</td>
                                        <td>Invalid site role</td>
                                        <td>
                                            <p>The value of the <span class="api-command-ref">minimumSiteRole</span> or <span class="api-command-ref">siteRole</span> attribute must be
											<span class="api-command-ref">Explorer</span>,
											<span class="api-command-ref">ExplorerCanPublish</span>,
											<span class="api-command-ref">SiteAdministratorCreator</span>,
											<span class="api-command-ref">SiteAdministratorExplorer</span>,
											<span class="api-command-ref">Unlicensed</span>,
										or <span class="api-command-ref">Viewer</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>400019</td>
                                        <td>Malformed import element</td>
                                        <td>If the body includes an <span class="api-command-ref">&lt;import&gt;</span> element, it must contain a <span class="api-command-ref">source</span>, <span class="api-command-ref">domainName</span>,
                                    and <span class="api-command-ref">siteRole</span> attribute.  If any of these attributes are missing, the element is malformed. In addition, the <span class="api-command-ref">source</span> attribute
                                    must have a value of <code>ActiveDirectory</code>; otherwise the element is malformed.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403011</td>
                                        <td>Active Directory not configured</td>
                                        <td>The request body contains an <span class="api-command-ref">&lt;import&gt;</span> element is included, but Tableau Server is configured for local authentication.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403020</td>
                                        <td>Imported group name update forbidden</td>
                                        <td>
								The request body contains an <span class="api-command-ref">&lt;import&gt;</span> element and the value of the
								<span class="api-command-ref">name</span> attribute of the <span class="api-command-ref">&lt;group&gt;</span> element
								in the request body is different from the name of the group imported into Tableau Server as
                                referenced by the <span class="api-command-ref">group-id</span> value in the URI.
                            </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404012</td>
                                        <td>Group not found</td>
                                        <td>The group ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404016</td>
                                        <td>Domain not found</td>
                                        <td>The request body includes an <span class="api-command-ref">&lt;import&gt;</span> element, but the specified domain name doesn't exist in Active Directory.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404017</td>
                                        <td>Active Directory group not found</td>
                                        <td>The request body includes an <span class="api-command-ref">&lt;import&gt;</span> element, but no group with the name specified in the <span class="api-command-ref">&lt;group&gt;</span>
                                    element exists in Active Directory.</td>
                                    </tr>
                                    <tr>
                                        <td>405</td>
                                        <td>405000</td>
                                        <td>Invalid request method</td>
                                        <td>Request type was not <span class="api-command-ref">PUT</span>.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409009</td>
                                        <td>Group name conflict</td>
                                        <td>The group name in the request is already in use in the specified site.  For the purpose of uniqueness checks, group names are case-insensitive.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Update Group Set

Updates a group set name on a Tableau Server or Tableau Cloud site.

**Version:** Available in API 3.22 (Tableau Cloud February 2024 / Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Server administrators or Tableau Cloud site admins.  _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:groupsets:update

- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

PUT /api/api-version/sites/site-id/groupsets/group-set-id

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the group.</td></tr><tr><td><span class="api-placeholder">group-set-id</span></td><td>The ID of the group set to update.</td></tr></tbody></table>

#### Request Body

Copy

```
<tsRequest>  <groupSet name="Researchers-one" /></tsRequest>
```

Copy

```
{  "groupSet": {    "@name": "Researchers-one"  }}
```

#### Attribute Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-extra-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">name</span></td><td>The new name for the group set.</td></tr></tbody></table>

#### Response Code

200

#### Response Body

Copy

```
<tsResponse>  <groupSet id="group-set-id"    name="Researchers-one"    groupCount="2"/>      <group id="1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d"        name="Internal"/>      <group id="9a8a7b6b-5c4c-3d2d-1e0e-9a8a7b6b5b4b"        name="External"/>  </groupSet></tsResponse>
```

Copy

```
{  "groupSet": {    "id": "group-set-id",    "name": "Researchers-one",    "groupCount": "2",    "group": [      {        "id": "1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",        "name": "Internal"      },      {        "id": "9a8a7b6b-5c4c-3d2d-1e0e-9a8a7b6b5b4b",        "name": "External"      }    ]  }}
```

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>400013</td>
                                        <td>Invalid site role</td>
                                        <td>
                                            <p>The value of the <span class="api-command-ref">minimumSiteRole</span> or <span class="api-command-ref">siteRole</span> attribute must be
											<span class="api-command-ref">Explorer</span>,
											<span class="api-command-ref">ExplorerCanPublish</span>,
											<span class="api-command-ref">SiteAdministratorCreator</span>,
											<span class="api-command-ref">SiteAdministratorExplorer</span>,
											<span class="api-command-ref">Unlicensed</span>,
										or <span class="api-command-ref">Viewer</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>405</td>
                                        <td>405000</td>
                                        <td>Invalid request method</td>
                                        <td>The request type wasn’t <span class="api-command-ref">PUT</span>.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409120</td>
                                        <td>Group set not found.</td>
                                        <td>The group set ID in the request body doesn't correspond to an existing group set.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409121</td>
                                        <td>Group set name conflict</td>
                                        <td>The group set name in the request already belongs to another group set.  For the purpose of uniqueness checks, group set names are case-insensitive.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Update SCIM Configuration

Updates the System for Cross-domain Identity Management (SCIM) configuration on the Tableau Cloud site.

You must be the user that created the SCIM configuration to update the SCIM configuration unless the creator of the SCIM configuration is no longer a member of the site.

**Version**: Available in API 3.26 (Tableau Cloud August 2025) and later.

**License**: No additional license required.

**Permissions**: Tableau Cloud site admins only.

**Access Scope**: `tableau:scim_configurations:read`

- Scope added in API 3.27 (Tableau Cloud December 2025)

_For more information, see_ [Versions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_,_ [Permissions](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_, [access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps_[Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm)_._

#### URI

PATCH /api/api-version/sites/site-luid/scimConfigurations/scim-configuration-id

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">scim-configuration-id</span></td><td>The UUID of the SCIM configuration. To get the SCIM&nbsp;configuration UUID, see <a href="#list_scim_configurations">List SCIM Configurations</a>.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <scimConfiguration>
    <name>SCIM Contractors Canada</name>
    <idpConfigurationId>d3b782da-0787-44ca-8585-6fd48dbfc658d3b782da-0787-44ca-8585-6fd48dbfc658</idpConfigurationId>
  </scimConfiguration>
</tsRequest>
```

```
{
"scimConfiguration": {
  "name": "SCIM Contractors Canada",
  "idpConfigurationId": "d3b782da-0787-44ca-8585-6fd48dbfc658d3b782da-0787-44ca-8585-6fd48dbfc658"
  }
}
```

#### cURL Request Example

```
POST request: curl --location 'https://prod-ca-a.online.tableau.com/api/3.29/sites/0f04ea64-0d72-424a-afd8-ee7d758dc9b8/scimConfigurations \ --data '{ "scimConfiguration":{ "name": "SCIM Contractors Canada", "idpConfigurationId": "d3b782da-0787-44ca-8585-6fd48dbfc658" } }'
```

#### Attribute Values

<table class="api-parameters-table">
                            <colgroup>
                                <col class="api-parameters-table-col-1-wide" style="width: 264px;">
                                <col>
                            </colgroup>
                            <tbody>
                                <tr>
                                    <td><span class="api-placeholder">name</span>
                                    </td>
                                    <td>(Required) Name of the SCIM&nbsp;configuration.</td>
                                </tr>
                                <tr>
                                    <td><span class="api-placeholder">idpConfigurationId</span>
                                    </td>
                                    <td>
                                        <p>(Required) Authentication configuration to associate with the SCIM&nbsp;configuration.
</p>
                                        <p> Starting in API 3.26, you can have  multiple SCIM&nbsp;configurations. Include the <span class="api-command-ref">idpConfigurationId</span> to identify which configuration to update. If a SCIM token is associated with SCIM&nbsp;configuration, updating the <span class="api-command-ref">IdPConfigurationId</span> deletes the SCIM&nbsp;token. Ensure the SCIM token's secret is removed from the identity provider's (IdP's) SCIM configuration. To get the <span class="api-command-ref">idpConfigurationId</span>, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a>.</p>
                                        <p>Starting in API&nbsp;3.28, you can associate OIDC or Google authentication with SCIM.</p>
                                    </td>
                                </tr>
                            </tbody>
                        </table>

#### Response Code

204

#### Response Body

```
<tsResponse>
  <scimConfiguration>
    <id>065693d8-436a-4738-a8f1-375953a2a888</id>
    <idpConfigurationId>d3b782da-0787-44ca-8585-6fd48dbfc658</idpConfigurationId>
    <isApiTokenActive>false</isApiTokenActive>
    <isOwner>true</isOwner>
    <name>SCIM Contractors Canada</name>
    <createdAt>2025-04-01 06:31:47.882</createdAt>
  </scimConfiguration>
</tsResponse>
```

```
{
  "scimConfiguration": {
    "id": "065693d8-436a-4738-a8f1-375953a2a888",
    "idpConfigurationId": "d3b782da-0787-44ca-8585-6fd48dbfc658",
    "isApiTokenActive": false,
    "isOwner": true,
    "name": "SCIM Contractors Canada",
    "createdAt": "2025-04-01 06:31:47.882"
  }
}
```

#### Errors

<table class="api-error-table"><colgroup><col class="api-error-table-col-1"> <col class="api-error-table-col-2"> <col class="api-error-table-col-3"> <col></colgroup><tbody><tr><th>HTTP status</th><th><code>error</code> Code</th><th>Condition</th><th>Details</th></tr><tr><td>400</td><td>400008</td><td>Bad Request</td><td>The content of the request body contains unsupported attributes, the SCIM&nbsp;configuration name already exists, or the <code>idpConfigurationId</code> is missing or not valid.</td></tr><tr><td>401</td><td>401002</td><td>Unauthorized Access</td><td>The authentication token provided in the request header is invalid or has expired.</td></tr><tr><td>403</td><td>403182</td><td>Forbidden</td><td>The SCIM&nbsp;configuration can only be updated by the user who created the SCIM&nbsp;configuration.</td></tr><tr><td>404</td><td>404050</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration does not have an associated SCIM&nbsp;token.</td></tr><tr><td>404</td><td>404057</td><td>Resource Not Found</td><td>The SCIM&nbsp;configuration UUID is not valid or does not exist on this site.</td></tr></tbody></table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Update User

Modifies information about the specified user.

**Tableau Server**

If Tableau Server is configured to use local authentication, you can update the user's name, email address, password, or site role.

If Tableau Server is configured to use Active Directory for authentication, you can change the user's display name (full name), email address, and site role. However, if you synchronize the user with Active Directory, the display name and email address will be overwritten with the information that's in Active Directory.

**Tableau Cloud**

For Tableau Cloud, you can update the site role for a user, but you cannot update or change a user's password, user name (email address), or full name.

#### URI

PUT /api/api-version/sites/site-id/users/user-id

#### Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-id</span></td><td>The ID of the site that contains the user.</td></tr><tr><td><span class="api-placeholder">user-id</span></td><td>The ID of the user to update.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
 <user fullName="new-full-name"
    email="new-email"
    password="new-password"
    siteRole="new-site-role"
    authSetting="new-auth-setting"
	identityPoolName="identity-pool-name"
	idpConfigurationId="idp-configuration-id"
	language="language"
	locale="locale"/>
</tsRequest>
```

```
{
	"user": {
	   "fullName":"new-full-name",
	   "email":"new-email",
	   "password":"new-password",
	   "siteRole":"new-site-role",
	   "authSetting":"new-auth-setting",
	   "identityPoolName":"identity-pool-name",
	   "idpConfigurationId":"idp-configuration-id",
	   "language":"language",
	   "locale":"locale"
	 }
}
```

#### Attribute Values

Any combination of the elements inside the <user> element is valid. Only those elements present will result in updates to their values for the user. If no elements are present, the update will not take effect.

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1-extra-wide">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><span class="api-placeholder">new-full-name</span>
                                        </td>
                                        <td>(Optional) The new name for the user. Users can change names without affecting the groups they belong to. Tableau Server only. Not available in Tableau Cloud.
                                </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">new-email</span>
                                        </td>
                                        <td>(Optional) The new email address for the for the Tableau Server user.
                                <p>Starting in API 3.26 (July 2025), the email address where the Tableau Cloud user can receive notifications. If no value is provided, Tableau Cloud uses the <code>username</code> value to send notifications to. </p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">new-password</span>
                                        </td>
                                        <td>(Optional) The new password for the user. Tableau Server only. Not available in Tableau Cloud.</td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">new-site-role</span>
                                        </td>
                                        <td>
                                            <p>The new site role to assign to the user. You can assign the following roles:
									<span class="api-command-ref">Creator</span>,
									<span class="api-command-ref">Explorer</span>,
									<span class="api-command-ref">ExplorerCanPublish</span>,
									<span class="api-command-ref">ServerAdministrator</span>,
									<span class="api-command-ref">SiteAdministratorExplorer</span>,
									<span class="api-command-ref">SiteAdministratorCreator</span>,
									<span class="api-command-ref">Unlicensed</span>,
									or
								<span class="api-command-ref">Viewer</span>.</p>
                                            <p><strong>Note</strong>: Only a user in the <span class="api-command-ref">ServerAdministrator</span>
									site role can use the REST API to add or remove another user from the
									<span class="api-command-ref">ServerAdministrator</span> site role. Users in the <span class="api-command-ref">ServerAdministrator</span> site role can only be moved to the <b>Creator</b> site role if one or more <b>Creator</b> licenses have been activated on the server; otherwise these users can only be moved to the <b>Publisher</b> site role. This method only supports the
								    <span class="api-command-ref">ServerAdministrator</span> site role in API 2.8 and later.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><a name="authsetting"></a><span class="api-placeholder">new-auth-setting</span>
                                        </td>
                                        <td>(Optional) The authentication type for the user.<p><b>Tableau Server</b></p><p>The <span class="api-command-ref">authSetting</span> attribute only applies when updating users on sites with site-specific SAML-enabled settings.</p><p><b>Tableau Cloud</b></p><p>The ability to create and enable multiple authentication methods simultaneously was introduced in API 3.25 (January 2025). As a result of this capability, consider the following:</p><ul><li><p><b>For Tableau with MFA (or Tableau) authentication:</b> To assign Tableau with MFA&nbsp;authentication (or Tableau authentication if still available for your site), you can use the <span class="api-command-ref">authSetting</span> or <span class="api-command-ref"><a href="#idpconfigurationid">idpConfigurationId</a></span> attribute, but not both.</p></li><li><p><b>For SAML and OIDC-based authentication:</b></p><ul><li><p><b>For new configurations:</b> To assign SAML&nbsp;or OIDC-based authentication, whose configurations were created during or after January 2025,  you must use the <span class="api-command-ref">idpConfigurationId</span> attribute for assigning user authentication.  Skip to <a href="#idpconfigurationid" class="xref">idp-configuration-id</a>.</p></li><li><p><b>For existing configurations:</b> To assign SAML&nbsp;and OIDC-based authentication, whose configurations that Tableau has automatically prefixed with "Initial" (such as "Initial SAML," "Initial Google," "Initial OIDC," or "Initial Salesforce"),  you can continue to use the <span class="api-command-ref">authSetting</span> attribute for assigning user authentication. Alternatively, you can use the <span class="api-command-ref"><a href="#idpconfigurationid">idpConfigurationId</a></span> attribute for assigning user authentication. Do not use both.</p></li></ul></li><p><b>Notes:</b></p><ul><li>In cases where both attributes are supported, you can use the <span class="api-command-ref">authSetting</span> attribute or the <span class="api-command-ref">idpConfigurationId</span> attribute, but not both.</li><li>If neither <span class="api-command-ref">authSetting</span> nor <span class="api-command-ref">idpConfigurationId</span> attribute is specified, then <code>TableauIdWithMFA</code> (or in some cases <code>ServerDefault</code> if that option is still available for your site) is the authentication  assigned to the user.</li><li>If you see "Unspecified" as the authentication method for the user in Tableau Cloud or if the user is unable to sign in, use the <span class="api-command-ref">idpConfigurationId</span> attribute instead. For more information, see <a href="https://help.salesforce.com/s/articleView?id=004693708&amp;type=1" target="_blank">When adding users to Tableau Cloud via Rest API, the user's authentication method is listed as "Unspecified" and the user gets error "Remote IdP entity descriptor is not configured" on login attempt</a> knowledge article or skip to <a href="#idpconfigurationid" class="xref">idp-configuration-id</a>.</li></ul></ul><p>You can assign the following values for the <span class="api-command-ref">authSetting</span> attribute:</p><ul><li><code>SAML</code> - The user signs in using the identity provider (IdP) configured for the site.
											For Tableau Cloud configuration, see
											<a href="https://help.tableau.com/current/server/en-us/saml_site_specific.htm" rel="noreferrer" target="_blank">Enable SAML Authentication on a Site</a>.
											For Tableau Server, see
											<a href="https://help.tableau.com/current/server/en-us/saml_site_specific.htm" rel="noreferrer" target="_blank">Configure Site-Specific SAML</a>.
										</li><li><code>OpenID</code> - <i>Tableau Cloud only</i>: The user signs in using Google, Salesforce or OpenID&nbsp;Connect provider credentials.
											<code>OpenID</code> corresponds to Google, Salesforce, or&nbsp;OIDC&nbsp;authentication configuration in Tableau Cloud authentication settings.</li><li><code>TableauIDWithMFA</code> - <i>Tableau Cloud only</i>:&nbsp;The user signs in using a combination of TableauID credentials and a registered verification method. For more information, see <a href="https://help.tableau.com/current/online/en-us/security_auth.htm#mfa_requirement" target="_blank">About multi-factor authentication and Tableau Cloud</a>.</li><li><code>ServerDefault</code> - The user signs in using the default authentication method that's set for the server.
											For Tableau Cloud, if Tableau hasn't updated your site to require Tableau with MFA yet, you can continue to use this authentication type on a temporary basis. The <code>ServerDefault</code> value corresponds to <span class="api-command-ref">TableauID</span> in authentication
											settings. For Tableau Server, the
											<a href="https://help.tableau.com/current/server/en-us/saml.htm" rel="noreferrer" target="_blank">SAML</a>
											Server help page describes default authentication options.
</li></ul><p></p></td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">identity-pool-name</span>
                                        </td>
                                        <td>(Optional, Tableau Server only) When identity pools are configured, the name of the identity pool.
                                <p>Starting in API&nbsp;3.19, include the identity pool name when identity pools are configured and you need to add a user to an identity pool that uses the local identity store and OIDC authentication. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_identity_pools.htm" class="xref">Identity Pools Methods</a>.</p></td>
                                    </tr>
                                    <tr>
                                        <td><a name="idpconfigurationid"></a><span class="api-placeholder">idp-configuration-id</span>
                                        </td>
                                        <td>
                                            <p>(Optional, Tableau Cloud only) The configuration to assign for user authentication. Added in API 3.25 (January 2025).</p>
                                            <p>To find the <span class="api-command-ref">idpConfigurationId</span> attribute value, use the <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_site.htm#list_authentication_configurations_site" class="xref">List Authentication Configurations for Site</a> method.</p>
                                            <p><b>Notes:</b>
                                            </p>
                                            <ul>
                                                <li>In cases where both attributes are supported, you can use the <span class="api-command-ref">idpConfigurationId</span> attribute or the <span class="api-command-ref">authSetting</span> attribute, but not both. </li>
                                                <li>If neither <span class="api-command-ref">idpConfigurationId</span> nor <span class="api-command-ref">authSetting</span> attribute is  specified, then <code>TableauIdWithMFA</code> (or in some cases <code>ServerDefault</code> if that option is still available for your site) is the authentication assigned to the user.
</li>
                                            </ul>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">language</span>
                                        </td>
                                        <td>
                                            <p>(Optional, Tableau Cloud only) Language of the user. </p>
                                            <p>Starting in API&nbsp;3.28 (March 2026), you can set the user's default language in Tableau Cloud to one of the supported languages (ISO 639-1). You can assign one of the following values: <span class="api-command-ref">de</span>, <span class="api-command-ref">en_GB</span>, <span class="api-command-ref">en</span>, <span class="api-command-ref">es</span>,<span class="api-command-ref"> fr_CA</span>, <span class="api-command-ref">fr</span>, <span class="api-command-ref">it</span>, <span class="api-command-ref">nl</span>, <span class="api-command-ref">pt</span>, <span class="api-command-ref">sv</span>, <span class="api-command-ref">th</span>, <span class="api-command-ref">ja</span>, <span class="api-command-ref">zh</span>, <span class="api-command-ref">zh_TW</span>, or <span class="api-command-ref">ko</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><span class="api-placeholder">locale</span>
                                        </td>
                                        <td>
                                            <p>(Optional, Tableau Cloud only) Locale of the user. </p>
                                            <p>Starting in API&nbsp;3.28 (March 2026), you can set the user's default locale to one of the supported locales. You can assign one of the following values: <span class="api-command-ref">ar_SA</span>, <span class="api-command-ref">ar_AE</span>, <span class="api-command-ref">ar_BH</span>, <span class="api-command-ref">ar_DZ</span>, <span class="api-command-ref">ar_EG</span>, <span class="api-command-ref">ar_IQ</span>, <span class="api-command-ref">ar_JO</span>, <span class="api-command-ref">ar_KW</span>, <span class="api-command-ref">ar_LB</span>, <span class="api-command-ref">ar_LY</span>, <span class="api-command-ref">ar_MA</span>, <span class="api-command-ref">ar_OM</span>, <span class="api-command-ref">ar_QA</span>, <span class="api-command-ref">ar_SD</span>, <span class="api-command-ref">ar_SY</span>, <span class="api-command-ref">ar_TN</span>, <span class="api-command-ref">ar_YE</span>, <span class="api-command-ref">be_BY</span>, <span class="api-command-ref">bg_BG</span>, <span class="api-command-ref">ca_ES</span>, <span class="api-command-ref">cs_CZ</span>, <span class="api-command-ref">da_DK</span>, <span class="api-command-ref">de_DE</span>, <span class="api-command-ref">de_AT</span>, <span class="api-command-ref">de_CH</span>, <span class="api-command-ref">de_LU</span>, <span class="api-command-ref">el_GR</span>, <span class="api-command-ref">el_CY</span>, <span class="api-command-ref">en_US</span>, <span class="api-command-ref">en_AU</span>, <span class="api-command-ref">en_CA</span>, <span class="api-command-ref">en_GB</span>, <span class="api-command-ref">en_IE</span>, <span class="api-command-ref">en_IN</span>, <span class="api-command-ref">en_MT</span>, <span class="api-command-ref">en_NZ</span>, <span class="api-command-ref">en_PH</span>, <span class="api-command-ref">en_SG</span>, <span class="api-command-ref">en_ZA</span>, <span class="api-command-ref">es_ES</span>, <span class="api-command-ref">es_AR</span>, <span class="api-command-ref">es_BO</span>, <span class="api-command-ref">es_CL</span>, <span class="api-command-ref">es_CO</span>, <span class="api-command-ref">es_CR</span>, <span class="api-command-ref">es_DO</span>, <span class="api-command-ref">es_EC</span>, <span class="api-command-ref">es_GT</span>, <span class="api-command-ref">es_HN</span>, <span class="api-command-ref">es_MX</span>, <span class="api-command-ref">es_NI</span>, <span class="api-command-ref">es_PA</span>, <span class="api-command-ref">es_PE</span>, <span class="api-command-ref">es_PR</span>, <span class="api-command-ref">es_PY</span>, <span class="api-command-ref">es_SV</span>, <span class="api-command-ref">es_US</span>, <span class="api-command-ref">es_UY</span>, <span class="api-command-ref">es_VE</span>, <span class="api-command-ref">et_EE</span>, <span class="api-command-ref">fi_FI</span>, <span class="api-command-ref">fr_FR</span>, <span class="api-command-ref">fr_BE</span>, <span class="api-command-ref">fr_CH</span>, <span class="api-command-ref">fr_LU</span>, <span class="api-command-ref">fr_CA</span>, <span class="api-command-ref">ga_IE</span>, <span class="api-command-ref">he_IL</span>, <span class="api-command-ref">hi_IN</span>, <span class="api-command-ref">hr_HR</span>, <span class="api-command-ref">hu_HU</span>, <span class="api-command-ref">id_ID</span>, <span class="api-command-ref">is_IS</span>, <span class="api-command-ref">it_IT</span>, <span class="api-command-ref">it_CH</span>, <span class="api-command-ref">ja_JP</span>, <span class="api-command-ref">ko_KR</span>, <span class="api-command-ref">lt_LT</span>, <span class="api-command-ref">lv_LV</span>, <span class="api-command-ref">mk_MK</span>, <span class="api-command-ref">ms_MY</span>, <span class="api-command-ref">mt_MT</span>, <span class="api-command-ref">nl_NL</span>, <span class="api-command-ref">nl_BE</span>, <span class="api-command-ref">no_NO</span>, <span class="api-command-ref">pl_PL</span>, <span class="api-command-ref">pt_BR</span>, <span class="api-command-ref">pt_PT</span>, <span class="api-command-ref">ro_RO</span>, <span class="api-command-ref">ru_RU</span>, <span class="api-command-ref">sk_SK</span>, <span class="api-command-ref">sl_SI</span>, <span class="api-command-ref">sq_AL</span>, <span class="api-command-ref">sr_RS</span>, <span class="api-command-ref">sr_BA</span>, <span class="api-command-ref">sr_ME</span>, <span class="api-command-ref">sv_SE</span>, <span class="api-command-ref">th_TH</span>, <span class="api-command-ref">tr_TR</span>, <span class="api-command-ref">uk_UA</span>, <span class="api-command-ref">vi_VN</span>, <span class="api-command-ref">zh_CN</span>, <span class="api-command-ref">zh_HK</span>, <span class="api-command-ref">zh_SG</span>, or <span class="api-command-ref">zh_TW</span>.</p>
                                        </td>
                                    </tr>
                                </tbody>
                            </table>

#### Permissions

This method can only be called by server administrators or site administrators. In addition, site administrators have some limitations in what changes they can make to users:

- Site administrators cannot set the fullName value.
- On Tableau Server, site administrators can change the email and password values only if the caller is a site administrator for all sites that the user is a member of. On Tableau Cloud, you cannot change a user's email or password.
- Site administrators can change the siteRole value only if the site is configured to allow site administrators to add and remove site users. Site administrators on Tableau Cloud can change the siteRole value because they have permission to add and remove site users. Starting in API 3.26 (July 2025), site administrators can update a user's email address that is different from the user's username. This email address is for receiving notifications only.

#### Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

```
tableau:users:update
```

For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### Response Code

200

#### Response Body

```
<tsResponse>
 <user name="user-name"
    fullName="new-full-name"
    email="new-email"
    siteRole="new-site-role"
    authSetting="new-auth-setting"
	identityPoolName="identity-pool-name"
	idpConfigurationId="idp-configuration-id" />
</tsResponse>
```

#### Version

Version 1.0 and later. For more information, see [REST API and Resource Versions](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm).

#### Errors

<table class="api-error-table">
                                <colgroup>
                                    <col class="api-error-table-col-1">
                                    <col class="api-error-table-col-2">
                                    <col class="api-error-table-col-3">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <th>HTTP status</th>
                                        <th><code>error</code> Code</th>
                                        <th>Condition</th>
                                        <th>Details</th>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Bad request</td>
                                        <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400000</td>
                                        <td>Invalid email address</td>
                                        <td>The <span class="api-command-ref">email</span> attribute does not contain a valid email address.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400003</td>
                                        <td>Bad request</td>
                                        <td>The user authentication setting <code>ServerDefault</code> is not supported for you site. Try again using <code>TableauIDWithMFA</code> instead.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400012</td>
                                        <td>Bad request</td>
                                        <td>The user cannot be assigned the Unlicensed role because they are still a member of a group that has
								a minimum site role set.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400217</td>
                                        <td>Unsupported language</td>
                                        <td>The specified language is not valid or not supported.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400218</td>
                                        <td>Unsupported locale</td>
                                        <td>The specified locale is not valid or not supported.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403009</td>
                                        <td>Licensing update on self forbidden</td>
                                        <td>A user cannot update their own licensing role.</td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403009</td>
                                        <td>Guest update forbidden</td>
                                        <td>The Guest user is a special user and cannot be updated.</td>
                                    </tr>
                                    <tr>
                                        <td>400</td>
                                        <td>400013</td>
                                        <td>Invalid site role</td>
                                        <td>
                                            <p>The value of the <span class="api-command-ref">siteRole</span> attribute must be
											<span class="api-command-ref">Creator</span>,
											<span class="api-command-ref">Explorer</span>,
											<span class="api-command-ref">ExplorerCanPublish</span>,
											<span class="api-command-ref">ServerAdministrator</span>,
											<span class="api-command-ref">SiteAdministratorExplorer</span>,
											<span class="api-command-ref">SiteAdministratorCreator</span>,
											<span class="api-command-ref">Unlicensed</span>,
											or
										<span class="api-command-ref">Viewer</span>.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403193</td>
                                        <td>Forbidden</td>
                                        <td>A non-administrator user called this method or doesn't have permissions to update language for the user. </td>
                                    </tr>
                                    <tr>
                                        <td>403</td>
                                        <td>403194</td>
                                        <td>Forbidden</td>
                                        <td>A non-administrator user called this method or doesn't have permissions to update locale for the user. </td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404000</td>
                                        <td>Site not found</td>
                                        <td>The site ID in the URI doesn't correspond to an existing site.</td>
                                    </tr>
                                    <tr>
                                        <td>404</td>
                                        <td>404002</td>
                                        <td>User not found</td>
                                        <td>The user ID in the URI doesn't correspond to an existing user.</td>
                                    </tr>
                                    <tr>
                                        <td>405</td>
                                        <td>405000</td>
                                        <td>Invalid request method</td>
                                        <td>Request type was not <span class="api-command-ref">PUT</span>.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409000</td>
                                        <td>User conflict</td>
                                        <td>The user with the specified name is already registered on the site in the same domain.</td>
                                    </tr>
                                    <tr>
                                        <td>409</td>
                                        <td>409014</td>
                                        <td>Licensing conflict</td>
                                        <td>The request is attempting to update the user to a licensing role that has insufficient capacity.</td>
                                    </tr>
                                    <tr>
                                        <td>500</td>
                                        <td>500109</td>
                                        <td>Internal language error</td>
                                        <td>The language request could not be completed.</td>
                                    </tr>
                                    <tr>
                                        <td>500</td>
                                        <td>500110</td>
                                        <td>Internal locale error</td>
                                        <td>The locale request could not be completed.</td>
                                    </tr>
                                </tbody>
                            </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).

## Upload User Credentials

Uploads user credentials to a site on a destination Tableau Cloud or Tableau Server.

Before you use this method, you must create public and private keys for resources with embedded credentials. For more information, see [Migrate Workbooks and Data Sources with Embedded Credentials](https://help.tableau.com/current/server/en-us/cmt-migration_embedded_credentials.htm).

**Version:** Available in API 3.23 (Tableau Cloud June 2024/ Tableau Server 2024.2) and later. _[Version Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_versions.htm)_

**License:** No additional license required.

**Permissions:** This method can only be called by Tableau Cloud and Tableau Server admins.   _[Permissions Overview](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_permissions.htm)_

**JWT Access Scope:** tableau:oauth\_credentials:upload

- Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).
- For more information, see [Access scopes for UATs](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html#scopes) (Cloud) and access scopes for connected apps: [Cloud](https://help.tableau.com/current/online/en-us/connected_apps_scopes.htm), [Server-Windows](https://help.tableau.com/current/server/en-us/connected_apps_scopes.htm), or [Server-Linux](https://help.tableau.com/current/server-linux/en-us/connected_apps_scopes.htm).

#### URI

PUT /api/api-version/sites/site-luid/users/user-luid/uploadSavedCreds

#### URI Parameter Values

<table class="api-parameters-table"><colgroup><col class="api-parameters-table-col-1-wide"> <col></colgroup><tbody><tr><td><span class="api-placeholder">api-version</span></td><td>The version of the API to use, such as <code><span class="mc-variable Variables.REST-API-Version variable">3.29</span></code>. For more information, see <a href="https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_versions.htm" class="xref">REST API and Resource Versions</a>.</td></tr><tr><td><span class="api-placeholder">site-luid</span></td><td>The LUID for the site.</td></tr><tr><td><span class="api-placeholder">user-luid</span></td><td>The LUID of the user whose credentials you want to upload.</td></tr></tbody></table>

#### Request Body

```
<tsRequest>
  <associatedUserLuidMapping/>
  <encryptedKeychainList>
    <encryptedKeychain>BADsJ5lBKho2Tdqqbo7txS8IyGlBu9LiRyb8etCHJLhBUurgIRHk3g5AeMQg6KHBw+6nwNIDEd65MKi76DLd5aIMhQC5aLCR4NE7R2gp7JbxLo+nOMGnfDQm5XekJVpLQGfY53GIX52ED2iTfOQ0yRNbnPV4djT0z23rosG0gpmqXV/GlBu9LiRyb8wx8RisnZdvv+SAlv222jVhksX1w5A6HB3Bs45BeWfpwrOnHwnNoWUGwHuu4iGlyE7m65RlATZN+fvDGOFN1zU2lXaSZyWqRKiWkD+oGlBu9LiRyb8Gz7RnesKvH6QEL9sT8cXA1ZOEA531xNAv9rjazEP5BssIdA1GcJ5J7zar5xxC68qm3cz3MkndyqWXZrf0vWPgwysUHEpWn60oDG/8/xG6c0Eigh4gwE+dA+NF1GlBu9LiRyb8+AzJ7vatf95LDwAuRT43G3Q+WApx9qBPXco15pKjwy00rHPgn4cRtu+unwh6d3gIh6AbK6X++U/vV/Ktpe31lSZmV8eHPeTNfdCrGOT9ozZhF5oKGlBu9LiRyb8tf1YcXawh3bvtZxg9d8a2mKNXDeaF+uJrpI43aFa4KrJKdfvDpq2k0aJhL1QNxWSFBYw0tPJX/rhKAeOHHY2K44Wh5JNWwL+x1uYap93IK303sJ1GlBu9LiRyb8UhfIW7o5iUtbYWrpCvVwubZLf4U5Y=
    <encryptedKeychain>
  </encryptedKeychainList>
</tsRequest>
```

```
{
  "associatedUserLuidMapping": [],
  "encryptedKeychainList": {
    "encryptedKeychain": "BADsJ5lBKho2Tdqqbo7txS8IyGlBu9LiRyb8etCHJLhBUurgIRHk3g5AeMQg6KHBw+6nwNIDEd65MKi76DLd5aIMhQC5aLCR4NE7R2gp7JbxLo+nOMGnfDQm5XekJVpLQGfY53GIX52ED2iTfOQ0yRNbnPV4djT0z23rosG0gpmqXV/GlBu9LiRyb8wx8RisnZdvv+SAlv222jVhksX1w5A6HB3Bs45BeWfpwrOnHwnNoWUGwHuu4iGlyE7m65RlATZN+fvDGOFN1zU2lXaSZyWqRKiWkD+oGlBu9LiRyb8Gz7RnesKvH6QEL9sT8cXA1ZOEA531xNAv9rjazEP5BssIdA1GcJ5J7zar5xxC68qm3cz3MkndyqWXZrf0vWPgwysUHEpWn60oDG/8/xG6c0Eigh4gwE+dA+NF1GlBu9LiRyb8+AzJ7vatf95LDwAuRT43G3Q+WApx9qBPXco15pKjwy00rHPgn4cRtu+unwh6d3gIh6AbK6X++U/vV/Ktpe31lSZmV8eHPeTNfdCrGOT9ozZhF5oKGlBu9LiRyb8tf1YcXawh3bvtZxg9d8a2mKNXDeaF+uJrpI43aFa4KrJKdfvDpq2k0aJhL1QNxWSFBYw0tPJX/rhKAeOHHY2K44Wh5JNWwL+x1uYap93IK303sJ1GlBu9LiRyb8UhfIW7o5iUtbYWrpCvVwubZLf4U5Y="
  }
}
```

#### Request Attributes

<table class="api-parameters-table">
                                <colgroup>
                                    <col class="api-parameters-table-col-1">
                                    <col>
                                </colgroup>
                                <tbody>
                                    <tr>
                                        <td><code>associatedUserLuidMapping</code>
                                        </td>
                                        <td>
                                            <p>
								(Required) The user IDs from the source site mapped to destination site user IDs.</p>
                                        </td>
                                    </tr>
                                    <tr>
                                        <td><code>encryptedKeychainList</code>
                                        </td>
                                        <td>(Required) List of encrypted keychains from the source Tableau Server.</td>
                                    </tr>
                                </tbody>
                            </table>

#### cURL Request Example

```
curl --location --request GET "https://example.com/api/3.24/sites/a946d998-2ead-4894-bb50-1054a91dcab3/users/6ae4a163-d073-4ab2-9668-954bab4b029e/uploadSavedCreds"  --header "Content-Type: application/json"  --data "<associatedUserLuidMapping/>     <encryptedKeychainList>         <encryptedKeychain>BADsJ5lBKho2Tdqqbo7txS8IyGlBu9LiRyb8etCHJLhBUurgIRHk3g5AeMQg6KHBw+6nwNIDEd65MKi76DLd5aIMhQC5aLCR4NE7R2gp7JbxLo+nOMGnfDQm5XekJVpLQGfY53GIX52ED2iTfOQ0yRNbnPV4djT0z23rosG0gpmqXV/GlBu9LiRyb8wx8RisnZdvv+SAlv222jVhksX1w5A6HB3Bs45BeWfpwrOnHwnNoWUGwHuu4iGlyE7m65RlATZN+fvDGOFN1zU2lXaSZyWqRKiWkD+oGlBu9LiRyb8Gz7RnesKvH6QEL9sT8cXA1ZOEA531xNAv9rjazEP5BssIdA1GcJ5J7zar5xxC68qm3cz3MkndyqWXZrf0vWPgwysUHEpWn60oDG/8/xG6c0Eigh4gwE+dA+NF1GlBu9LiRyb8+AzJ7vatf95LDwAuRT43G3Q+WApx9qBPXco15pKjwy00rHPgn4cRtu+unwh6d3gIh6AbK6X++U/vV/Ktpe31lSZmV8eHPeTNfdCrGOT9ozZhF5oKGlBu9LiRyb8tf1YcXawh3bvtZxg9d8a2mKNXDeaF+uJrpI43aFa4KrJKdfvDpq2k0aJhL1QNxWSFBYw0tPJX/rhKAeOHHY2K44Wh5JNWwL+x1uYap93IK303sJ1GlBu9LiRyb8UhfIW7o5iUtbYWrpCvVwubZLf4U5Y=         <encryptedKeychain> 	</encryptedKeychainList>"
```

#### Response Code

200

#### Response Body

None.

#### Errors

<table class="api-error-table">
                        <colgroup>
                            <col class="api-error-table-col-1">
                            <col class="api-error-table-col-2">
                            <col class="api-error-table-col-3">
                            <col>
                        </colgroup>
                        <tbody>
                            <tr>
                                <th>HTTP status</th>
                                <th><code>error</code> Code</th>
                                <th>Condition</th>
                                <th>Details</th>
                            </tr>
                            <tr>
                                <td>400</td>
                                <td>400000</td>
                                <td>Bad Request</td>
                                <td>The content of the request body is missing or incomplete, or contains malformed XML.</td>
                            </tr>
                            <tr>
                                <td>401</td>
                                <td>401002</td>
                                <td>Unauthorized Access</td>
                                <td>
                                    <p>The authentication token provided in the request header was invalid or has expired.</p>
                                </td>
                            </tr>
                            <tr>
                                <td>403</td>
                                <td>403054</td>
                                <td>Unauthorized Access</td>
                                <td>A non-administrator user attempted to get data source revision information, but the caller doesn't have sufficient permissions.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404000</td>
                                <td>Site not found</td>
                                <td>The site ID in the URI doesn't correspond to an existing site.</td>
                            </tr>
                            <tr>
                                <td>404</td>
                                <td>404002
                    </td>
                                <td>User not found</td>
                                <td>The user ID in the URI doesn't correspond to an existing user.</td>
                            </tr>
                            <tr>
                                <td>405</td>
                                <td>405000</td>
                                <td>Invalid request method</td>
                                <td>Request type was not <span class="api-command-ref">PUT</span>.</td>
                            </tr>
                        </tbody>
                    </table>

For more information, see [Handling Errors](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_concepts_errors.htm).