---
schema_version: "1"
id: 3840808ce9ff9f2c860764a1f56f383c8d4efb22bb6a8a3fa01304b8a7444872
title: Authentication
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/api/tsm_api/docs/authentication.md
canonical_url: https://help.tableau.com/v0.0/api/tsm_api/en-us/docs/authentication.htm
source_site: help.tableau.com
content_type: documentation
content_hash: e20e87d22e87070a46d0521b34bcab22028cc9ec3ec77576dfcbb271c7175798
description: Documentation for Tableau Services Manager API
---
# Authentication

  

Because the TSM API allows you to perform administrative tasks, it requires authentication over HTTPS.

## User account requirements

The account you use to authenticate with TSM must exist on the Tableau Server computer. This user account must use password-based authentication.

Additional requirements depend on the operating system used to run Tableau Server:

- For Tableau Server on Windows, the user account must also be an administrator on the Tableau Server computer.
- For Tableau Server on Linux, the user account must also be a part of the `tsmadmin` group that is authorized to access TSM.

This user account is distinct from Tableau Server user accounts, including Tableau Server administrator and site administrator accounts.

### Add a user account to the tsmadmin group (Linux only)

When you first run the `initialize-tsm` script to start TSM as part of Tableau Server installation, the user account that you use to run the script is added to the `tsmadmin` group. If you run the script and use the `-u` option to specify a different user account, that user account is used to run the script and then added to the `tsmadmin` group. The `initialize-tsm` script is in the `/opt/tableau/tableau_server/packages/scripts.<version>` directory.

To add an existing user account to the `tsmadmin` group after you have already run the `initialize-tsm` script, use the Linux `usermod` command with the `-a` (append) and `-G` (groups) options:

`usermod -a -G tsmadmin <user>`

To create a new user account and add it to the `tsmadmin` group, use the following command:

`useradd -G tsmadmin <user>`

## HTTPS requirement

All requests and responses must be sent over HTTPS. By default, TSM uses a self-signed SSL certificate.  
As a result, you might see a warning that the request is not secure depending on the library that you use to send requests.You do not need to do anything to enable SSL for TSM. Just specify `https` in the URI.

## Signing in to TSM

Send a POST request to the `login` endpoint to authenticate to TSM:

```
https://your-server:8850/api/1.0/login
```

A login request must include the following:

**Content-type header**

The header must specify that the content-type is `application/json`.

**Authentication body**

The body of the request must include an authentication object that includes the user name and password.

For example, you might send the following body:

```
{
    "authentication": {
        "name": "username",
        "password": "password"
    }
}
```

A successful login request returns a 204 status code and an authentication cookie. Additional requests that you make to the TSM API must include a valid authentication cookie.

## Signing out of TSM

Send a POST request to the `logout` endpoint to invalidate your authentication cookie:

```
https://your-server:8850/api/1.0/logout
```

Alternatively, to invalidate all active authentication cookes for TSM, send a POST request to the `logout/all` endpoint:

```
https://your-server:8850/api/1.0/logout/all
```

A successful logout request returns a 204 status code.

## Sample login and logout requests

```
import json
import requests

session = requests.Session()
login_url = 'https://your-server:8850/api/1.0/login'
logout_url = 'https://your-server:8850/api/1.0/logout'

headers = {
    'content-type': 'application/json'
    }

body = {
    'authentication': {
        'name': 'username',
        'password': 'password'
        }
    }

# Configure the session to authenticate with the provided credentials.
# Do not verify the SSL certificate because this is a self-signed certificate.
session = requests.Session()

# Sign in
login_resp = session.post(login_url, data=json.dumps(body), headers=headers, verify=False)
print '{0}: {1}'.format(login_resp.status_code, login_url)

# Sign out
logout_resp = session.post(logout_url)
print '{0}: {1}'.format(logout_resp.status_code, logout_url)

```