Version: Available in API 3.21 (Tableau Cloud October 2023) and later.Version Overview(Link opens in a new window)

License: No additional license required.

Permissions: Any Tableau Cloud user. If you're a Tableau Cloud site admin, you can list the PATs of a user when you are the site admin on all sites that the PAT owner is a member of. Permissions Overview(Link opens in a new window)

JWT Access Scope: Not available.

URI

GET /api/api-version/sites/site-luid/users/user-luid/personal-access-tokens

URI Parameter Values

Request Body

None

cURL Request Example

curl "http://myco/api/3.27/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/d5704762-603a-42b2-a9a7-f9cd2b2c4253/personal-access-tokens" -X GET -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"

Response Code

200

Response Body

<tsResponse>
    <personalAccessTokens>
        <personalAccessToken tokenName="user_pat1" tokenGuid="011b6267-a067-473a-9d16-b34cc58f90df" lastUsedAt="2023-06-13T16:55:46Z" expiresAt="2024-06-12T16:55:46Z"/>
        <personalAccessToken tokenName="user_pat4" tokenGuid="0fb30637-b638-4ce2-bbac-ac6611104ed9" lastUsedAt="2023-06-13T16:55:51Z" expiresAt="2024-06-12T16:55:51Z"/>
        <personalAccessToken tokenName="user_pat5" tokenGuid="db8c0b5d-5946-4f7c-a966-af334a3d10a5" lastUsedAt="2023-06-13T16:55:56Z" expiresAt="2024-06-12T16:55:56Z"/>
    </personalAccessTokens>
</tsResponse>

{
  "personalAccessTokens": [
    {
      "tokenName": "user_pat1",
      "tokenGuid": "011b6267-a067-473a-9d16-b34cc58f90df",
      "lastUsedAt": "2023-06-13T16:55:46Z",
      "expiresAt": "2024-06-12T16:55:46Z"
    },
    {
      "tokenName": "user_pat4",
      "tokenGuid": "0fb30637-b638-4ce2-bbac-ac6611104ed9",
      "lastUsedAt": "2023-06-13T16:55:51Z",
      "expiresAt": "2024-06-12T16:55:51Z"
    },
    {
      "tokenName": "user_pat5",
      "tokenGuid": "db8c0b5d-5946-4f7c-a966-af334a3d10a5",
      "lastUsedAt": "2023-06-13T16:55:56Z",
      "expiresAt": "2024-06-12T16:55:56Z"
    }
  ]
}

URI

DELETE /api/api-version/auth/serverAdminAccessTokens

Parameter Values

Request Body

None

Permissions

Only Tableau Server users with server administrator permissions can use this method.

Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

tableau:server_admin_tokens:delete

For more information, seeAccess scopes for UATs(Link opens in a new window) (Cloud)and access scopes for connected apps:Cloud(Link opens in a new window),Server-Windows(Link opens in a new window),orServer-Linux(Link opens in a new window).

Response Code

204

Response Body

None

Version

Version 3.11 and later. For more information, seeREST API and Resource Versions.

Errors

For more information, seeHandling Errors.

Version: Available in API 3.21 (Tableau Cloud October 2023) and later.Version Overview(Link opens in a new window)

License: No additional license required.

Permissions: Any Tableau Cloud user. If you're a Tableau Cloud site admin, you can revoke the PAT of a user when you are the site admin on all sites that the PAT owner is a member of. Permissions Overview(Link opens in a new window)

JWT Access Scope: Not available.

URI

DELETE /api/api-version/sites/site-luid/users/user-luid/personal-access-tokens/pat-name

URI Parameter Values

Request Body

None

cURL Request Example

curl "http://myco/api/3.27/sites/9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d/users/d5704762-603a-42b2-a9a7-f9cd2b2c4253/personal-access-tokens/my_pat" -X DELETE -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"

Response Code

204

Response Body

None

Notes:

• SAML single sign on(Link opens in a new window) (SSO) authentication does not validate REST API requests. For a scenario where you want to integrate Tableau authentication into a SSO environment you will need to incorporate a REST sign in request, and then use the credentials token from its response in the header of subsequent requests.

• The credentials token is valid for REST API calls and Tableau Metadata API (GraphQL) queries. You cannot use the credentials token as authentication for other operations with Tableau Server. In addition, the credentials token is good only for operations in the site that you're signed in to. You cannot sign in to one site and then use the credentials token you get back to send requests to a different site. If you do, the server returns an HTTP403 (Forbidden) error.

• (Tableau Cloud only) If multi-factor authentication (MFA) is enabled with Tableau authentication, PATs are required. You must use a PAT, instead of user name and password, to make a REST API sign in request to Tableau Cloud.

URI

POST /api/api-version/auth/signin

Note: For Tableau Cloud, the server address in the URI must contain the pod name, such as prod-ca-a or us-east-1. For example, the URI to sign in to a site in the 10ay pod would be:https://prod-ca-a.online.tableau.com/api/api-version/auth/signin. For more information, seeAbout the pod name.

Parameter Values

Request Body

PAT

Signing in with a user's personal access token (PAT): 

• For Tableau Server, seepersonal access token(Link opens in a new window).
• For Tableau Cloud, seepersonal access token(Link opens in a new window).

<tsRequest>  <credentials personalAccessTokenName="personal-access-token-name"    personalAccessTokenSecret="personal-access-token-secret" >      <site contentUrl="content-url" />  </credentials></tsRequest>

User name and password

Signing in with a user's user name and password:

<tsRequest>  <credentials name="username" password="password" >    <site contentUrl="content-url" />  </credentials></tsRequest>

Impersonating user using username and password

Signing in with server administrator's username and password to impersonate a user (Tableau Server only):

<tsRequest>  <credentials name="username" password="password" ><site contentUrl="content-url" /><userapi-placeholder">user-to-impersonate" />  </credentials></tsRequest>

Impersonating user using PAT

Signing in with server administrator'spersonal access token(Link opens in a new window) (PAT) to impersonate a user (Tableau Server only):

<tsRequest>  <credentials personalAccessTokenName="personal-access-token-name"    personalAccessTokenSecret="personal-access-token-secret" >  <site contentUrl="content-url" />  <userapi-placeholder">user-to-impersonate" />  </credentials></tsRequest>

Connected apps JWT

Signing in with a JSON Web Token (JWT), from aconnected app(Link opens in a new window) (added in Tableau Cloud June 2022 (API 3.16); Tableau Server 2022.3 (API 3.17)):

<tsRequest>  <credentials jwt="json-web-token"  <site contentUrl="content-url" />  </credentials></tsRequest>

When a JWT sign-in is used, the JWT must be configured with the scopes of the REST API methodsthe connected app can access. You can find the scope for a JWT-supported method in a method's properties block or references details under theAccess scope section. These sections show the scope declaration to use in the JWT that calls that method. You can also see a full list of JWT-supported scopes inREST API methods that support JWT authorization(Link opens in a new window) (Tableau Cloud Help) orREST API methods that support JWT authorization(Link opens in a new window) (Tableau Server Help).

Note: Beginning in API 3.20 (June 2023) for Tableau Cloud and API 3.21 (Tableau 2023.3) for Tableau Server, the Sign In (and Sign Out) method is supported by JWT authorization but does not require a scope to use.

About connected app errors

If you encounter issues with signing in with a JWT, the response body is appended with an additional error code that you can reference inTroubleshoot scopes(Link opens in a new window) (Tableau Cloud Help) orTroubleshoot scopes(Link opens in a new window) (Tableau Server Help). For example, in the following response body, you can reference “10084” to help troubleshoot issues with signing in to Tableau Cloud or Tableau Server using a JWT for REST API authorization.

<error code="401001">  "summary": "Signin Error",  "detail": "Error signing in to Tableau Cloud (10084)"</error>

Unified access tokens JWT

Signing in with a JSON Web Token (JWT) using a unified access token (added in Tableau Cloud December 2025 (API 3.27)):

XML

<tsRequest>  <credentials jwt="json-web-token"isUat="true"  <site contentUrl="content-url" />  </credentials></tsRequest>

JSON

{"credentials": {"jwt": "json-web-token","isUat": is-uat,"site": {"contentUrl": ""}}}

When a JWT sign-in is used, the JWT must be configured with the scopes for the REST API capabilities that should be available to the unified access token (UAT). You can find the scope for a JWT-supported method in a method's properties block. The properties block shows the scope declaration to use in the JWT that calls that method. If a scope is not listed in the method's properties block, access to that method can't be limited by a JWT.

For more information about UATs, seeUnified Access Tokens(Link opens in a new window) in the Tableau Cloud Manager REST API Help.

Attribute Values

Permissions

Any Tableau user can sign in through the REST API. A user that does not have administrator permissions will have limited permissions to perform subsequent operations. Only server administrators can sign in with username and password in order to impersonate other Tableau Server users.

Response Code

200

Response Body

<tsResponse>  <credentials token="authentication-token"  estimatedTimeToExpiration="time-to-expiration" >    <siteapi-placeholder">site-id" contentUrl="content-url" />    <userapi-placeholder">user-id-of-signed-in-user"  </credentials></tsResponse>

AnestimatedTimeToExpiration value is returned when you sign in using a PAT. The value represents the approximate timeuntil the token returned from the PAT sign in will expire and need to be refreshed. The estimated time is based on regular usage of thetoken for authenticating calls, but actual time may be shorter if the token is unused for an extended length of time.

Version

Version 1.0 and later. For more information, seeREST API and Resource Versions.

Errors

For more information, seeHandling Errors.

Example

curl "https://MY-SERVER/api/3.27/auth/signin" -X POST -d @signin.xml

Content of signin.xml:

<tsRequest>  <credentials personalAccessTokenName="MY_PAT_NAME"personalAccessTokenSecret="vFel4qtGTZ2+Po0ZWT7YWg==:nMmSHnQ5kJBP17ZtsBgPtuVWdYJFAbBG"  >      <site contentUrl="MarketingSite" />  </credentials></tsRequest>

Example response:

<tsResponseversion-and-namespace-settings>  <credentials token="HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3">    <site          contentUrl="MarketingSite"/>  </credentials></tsResponse>

URI

POST /api/api-version/auth/signout

Parameter Values

Request Body

None

Permissions

Any user can call this method.

Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

tableau:*:*

For more information, seeAccess scopes for UATs(Link opens in a new window) (Cloud)and access scopes for connected apps:Cloud(Link opens in a new window),Server-Windows(Link opens in a new window),orServer-Linux(Link opens in a new window).

Response Code

204

Response Body

None

Version

Version 1.0 and later. For more information, seeREST API and Resource Versions.

Errors

For more information, seeHandling Errors.

Example

curl "http://MY-SERVER/api/3.27/auth/signout" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"

URI

POST /api/api-version/auth/switchSite

Parameter Values

Request Body

<tsRequest>   <site contentUrl="content-url" /></tsRequest>

Attribute Values

Permissions

Tableau Server users who are not server administrators can switch sites, provided that they have access to the destination site.

Access Scope

Scope added in API 3.27 (Tableau Cloud December 2025 / Server 2025.3).

tableau:sites:switch

For more information, seeAccess scopes for UATs(Link opens in a new window) (Cloud)and access scopes for connected apps:Cloud(Link opens in a new window),Server-Windows(Link opens in a new window),orServer-Linux(Link opens in a new window).

Response Code

200

Response Body

<tsResponse>  <credentials token="authentication-token" >    <siteapi-placeholder">site-id" contentUrl="content-url" />    <userapi-placeholder">user-id-of-signed-in-user" />  </credentials></tsResponse>

Version

Version 2.6 and later. For more information, seeREST API and Resource Versions.

Errors

For more information, seeHandling Errors.

Example

curl "https://MY-SERVER/api/3.27/auth/switchSite" -X POST -H "X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd"-d @switch_site.xml

Content of switch_site.xml:

<tsRequest>   <site contentUrl="MarketingSite" /></tsRequest>

Example response:

<tsResponseversion-and-namespace-settings>  <credentials token="HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3">    <site          contentUrl="MarketingSite"/>  </credentials></tsResponse>