Skip to main content
POST
Provision an embed user

Authorizations

Authorization
string
header
required

Token authentication. Send Authorization: Bearer <YOUR_TOKEN>.

Path Parameters

embedTenantName
string
required

Name of the embed tenant (the embedTenantName used to generate embed sessions).

Body

application/json

ProvisionEmbedUserInput

externalId
string
required

The id your own system knows this user by β€” the same externalId you will pass to generate-session. Trimmed and lowercased before it is stored, so casing never produces a second user.

Minimum string length: 1
email
string<email> | null

Email address, shown wherever the user is listed and searchable through GET /embed-tenants/{embedTenantName}/users. Must be a valid address, and is stored lowercased. Omit it and Cube derives a synthetic {externalId}@cubecloud.dev placeholder instead, which is what makes a user hard to recognise in a list. Supplying it again later updates the stored address.

groups
string[] | null

Global, account-wide groups (the groups field of generate-session) that gate data-model access. They must already exist. Supplying the field REPLACES the user’s global groups; omit it to leave them untouched, pass [] to clear them.

tenantGroups
string[] | null

Groups belonging to this embed tenant (the tenantGroups field of generate-session), which scope content sharing and organization within the tenant. Create them first via POST /embed-tenants/{embedTenantName}/groups. Supplying the field REPLACES the user’s tenant groups; omit it to leave them untouched, pass [] to clear them.

userProfile
object | null

Display name and avatar. displayName is the name shown wherever the user appears, including on content they author. Omitted fields keep their current value.

Response

200 - application/json
id
integer
required
username
string
required
createdAt
email
string | null
externalId
string | null
firstName
string | null
lastLogin