Provision an embed user
externalId that already exists updates it rather than failing. email, userProfile.displayName and userProfile.picture are overwritten when supplied and preserved when omitted; each group lane is REPLACED when supplied, preserved when omitted, and cleared by []. The embed tenant itself is created on demand, so it need not exist yet.
Everything set here is exactly what generate-session would have set, and a later session for the same externalId re-applies whatever it carries β so provisioning changes when a user exists, never what their session grants them.Authorizations
Token authentication. Send Authorization: Bearer <YOUR_TOKEN>.
Path Parameters
Name of the embed tenant (the embedTenantName used to generate embed sessions).
Body
ProvisionEmbedUserInput
The id your own system knows this user by β the same externalId you will pass to generate-session. Trimmed and lowercased before it is stored, so casing never produces a second user.
1Email address, shown wherever the user is listed and searchable through GET /embed-tenants/{embedTenantName}/users. Must be a valid address, and is stored lowercased. Omit it and Cube derives a synthetic {externalId}@cubecloud.dev placeholder instead, which is what makes a user hard to recognise in a list. Supplying it again later updates the stored address.
Global, account-wide groups (the groups field of generate-session) that gate data-model access. They must already exist. Supplying the field REPLACES the userβs global groups; omit it to leave them untouched, pass [] to clear them.
Groups belonging to this embed tenant (the tenantGroups field of generate-session), which scope content sharing and organization within the tenant. Create them first via POST /embed-tenants/{embedTenantName}/groups. Supplying the field REPLACES the userβs tenant groups; omit it to leave them untouched, pass [] to clear them.
Display name and avatar. displayName is the name shown wherever the user appears, including on content they author. Omitted fields keep their current value.