> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cube.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Provision embed users in bulk

**🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.

Provisions up to 100 embed users in one request, each exactly as `POST /embed-tenants/{embedTenantName}/user` would. Use it to load a user directory into an embed tenant, and send further requests to cover a directory larger than one batch.

**This endpoint is partially successful.** It returns `200` whenever the request itself is well formed, and reports each user separately:

* `succeeded` — the users that were provisioned, in the order requested.
* `failed` — the entries that were not, each with the `externalId` and an `error` carrying the `status` and `message` the single-user endpoint would have returned (`400` for a group name that does not exist, `429` once the tenant is at its embed-user limit).

Users are applied one at a time in the order given, and earlier ones are not rolled back when a later one fails. Since provisioning is idempotent, resending the whole batch after fixing the failures is safe. A repeated `externalId` within one batch is applied once per entry, so the last one wins.


## OpenAPI

````yaml /api-reference/api.yaml post /api/v1/embed-tenants/{embedTenantName}/users
openapi: 3.1.0
info:
  title: Cube Platform API
  version: 1.0.0
  description: >-
    Programmatically manage Cube: deployments and everything scoped to them

    (environments, folders, reports, workbooks, notifications, workspace, and
    agents),

    plus account-level users, groups, policies, embedding, and AI settings.
    Data-model

    authoring, dev mode, branches, and uploads live under /build/api/v1 — same
    host and

    token, routed to the build pods.
servers:
  - url: https://{tenant}.cubecloud.dev
    description: Your tenant host. Replace the whole host if you use a custom domain.
    variables:
      tenant:
        default: your-tenant
        description: Your Cube tenant subdomain
security:
  - bearerAuth: []
tags:
  - name: Deployments
  - name: Deployment Creation
  - name: Environments
  - name: Env Variables
  - name: Regions
  - name: Data Model
  - name: Data Model Uploads
  - name: GitHub
  - name: GitHub Connection
  - name: dbt Sync
  - name: Folders
  - name: Reports
  - name: Workbooks
  - name: Notifications
  - name: Workspace
  - name: Users Admin
  - name: User Attributes
  - name: User Attribute Values
  - name: Tenant Settings
  - name: OAuth Integrations
  - name: User OAuth Tokens
  - name: OIDC Token Configs
  - name: App Theme
  - name: Embed
  - name: Embed Tenants
  - name: Dashboard Embed Access
  - name: Usage Analytics
  - name: OpenAPI Spec
paths:
  /api/v1/embed-tenants/{embedTenantName}/users:
    post:
      tags:
        - Embed Tenants
      summary: Provision embed users in bulk
      operationId: provisionEmbedUsers
      parameters:
        - in: path
          name: embedTenantName
          required: true
          schema:
            type: string
          description: >-
            Name of the embed tenant (the `embedTenantName` used to generate
            embed sessions).
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProvisionEmbedUsersInput'
        description: ProvisionEmbedUsersInput
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProvisionEmbedUsersResponse'
          description: ''
components:
  schemas:
    ProvisionEmbedUsersInput:
      properties:
        users:
          description: Embed users to provision (1–100 per request).
          items:
            $ref: '#/components/schemas/ProvisionEmbedUserInput'
          maxItems: 100
          minItems: 1
          type: array
      required:
        - users
      type: object
    ProvisionEmbedUsersResponse:
      properties:
        failed:
          description: The entries that were not applied, each with the reason.
          items:
            $ref: '#/components/schemas/ProvisionEmbedUserFailure'
          type: array
        succeeded:
          description: The users that were provisioned, in the order they were requested.
          items:
            $ref: '#/components/schemas/EmbedUser'
          type: array
      required:
        - succeeded
        - failed
      type: object
    ProvisionEmbedUserInput:
      properties:
        email:
          oneOf:
            - format: email
              type: string
              description: >-
                Email address, shown wherever the user is listed and searchable
                through `GET /embed-tenants/{embedTenantName}/users`. Must be a
                valid address, and is stored lowercased. Omit it and Cube
                derives a synthetic `{externalId}@cubecloud.dev` placeholder
                instead, which is what makes a user hard to recognise in a list.
                Supplying it again later updates the stored address.
            - type: 'null'
        externalId:
          description: >-
            The id your own system knows this user by — the same `externalId`
            you will pass to `generate-session`. Trimmed and lowercased before
            it is stored, so casing never produces a second user.
          minLength: 1
          type: string
        groups:
          oneOf:
            - items:
                type: string
              type: array
              description: >-
                Global, account-wide groups (the `groups` field of
                `generate-session`) that gate data-model access. They must
                already exist. Supplying the field REPLACES the user’s global
                groups; omit it to leave them untouched, pass `[]` to clear
                them.
            - type: 'null'
        tenantGroups:
          oneOf:
            - items:
                type: string
              type: array
              description: >-
                Groups belonging to this embed tenant (the `tenantGroups` field
                of `generate-session`), which scope content sharing and
                organization within the tenant. Create them first via `POST
                /embed-tenants/{embedTenantName}/groups`. Supplying the field
                REPLACES the user’s tenant groups; omit it to leave them
                untouched, pass `[]` to clear them.
            - type: 'null'
        userProfile:
          oneOf:
            - $ref: '#/components/schemas/EmbedUserProfile'
              type: object
              description: >-
                Display name and avatar. `displayName` is the name shown
                wherever the user appears, including on content they author.
                Omitted fields keep their current value.
            - type: 'null'
      required:
        - externalId
      type: object
    ProvisionEmbedUserFailure:
      properties:
        error:
          $ref: '#/components/schemas/BulkActionError'
        externalId:
          description: >-
            The `externalId` of the entry that failed, normalized the same way a
            successful one is.
          type: string
      required:
        - externalId
        - error
      type: object
    EmbedUser:
      properties:
        createdAt:
          oneOf:
            - oneOf:
                - format: date
                  type: string
                - format: date-time
                  type: string
            - type: 'null'
        email:
          oneOf:
            - type: string
            - type: 'null'
        externalId:
          oneOf:
            - type: string
            - type: 'null'
        firstName:
          oneOf:
            - type: string
            - type: 'null'
        id:
          type: integer
        lastLogin:
          oneOf:
            - oneOf:
                - format: date
                  type: string
                - format: date-time
                  type: string
            - type: 'null'
        username:
          type: string
      required:
        - id
        - username
      type: object
    EmbedUserProfile:
      properties:
        displayName:
          oneOf:
            - type: string
            - type: 'null'
        picture:
          oneOf:
            - format: url
              type: string
            - type: 'null'
      type: object
    BulkActionError:
      properties:
        message:
          type: string
        status:
          type: integer
      required:
        - status
        - message
      type: object
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Token authentication. Send `Authorization: Bearer <YOUR_TOKEN>`.'

````