Generate an embed session
sessionId.
The session captures the embed context that will be baked into the embed token once redeemed — the target deploymentId, the end user’s identity (externalId / email / userProfile), their group memberships, userAttributes, and an optional securityContext. Exchange the returned sessionId for a signed embed JWT via POST /api/v1/embed/session/token (single use).
The end user can be assigned to two independent kinds of group, which serve different purposes:
groups— global, tenant-wide groups for data-model access control. Their names are passed verbatim into the Cube security context (cubeCloud.groups), where your data model’saccess_policyrules use them to gate cubes, views, members, and row-/column-level filters. They must already exist in the tenant.tenantGroups— per-embed-tenant groups for sharing and organizing content within a single embed tenant (e.g. sharing a workbook or dashboard with a group in Creator Mode). RequirescreatorMode: trueandembedTenantName; create them inline viatenantGroupDefinitions. In the security context they are namespaced assystem:tenant:{embedTenantName}:group:{group}, so they never collide with a same-named global group.
deploymentId is required and the caller must have read access to it. Embedding must be enabled for the tenant, otherwise 403 is returned.Authorizations
Token authentication. Send Authorization: Bearer <YOUR_TOKEN>.
Body
GenerateSessionDTO
^[a-z][a-z0-9-]{0,34}[a-z0-9]$Deprecated and ignored. Global groups can no longer be created through this endpoint — define them beforehand via the Cube Cloud UI or admin API. Still accepted for backward compatibility (no error), but it has no effect. To create per-embed-tenant groups, use tenantGroupDefinitions.
Global user groups — defined once at the tenant level and shared across every embed tenant — to assign this embed user to. Use groups for data-model access control: each name is placed verbatim into the Cube security context as cubeCloud.groups, where your data model's access_policy rules reference it to gate cubes, views, members, and row-/column-level filters. The groups must already exist in the tenant (create them via the Cube Cloud UI or admin API beforehand) — this endpoint never creates global groups, and names that do not resolve to an existing group are rejected. Global groups are NOT shown in an embed tenant’s Creator Mode UI. To share or organize content inside a single embed tenant, use tenantGroups instead.
Per-session overrides for embed behavior. Each key is tri-state: omit it to inherit the account-wide setting, or set true/false to force the behavior for every embed viewed with this session, taking precedence over the account-wide setting.
Idempotently create or update the per-embed-tenant groups referenced by tenantGroups, before they are assigned. Requires creatorMode: true and embedTenantName. Use this to declare a tenant’s groups in the same call that assigns them, so you do not need a separate admin request. Applies only to per-embed-tenant groups; global groups must be defined beforehand.
Per-embed-tenant user groups — scoped to the single embed tenant named by embedTenantName — to assign this embed user to. Use tenantGroups for content sharing and organization within one embed tenant: for example, so a creator can share a workbook, dashboard, or folder with a group of that tenant’s users. These are the only groups shown in the embed tenant’s Creator Mode UI. Requires creatorMode: true and embedTenantName. Define the groups beforehand — or in the same request — via tenantGroupDefinitions. In the Cube security context they appear namespaced as system:tenant:{embedTenantName}:group:{groupName}, so a tenant group can never collide with — or be mistaken for — a global groups entry of the same name. For organization-wide data-model access policies, use groups.