---
title: "Provision an embed user"
method: POST
path: "/api/v1/embed-tenants/{embedTenantName}/user"
tags: ["Embed Tenants"]
---

# Provision an embed user

`POST /api/v1/embed-tenants/{embedTenantName}/user`

## Path parameters

- `embedTenantName` string, required

## Request body

- ProvisionEmbedUserInput
  - `email` string, email, nullable — Email address, shown wherever the user is listed and searchable through `GET /embed-tenants/{embedTenantName}/users`. Must be a valid address, and is stored lowercased. Omit it and Cube derives a synthetic `{externalId}@cubecloud.dev` placeholder instead, which is what makes a user hard to recognise in a list. Supplying it again later updates the stored address.
  - `externalId` string, required — The id your own system knows this user by — the same `externalId` you will pass to `generate-session`. Trimmed and lowercased before it is stored, so casing never produces a second user.
  - `groups` string[], nullable — Global, account-wide groups (the `groups` field of `generate-session`) that gate data-model access. They must already exist. Supplying the field REPLACES the user’s global groups; omit it to leave them untouched, pass `[]` to clear them.
  - `tenantGroups` string[], nullable — Groups belonging to this embed tenant (the `tenantGroups` field of `generate-session`), which scope content sharing and organization within the tenant. Create them first via `POST /embed-tenants/{embedTenantName}/groups`. Supplying the field REPLACES the user’s tenant groups; omit it to leave them untouched, pass `[]` to clear them.
  - `userProfile` EmbedUserProfile
    - `displayName` string, nullable
    - `picture` string, url, nullable

## Response `200`

- EmbedUser
  - `createdAt` union
    - string, date
    - string, date-time
  - `email` string, nullable
  - `externalId` string, nullable
  - `firstName` string, nullable
  - `id` integer, required
  - `lastLogin` union
    - string, date
    - string, date-time
  - `username` string, required

## Changes

- **2026-08-30** `3adb3c5e66ca` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cube-js/apis/cube-cloud-rest-api/changes/api/v1/embed-tenants/:embedTenantName/user/post.md)

---

[API](https://skmtc.dev/cube-js/apis/cube-cloud-rest-api.md) · [All operations](https://skmtc.dev/cube-js/apis/cube-cloud-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cube-js/cube-cloud-rest-api/revisions/3adb3c5e66ca/schema)