---
title: "Provision embed users in bulk"
method: POST
path: "/api/v1/embed-tenants/{embedTenantName}/users"
tags: ["Embed Tenants"]
---

# Provision embed users in bulk

`POST /api/v1/embed-tenants/{embedTenantName}/users`

## Path parameters

- `embedTenantName` string, required

## Request body

- ProvisionEmbedUsersInput
  - `users` ProvisionEmbedUserInput[], required — Embed users to provision (1–100 per request).
    - `email` string, email, nullable — Email address, shown wherever the user is listed and searchable through `GET /embed-tenants/{embedTenantName}/users`. Must be a valid address, and is stored lowercased. Omit it and Cube derives a synthetic `{externalId}@cubecloud.dev` placeholder instead, which is what makes a user hard to recognise in a list. Supplying it again later updates the stored address.
    - `externalId` string, required — The id your own system knows this user by — the same `externalId` you will pass to `generate-session`. Trimmed and lowercased before it is stored, so casing never produces a second user.
    - `groups` string[], nullable — Global, account-wide groups (the `groups` field of `generate-session`) that gate data-model access. They must already exist. Supplying the field REPLACES the user’s global groups; omit it to leave them untouched, pass `[]` to clear them.
    - `tenantGroups` string[], nullable — Groups belonging to this embed tenant (the `tenantGroups` field of `generate-session`), which scope content sharing and organization within the tenant. Create them first via `POST /embed-tenants/{embedTenantName}/groups`. Supplying the field REPLACES the user’s tenant groups; omit it to leave them untouched, pass `[]` to clear them.
    - `userProfile` EmbedUserProfile
      - `displayName` string, nullable
      - `picture` string, url, nullable

## Response `200`

- ProvisionEmbedUsersResponse
  - `failed` ProvisionEmbedUserFailure[], required — The entries that were not applied, each with the reason.
    - `error` BulkActionError, required
      - `message` string, required
      - `status` integer, required
    - `externalId` string, required — The `externalId` of the entry that failed, normalized the same way a successful one is.
  - `succeeded` EmbedUser[], required — The users that were provisioned, in the order they were requested.
    - `createdAt` union
      - string, date
      - string, date-time
    - `email` string, nullable
    - `externalId` string, nullable
    - `firstName` string, nullable
    - `id` integer, required
    - `lastLogin` union
      - string, date
      - string, date-time
    - `username` string, required

## Changes

- **2026-08-30** `3adb3c5e66ca` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cube-js/apis/cube-cloud-rest-api/changes/api/v1/embed-tenants/:embedTenantName/users/post.md)

---

[API](https://skmtc.dev/cube-js/apis/cube-cloud-rest-api.md) · [All operations](https://skmtc.dev/cube-js/apis/cube-cloud-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cube-js/cube-cloud-rest-api/revisions/3adb3c5e66ca/schema)