Generate an embed session

Global user groups — defined once at the tenant level and shared across every embed tenant — to assign this embed user to. Use groups for data-model access control: each name is placed verbatim into the Cube security context as cubeCloud.groups, where your data model's access_policy rules reference it to gate cubes, views, members, and row-/column-level filters. The groups must already exist in the tenant (create them via the Cube UI or admin API beforehand) — this endpoint never creates global groups, and names that do not resolve to an existing group are rejected. Global groups are NOT shown in an embed tenant’s Creator Mode UI. To share or organize content inside a single embed tenant, use tenantGroups instead.

Per-embed-tenant user groups — scoped to the single embed tenant named by embedTenantName — to assign this embed user to. Use tenantGroups for content sharing and organization within one embed tenant: for example, so a creator can share a workbook, dashboard, or folder with a group of that tenant’s users. These are the only groups shown in the embed tenant’s Creator Mode UI. Requires creatorMode: true and embedTenantName. Define the groups beforehand — or in the same request — via tenantGroupDefinitions. In the Cube security context they appear namespaced as system:tenant:{embedTenantName}:group:{groupName}, so a tenant group can never collide with — or be mistaken for — a global groups entry of the same name. For organization-wide data-model access policies, use groups.