---
title: "Generate embedded SSO session"
method: POST
path: "/v1/embed/sso/generate-session"
tags: ["Embed"]
---

# Generate embedded SSO session

`POST /v1/embed/sso/generate-session`

## Request

- Base URL: `https://blobsrus.omniapp.co/api`
- URL: `https://blobsrus.omniapp.co/api/v1/embed/sso/generate-session`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

<Note>
  The [Embed](/embed) feature must be enabled in your Omni organization to use this endpoint.
</Note>

Generate an embedded SSO session.

## Request body

- object
  - `accessBoost` union: If `true`, enables [AccessBoost](/embed/setup/url-parameters/accessBoost) for the embedded dashboard. Requires AccessBoost to be enabled for non-administrators in **Settings > Content permissions**.
    - 'true' | 'false'
    - boolean
  - `connectionRoles` object: Map of connection IDs to base or custom role names, setting the level of access embed users have to the connection's models. Invalid or disallowed roles are ignored. See the [`connectionRoles` parameter reference](/embed/setup/url-parameters/connectionRoles) for accepted role values and omission behavior.
  - `customTheme` object: Custom dashboard theme properties. Values must be a valid [theme property](/embed/customization/themes). See the [`customTheme` parameter reference](/embed/setup/url-parameters/customTheme) for more information.
  - `groups` string[]: Optional list of non-entity group names to assign to the user. Entity-group membership is managed by the [`entity` URL parameter](/embed/setup/url-parameters/entity).
  - `modelRoles` object: Map of model IDs to base or custom role names, overriding `connectionRoles`. Invalid or disallowed roles are ignored. See the [`modelRoles` parameter reference](/embed/setup/url-parameters/modelRoles) for more information.
  - `preserveEntityFolderContentRole` union: If `true`, retains the embed user's existing entity folder content role instead of applying the role from this request. See the [`preserveEntityFolderContentRole` parameter reference](/embed/setup/url-parameters/preserveEntityFolderContentRole) for more information.
    - 'true' | 'false'
    - boolean
  - `sdk` string: Optional SDK telemetry marker used for Omni's internal tracking. Has no effect on the created session.
  - `signature` string: Accepted for compatibility, but this endpoint authenticates with an Organization API key, not this signature.
  - `uiSettings` object: Embed UI settings. Invalid values are ignored. See the [`uiSettings` parameter reference](/embed/setup/url-parameters/uiSettings) for more information.
    - `showNavigation` boolean: When `true`, the [sidebar](/administration/settings/sidebar) and icon will display in the top-left corner of the app. When `false`, the panel and icon are hidden.
    - `dashboardChartContextMenu` boolean: When `true`, context menus (the <Icon icon="ellipsis-vertical" className="icons" /> icon and right-click menu) will be available on dashboard tiles. When `false`, context menus will be hidden.
    - `documentBreadcrumb` 'display' | 'link' | 'none': Controls the display of folder path breadcrumbs in document title headers. This setting applies to [Create mode embeds](/embed/customization/create-mode) and affects workbooks and dashboards. Must be one of: - `link` - Displays the folder path breadcrumb in the document title header as clickable links - `display` - Displays the folder path breadcrumb as visible text without hyperlinks, preventing navigation out of the embed - `none` - Hides the folder path breadcrumb entirely, including the personal-scope prefix (e.g., "X's Documents")
    - `dashboardGeneratedAt` boolean: When `true`, the `Generated <timestamp>` stamp is displayed in the dashboard footer. When `false`, the timestamp is hidden.
    - `tileRanTimestamp` boolean: When `true`, the `Query ran <timestamp>` entry is displayed in a tile's context menu.
    - `showHeader` boolean: When `true`, the top header bar is displayed across the app. When `false`, the header bar is hidden. This setting applies to dashboard, workbook, and application pages.
    - `shareButton` boolean: When `true`, users can share content, such as through the **Share** button. When `false`, all sharing options are hidden for the session.
  - `userAttributes` object: Optional user attributes for row-level security. Values are a string, a number, or an array of strings/numbers. Numbers are converted to strings on receipt, so send anything beyond the JSON safe integer range (`2^53 - 1`) as a string or it loses precision before Omni sees it. See the [`userSettings` parameter reference](/embed/setup/url-parameters/userAttributes) for more information.

## Response `200`

Session token generated

- object
  - `membershipId` string, required: Membership ID of the embed user the session logs in as. This is the same ID used by the [List](/api/users/list-embed-users) and [retrieve embed users](/api/users/retrieve-embed-user) endpoints.
  - `sessionId` string, required: Session ID to use for embedding Omni content
  - `userId` string, required: Omni user ID of the embed user the session logs in as. This ID is created on the user's first request with a given `externalId`, and reused on later requests.

## Other responses

- `400`: Invalid request body
- `401`: Authentication required (API key with embed scope)
- `403`: Permission denied - embed not enabled

## Changes

- **2026-11-03** `43290040f88f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/omni/apis/omni-api/changes/v1/embed/sso/generate-session/post.md)

---

[API](https://skmtc.dev/omni/apis/omni-api.md) - [All operations](https://skmtc.dev/omni/apis/omni-api/llms.txt) - [OpenAPI document](https://skmtc.dev/omni/apis/omni-api/revisions/43290040f88f?raw)