Users and groups

You can create users and update user profiles using the REST API v2 user endpoints.

While you can delete users, it is preferable to deactivate a user, which maintains the user’s references within the system.

When configuring SAML SSO in ThoughtSpot UI, you can select the Automatically add SAML users to ThoughtSpot upon first authentication option, which will use the values in the SAML assertion to create a user if they do not already exist on ThoughtSpot. ThoughtSpot can also add users to groups sent within the SAML assertion. To enable and configure the SAML group attributes, contact your ThoughtSpot team.

By default, ThoughtSpot sends e-mail messages to a new user and enables onboarding workflows when they log in for the first time, even when you are embedding ThoughtSpot content. To alter this behavior at a system-wide level, you need to Customize the onboarding settings. The user update API also allows setting onboarding experience values for an individual user. If you need to modify the default behavior beyond the available UI options, contact your ThoughtSpot team. To specify whether an activation email is sent to a new user, set the trigger_activation_email parameter in the POST /api/rest/2.0/users/create request.

ThoughtSpot is gradually migrating its users to Identity and Access Management v2 (IAMv2) to provide a more secure login and authentication experience through internal authentication with Okta. The following are some of the important points to note with this upgrade:

Administrators can manage the user account status for all users. For IAMv2 users, the API response for the following APIs will also include SUSPENDED as a user state:

To create a user:

To update user details:

For more information, see the following pages:

Groups can be created via the REST API v2 group endpoints.

To create, edit, or delete groups, you need administrator privileges. If RBAC is enabled on your instance, the GROUP_ADMINISTRATION (Can manage groups) privilege is required. To assign Roles to a group or remove Roles from a group, you need both the GROUP_ADMINISTRATION and ROLE_ADMINISTRATION privileges.

The Group privileges are set directly on groups, either during group creation or via a group update API call.

You can add users to specific groups when creating a user or group via REST API endpoints. When you assign a user to a group, the user inherits the privileges and Roles assigned to that group.

To add users to an existing group or remove users from it, use the POST /api/rest/2.0/groups/{group_identifier}/update endpoint with the user_identifiers parameter and the ADD, REMOVE, or REPLACE operation. To update the groups of a single user, use the POST /api/rest/2.0/users/{user_identifier}/update endpoint with the group_identifiers parameter.

Removing a user from a group removes only the group association; it does not delete the user from ThoughtSpot. To delete a user, use the POST /api/rest/2.0/users/{user_identifier}/delete endpoint.

To get a list of users assigned to a group, use the POST /api/rest/2.0/groups/search endpoint.

Access to objects is determined by content shared directly to the user or the groups they belong to. It is easier to manage and audit sharing through groups rather than object sharing at the individual user level.

Users can share objects or modify sharing properties through the UI or via an API call to the POST /api/rest/2.0/security/metadata/share endpoint.

Note the following points about sharing objects via REST API:

To audit access, use the POST /api/rest/2.0/security/metadata/fetch-permissions endpoint to get the users and groups that have access to an object, or the POST /api/rest/2.0/security/principals/fetch-permissions endpoint to get the objects a user or group can access.

For more information and examples, see Access control and sharing.

Each user group includes a set of privileges for its users. When a user is assigned to a group in ThoughtSpot, the default privileges associated with a group are assigned to its users. The group privileges allow users belonging to a group to perform specific operations and access workflows. If a user belongs to more than one group, they will have the highest level of privileges from all the groups they belong to.

ThoughtSpot administrators can programmatically assign the following types of privileges to a user group:

If Role-Based Access Control (RBAC) is enabled on your instance, administrators can define role privileges and assign them to users via groups. Roles are always scoped to an Org; a role created in one Org cannot be assigned in another.