# Security settings

> For the complete documentation index, see [llms.txt](https://developers.thoughtspot.com/docs/llms.txt)

Source: https://developers.thoughtspot.com/docs/security-settings

# Security settings

ThoughtSpot allows administrators and developers to configure allowlists for Content Security Policy (CSP) and Cross-origin Resource Sharing (CORS), authentication attributes, and access control settings. These settings can be done via the **Security Settings** page in the ThoughtSpot UI, or through REST APIs v2, by sending a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint.

## Overview

Most web browsers block cross-site scripting, cross-domain requests, and third-party cookies by default. Web browsers also have built-in security mechanisms such as same-origin and content security policies. These policies restrict how applications and scripts from one origin (domain) can interact with the resources hosted on another origin (domain). To ensure data security and a seamless user experience in embedding applications, configure the settings described in this section.

When ThoughtSpot is embedded in another application, it is considered a third-party application in the host application context. As a result, cookies from ThoughtSpot are blocked by Web browsers.

### Third-party cookies

To avoid this issue, ThoughtSpot recommends the following:

-   Developers can use either [`AuthType.EmbeddedSSO`]({{navprefix}}/{{embed-authentication}}#embedSSO) or [`AuthType.TrustedAuthTokenCookieless`]({{navprefix}}/{{trusted-auth-sdk}}) based on their embedding setup.
    
-   If you are using a ThoughtSpot Cloud instance, set up your instance to the same domain as your host application. For more information, see [Custom domain configuration](https://docs.thoughtspot.com/cloud/latest/custom-domains).
    
-   If you are using authentication methods that rely on cookies, [enable partitioned cookies](#_enable_partitioned_cookies).
    

## Network access requirements

If your organization uses a firewall or Content Delivery Network (CDN) with domain-level access controls, you must allowlist the following domains before provisioning a new ThoughtSpot cluster or modifying an existing firewall configuration. Without access to the critical domains, ThoughtSpot will not load.

> **NOTE:** Contact your network administrator to apply these allowlist rules. ThoughtSpot does not manage your organization’s firewall or CDN configuration.

### Critical domains

Allowlist the following domains to ensure ThoughtSpot loads correctly. If any of these are blocked, ThoughtSpot will not function.

 
| Domain | Purpose |
| --- | --- |
| 
`*.thoughtspot.cloud`

 | 

ThoughtSpot application and APIs

 |
| 

`*.thoughtspotartifacts.cloud`

 | 

Static assets and build artifacts

 |
| 

`*.thoughtspotlogin.cloud`

 | 

Authentication and login flows

 |
| 

`ok14static.oktacdn.com`

 | 

Okta authentication assets

 |
| 

`*.cloudfront.net`

 | 

CDN-served ThoughtSpot resources

 |
| 

`cdn.skypack.dev`

 | 

JavaScript module delivery

 |
| 

`cdn.jsdelivr.net`

 | 

Open-source library assets

 |
| 

`cdnjs.cloudflare.com`

 | 

Open-source library assets

 |
| 

`code.jquery.com`

 | 

jQuery library

 |

### Optional domains

The following domains support third-party services that ThoughtSpot uses for product analytics, in-app guidance, customer support, and content delivery. Allowlist these domains to ensure these services load correctly within your ThoughtSpot instance.

 
| Domain | Feature |
| --- | --- |
| 
`cdn.mxpnl.com`

 | 

Mixpanel product analytics

 |
| 

`app.pendo.io`

 | 

Pendo in-app guidance

 |
| 

`cdn.pendo.io`

 | 

Pendo in-app guidance

 |
| 

`fonts.googleapis.com`

 | 

Google Fonts

 |
| 

`js.intercomcdn.com`

 | 

Intercom in-app support

 |
| 

`fast.wistia.com`

 | 

Wistia embedded video content

 |

## Configure security settings

Users with administration privileges can configure security settings on the Security settings page of the ThoughtSpot UI, or by sending a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Note that the following settings on the **Security Settings** page will appear as locked for ThoughtSpot Analytics application users and will require an embedding license:

-   [CSP visual embed hosts]({{navprefix}}/{{security-settings}}#csp-viz-embed-hosts)
    
-   [CORS whitelisted domains]({{navprefix}}/{{security-settings}}#cors-hosts)
    
-   [Block non-embed full app access]({{navprefix}}/{{security-settings}}#_block_access_to_non_embedded_thoughtspot_pages)
    
-   [SAML redirect domains]({{navprefix}}/{{configure-saml}}#saml-redirect)
    
-   [Trusted authentication]({{navprefix}}/{{trusted-authentication}})
    

#### Security settings for Orgs

On ThoughtSpot instances with Orgs, security settings can be managed at two levels:

-   Global settings for all Orgs (cluster level)  
    Cluster administrators can configure security settings globally for all Orgs. On ThoughtSpot instances with Orgs, the **Develop** page opens in the **Primary Org** context, unless you are accessing the Develop tab from a specific Org context. To configure settings for all Orgs, you must switch to the **All Orgs** context.
    
-   Org-level settings  
    Cluster and Org administrators can configure security settings for the current logged-in Org. Configuration modifications at the Org level do not affect other Orgs or the default settings applied at the All Orgs level.
    

The following table shows the settings available at the All Orgs and per-Org levels:

   
|  |  | All Orgs level (cluster level) | Per-Org level |
| --- | --- | --- | --- |
| 
CSP allowlists

 | 

**CSP visual embed hosts**

 | 

Yes





 | 

No





 |
| 

**CSP connect-src domains**

 | 

Yes





 | 

No





 |
| 

**CSP font-src domains**

 | 

Yes





 | 

No





 |
| 

**CSP img-src domains**

 | 

Yes





 | 

No





 |
| 

**CSP style-src domains**

 | 

Yes





 | 

No





 |
| 

**Permitted iFrame domains**

 | 

Yes





 | 

No





 |
| 

CORS allowlist

 | 

**CORS whitelisted domains**

 | 

Yes





 | 

Yes





 |
| 

Embed access

 | 

**Block non-embed full app access**

 | 

Yes





 | 

Yes





 |
| 

Partitioned cookies

 | 

**Enable partitioned cookies**

 | 

Yes





 | 

No





 |
| 

SAML SSO

 | 

**SAML redirect domains**

 | 

Yes





 | 

No





 |
| 

Token-based authentication

 | 

**Trusted authentication**

 | 

Yes  
Can be used to authenticate users in any Org on the ThoughtSpot instance.





 | 

Yes  
Each Org can have a separate secret key, which can be used to authenticate users in that Org.





 |

> **NOTE:** When security settings are defined at both levels, the Org-level settings take precedence over cluster-level settings within that Org. If the configuration settings are available at both levels and are configured only at the All Orgs level, the Orgs on the instance will inherit these settings. If the settings are not defined either at the All Orgs level or per Org, the system defaults will be applied.

### CSP allowlists

To allow another application to embed ThoughtSpot, you must [add your host application domain as a CSP Visual Embed host]({{navprefix}}/{{security-settings}}#csp-viz-embed-hosts).

To allow [loading script interfaces and JavaScript events for custom actions]({{navprefix}}/{{security-settings}}#csp-connect-src) or [importing resources from other sites]({{navprefix}}/{{security-settings}}#csp-trusted-domain), add the source domain URLs as trusted hosts in the respective CSP allowlist.

> **NOTE:** If your instance has Orgs configured, note that the default Org on your instance is Primary Org. ThoughtSpot allows CSP settings only at the cluster level, so you must switch to the All Orgs context to configure CSP allowlists.

#### Add CSP visual embed hosts

To allow your host domain to set the `frame-ancestors` CSP policy header and embed a ThoughtSpot object within your application frame, add your application domain as a CSP visual embed host.

> **NOTE:** Only users with a valid embed license can add Visual Embed hosts.

In the UI

1.  On your ThoughtSpot application instance, go to the **Develop** page.
    
2.  If your instance has Orgs, click the **All Orgs** tab.
    
3.  Go to **Customizations** > **Security settings**.
    
4.  Click **Edit**.
    
5.  In the **CSP visual embed hosts** text box, add the domain names. For valid domain name formats, see [Domain name format for CSP and CORS configuration]({{navprefix}}/{{security-settings}}#csp-cors-hosts).
    
6.  Click **Save changes**.
    

Through the REST API v2

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Add your application domain as a CSP visual embed host for your ThoughtSpot application instance by entering valid values for the parameter `visual_embed_hosts`.

```cURL
curl -X POST 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
     -H 'Authorization: Bearer {access-token}' \
     -H 'Content-Type: application/json' \
     --data-raw '{
       "cluster_preferences": {
         "csp_settings": {
           "visual_embed_hosts": [
             "www.thoughtspot.com",
             "mysite.com:8080",
             "http://localhost:8080"
           ]
         }
       }
     }'
```

#### Add URLs to CSP connect-src allowlist

If you plan to use a custom action or webhook to send data to an external endpoint or application, you must add the domains of the target endpoints or applications to the `CSP connect-src` allowlist.

In the UI

1.  On your ThoughtSpot application instance, go to the **Develop** page.
    
2.  If your instance has Orgs, click the **All Orgs** tab.
    
3.  Go to **Customizations** > **Security settings**.
    
4.  Click **Edit**.
    
5.  In the **CSP connect-src domains** text box, add the domain names. For valid domain name formats, see [Domain name format for CSP and CORS configuration]({{navprefix}}/{{security-settings}}#csp-cors-hosts).
    
6.  Click **Save changes**.
    

Through the REST API v2

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Add domains of the target endpoints or applications to the `connect_src_urls` parameter for your ThoughtSpot application instance.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
"cluster_preferences": {
    "csp_settings": {
        "connect_src_urls": [
            "localhost:3000",
            "thoughtspot.com"
        ]
    }
}
}'
```

#### Add other trusted domains

To import images, fonts, and stylesheets from external sites, or load the content from an external site using an iFrame element, you must add the source URLs as trusted domains in the CSP allowlist. For example, in the Liveboard Note tiles, if you want to insert an image from an external site or embed content from an external site in an iFrame, you must add domain URLs of these sites to the CSP allowList. Similarly, to import fonts and custom styles from an external source, you must add the source URL as a trusted domain in ThoughtSpot.

In the UI

1.  On your ThoughtSpot application instance, go to the **Develop** page.
    
2.  If your instance has Orgs, click the **All Orgs** tab.
    
3.  Go to **Customizations** > **Security settings** and configure the settings:  
    
    -   **CSP img-src domains**  
        Add the domains from which you want to load images and favicons.
        
    -   **CSP font-src domains**  
        Add the domains from which you want to load fonts.
        
    -   **CSP style-src domains**  
        Add the domains from which you want to load stylesheets.
        
    -   **CSP script-src domains** Add the domains from which you want host scripts. For more information, see [Integrate third-party tools and allow custom scripts]({{navprefix}}/{{3rd-party-script}}).
        
    

Through the REST API v2

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Add source URLs of sites, where from you can import images, fonts, and stylesheets, as trusted domains to the `img_src_urls`, `font_src_urls`, `style_src_urls`, `script_src_urls` parameters.

> **NOTE:** To be able to add allowed urls for custom JavaScript through script\_src\_urls, enabled should be set to true for script-src customization.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
"cluster_preferences": {
    "csp_settings": {
        "font_src_urls": [
            "*.thoughtspot.com"
        ],
        "img_src_urls": [
            "thoughtspot.com/products"
        ],
        "script_src_urls": {
        "enabled": true,
        "urls": [
            "thoughtspot:*"
        ]
    },
        "style_src_urls": [
            "*"
        ]
    }
}
}'
```

#### Add permitted iFrame domains

Features such as [Liveboard Note tiles](https://docs.thoughtspot.com/software/latest/liveboard-notes) and [custom charts](https://docs.thoughtspot.com/cloud/latest/chart-custom) allow iFrame content. If you are planning to embed content from an external site, make sure the domain URLs of these sites are added to the iFrame domain allowlist.

In the UI

1.  On your ThoughtSpot application instance, go to the **Develop** page.
    
2.  If your instance has Orgs, click the **All Orgs** tab.
    
3.  Go to **Customizations** > **Security settings**.
    
4.  Click **Edit**.
    
5.  In the **Permitted iFrame domains** text box, add the domain URL of the website or portal that you want to use for iFrame content.
    
6.  Click **Save changes**.
    

Through the REST API v2

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Add domain URLs of external sites using iFrame content to the `iframe_src_urls` parameter for your ThoughtSpot application instance.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
"cluster_preferences": {
    "csp_settings": {
        "iframe_src_urls": [
            "www.thoughtspot.com"
        ]
    }
}
}'
```

#### Enable CORS

To allow your embedding application to call ThoughtSpot, access its resources, and render embedded content, add your host application domain URL as a trusted host for CORS.

The CORS configuration on your instance controls which domains can access and modify your application content. To allow your application to call ThoughtSpot or its REST API endpoints, and request resources, you must add your application domain to the CORS allowlist. For example, if your website is hosted on the `example.com` domain and the embedded ThoughtSpot content is hosted on the `example.thoughtspot.com`, you must add the `example.com` domain to the CORS allowlist for cross-domain communication. You can also add `http://localhost:8080` to the CORS allowlist to test your deployments locally. However, we recommend that you disable `localhost` access in production environments.

If you enable CORS for your application domain, ThoughtSpot adds the `Access-Control-Allow-Origin` header in its API responses when your host application sends a request to ThoughtSpot.

In the UI

To add domain names to the CORS allowlist, complete these steps:

1.  On your ThoughtSpot instance, navigate to the **Develop** page.
    
2.  If your instance has Orgs, you can configure CORS allowlists for all Orgs globally at the cluster level or per Org.  
    
    -   For cluster-wide configuration, click the **All Orgs** tab.
        
    -   To configure settings at the Primary Org level, click the **Primary Org** tab.
        
    -   To configure CORS settings at the Org level, switch the Org context via the Org switcher in the top navigation bar.
        
    
3.  On the **Develop** page, go to **Customizations** > **Security settings**.
    
4.  Click **Edit**.
    
5.  In the **CORS whitelisted domains** text box, add the domain names. For valid domain name formats, see [Domain name format for CSP and CORS configuration]({{navprefix}}/{{security-settings}}#csp-cors-hosts).
    
6.  Click **Save changes**.
    

Through the REST API v2

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Add CORS allowlist for cross-domain communication to the parameter `cors_whitelisted_urls` for the cluster or for the Org.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
  "org_preferences": [
    {
      "cors_whitelisted_urls": [
        "localhost"
      ]
    }
  ],
  "cluster_preferences": {
    "cors_whitelisted_urls": [
      "mysite.com"
    ]
  }
}'
```

#### Allow custom app schemes for mobile and hybrid embeds

If you are embedding ThoughtSpot in a mobile or hybrid application built with frameworks such as Capacitor or Ionic, your application may use a custom URL scheme (for example, `capacitor://localhost` or `ionic://localhost`) rather than an `https://` origin.

To allow these origins to embed ThoughtSpot content, add the custom scheme URL to the **CSP visual embed hosts** and **CORS whitelisted domains** allowlists.

> **IMPORTANT:** Before allowlisting custom schemes, note that allowlisting a shared app scheme such as capacitor://localhost or ionic://localhost does not uniquely identify your application. Any application on the same device that uses the same framework presents the same origin to the browser. This means: Allowlisting capacitor://localhost grants embedding access to all Capacitor-based apps on that device, not just your app. Custom-scheme allowlisting enables the feature but cannot be used as an access control boundary. Do not rely on origin allowlisting alone as a security mechanism for custom-scheme embeds. Security for these embeds must be enforced through authentication. Use AuthType.TrustedAuthTokenCookieless (cookieless trusted auth) to ensure that only authenticated users in your app can access ThoughtSpot content.

##### Add a custom scheme to CSP visual embed hosts

1.  On your ThoughtSpot application instance, go to **Develop** > **Customizations** > **Security settings**.
    
    -   For cluster-wide configuration, click the **All Orgs** tab. CSP Visual Embed hosts configuration is allowe only at the instance level.
        
    -   To configure CORS settings at the Org level, click the **Primary Org** tab, and set the Org context via the Org switcher in the top navigation bar.
        
    
2.  Click **Edit**.
    
3.  In the **CSP visual embed hosts** text box, add your custom scheme URL. For example:
    
    capacitor://localhost
    
4.  Click **Save changes**.
    

##### Add a custom scheme to CORS whitelisted domains

1.  On your ThoughtSpot application instance, go to **Develop** > **Customizations** > **Security settings**.
    
2.  Click **Edit**.
    
3.  In the **CORS whitelisted domains** text box, add your custom scheme URL. For example:  
    `capacitor://localhost`
    
4.  Click **Save changes**.
    

##### Add a custom scheme via REST API

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` endpoint and add the custom scheme URL to the `visual_embed_hosts` and `cors_whitelisted_urls` arrays:

```cURL
curl -X POST \
 --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
 -H 'Authorization: Bearer {token}' \
 -H 'Content-Type: application/json' \
 --data-raw '{
  "cluster_preferences": {
    "cors_whitelisted_urls": [
      "capacitor://localhost"
    ],
    "csp_settings": {
      "visual_embed_hosts": [
        "capacitor://localhost"
      ]
    }
  }
}'
```

```cURL
curl -X POST 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
 -H 'Authorization: Bearer {token}' \
 -H 'Content-Type: application/json' \
  --data-raw '{
  "org_preferences": [
    {
      "cors_whitelisted_urls": [
        "capacitor://localhost"
      ]
    }
  ]
}'
```

After allowlisting the custom scheme, initialize the Visual Embed SDK using `AuthType.TrustedAuthTokenCookieless` in your Capacitor or Ionic application:

```JavaScript
import { init, AuthType } from '@thoughtspot/visual-embed-sdk';

init({
    thoughtSpotHost: 'https://your-thoughtspot-instance.thoughtspot.cloud',
    authType: AuthType.TrustedAuthTokenCookieless,
        getAuthToken: () => fetch('/api/get-token')
            .then(r => r.json())
            .then(d => d.token),
    });
```

#### Domain name format for CSP and CORS configuration

> **IMPORTANT:** You can add multiple domains to the CORS and CSP Visual Embed allowlists on the Develop Customizations > Security Settings page. Ensure that the CORS and CSP allowlists do not exceed 4096 characters. Protocol in the domain URL: CSP hosts: The UI allows adding a domain URL with or without the protocol (http/https). However, to avoid long URLs in the CSP header, you can exclude the protocol in the domain URL strings. CORS hosts: The UI allows adding a domain URL with the protocol (http/https). If the domain URLs are using https, you can exclude the protocol in domain URL strings, because ThoughtSpot assigns https to the URLs by default. For localhost and non-HTTPS URLs: For non-HTTPs domains or localhost such as localhost:3000, if you add the domain without the protocol, the https protocol will be assigned to the URL by default. Due to this, the localhost domain with http (http://localhost:3000) might result in a CSP or CORS error. Therefore, include the http protocol in the domain name strings for non-HTTPS domains and localhost. Port: If your domain URL has a non-standard port such as 8080, specify the port number in the domain name string. Websocket endpoints: You can add Websocket (wss://) endpoints for external tool script integrations, for example, tools that open WebSocket connections from the browser. Only hosts explicitly listed with wss:// are permitted.

The following table shows the valid domain name strings for the CORS and CSP allowlists.

    
| Domain name format | CSP Visual Embed host | CSP connect-src | CORS | CSP font-src  
CSP style-src  
CSP img-src |
| --- | --- | --- | --- | --- |
| 
Domain URL strings without protocol

-   `thoughtspot.com`
    
-   `www.thoughtspot.com`  
    





 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 |
| 

Domain URL strings for localhost

-   `localhost`
    
-   `localhost:3000`
    
-   `http://localhost:8080`
    
-   `http://localhost:3000`
    





 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 |
| 

Domain URL strings without port

-   `thoughtspot.com`
    
-   `mysite.com`
    

If your domain URL has a non-standard port, for example `mysite.com:8080`, make sure you add the port number in the domain name string.





 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 |
| 

URLs with custom schemes such as:  
`capacitor://localhost`  
`ionic://localhost`

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported





 | 

✓ Supported

 |
| 

Wildcard (`*`), (`.*`) for domain URL  


 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Partial  

_Supports only (`.*`)_





 | 

✓ Supported

 |
| 

Wildcard (\*) before the domain name extension  
`https://*.com`

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 |
| 

Plain text string without the domain name extension.  

`thoughtspot`

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported#

 | 

x Not supported

 |
| 

Domain name with wildcard (\*) and a leading dot  

`.*.thoughtspot.com`

 | 

x Not supported

 | 

x Not supported

 | 

✓ Supported  

_To avoid domain validation errors, make sure you add an escape character `\` after the wildcard in the domain URL string:_  
`.*\.thoughtspot.com`





 | 

x Not supported

 |
| 

Wildcard before the domain name  

`*.thoughtspot.com`





 | 

✓ Supported

 | 

✓ Supported

 | 

x Not supported

 | 

✓ Supported

 |
| 

Domain names with space, backslash (\\), and wildcard (\*).

-   `www.*.*.thoughtspot.com`  
    
-   `www.thoughtspot.com/*`  
    
-   `thoughtspot .com`  
    





 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 |
| 

URLs with query parameters  
`http://thoughtspot.com?2rjl6`

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 |
| 

URLs with path parameters  
`thoughtspot.com/products`

 | 

✓ Supported

 | 

✓ Supported

 | 

x Not supported

 | 

✓ Supported

 |
| 

URLs with path and query parameters  
`thoughtspot.com/products?id=1&page=2`

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 |
| 

IPv4 addresses  
`255.255.255.255`

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 |
| 

Semicolons as separators  
`thoughtspot.com; thoughtspot.com;`

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 |
| 

Comma-separated values  
`thoughtspot.com, thoughtspot.com`

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 |
| 

`mail://xyz.com`

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 | 

x Not supported

 |
| 

Wildcard (\*) for port

`thoughtspot:*`





 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 | 

✓ Supported

 |
| 

Websocket URLs  
`wss://`





 | 

✓ Supported

 | 

✓ Supported

 | 

x Not Supported

 | 

✓ Supported

 |

### Block access to non-embedded ThoughtSpot pages

If you have embedded ThoughtSpot content in your app, you may want your users to access only the ThoughtSpot pages embedded within the context of your host app. ThoughtSpot allows administrators to restrict user access to non-embedded application pages from the embedding application context or selectively grant access to specific user groups. For information, see [Control User Access]({{navprefix}}/{{selective-user-access}}).

**Through the REST API v2**

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Set `block_full_app_access` to `true` to restrict user access to non-embedded application pages from the embedding application context. Enter values for `groups_identifiers_with_access` to selectively grant access to specific user groups.

> **NOTE:** To be able to gives access through groups\_identifiers\_with\_access, the selective user access feature must be turned on in the Admin settings.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
"cluster_preferences": {
    "non_embed_access": {
        "block_full_app_access": false
    }
},
"org_preferences": [
    {
    "non_embed_access": {
        "block_full_app_access": true,
            "groups_identifiers_with_access": [
            "group1"
        ]
    }
    }
    ]
}'
```

### Enable partitioned cookies

Many web browsers do not allow third-party cookies. If you are using authentication methods that rely on cookies, users will not be able to access the embedded content when browsers block third-party cookies. Therefore, ThoughtSpot recommends using [cookieless authentication]({{navprefix}}/{{trusted-auth-sdk}}) in production environments.

However, if your implementation uses cookie-based authentication or [AuthType.None]({{navprefix}}/{{embed-authentication}}#none), ensure that you enable partitioned cookies:

1.  On your ThoughtSpot application instance, go to the **Develop** page.
    
2.  If your instance has Orgs, click the **All Orgs** tab.
    
3.  Go to **Customizations** > **Security settings**.
    
4.  Click **Edit**.
    
5.  Turn on the **Enable partitioned cookies** toggle switch.
    
6.  Click **Save changes**.
    

With partitioned cookies enabled, when a user logs in to ThoughtSpot and accesses embedded content on a host application, a cookie is set with the partitioned attribute. On browsers supporting partitioned cookies, the partitioned cookie will persist in the app after a successful login.

> **IMPORTANT:** Safari blocks all third-party cookies and does not support partitioned cookies. You can switch to a different browser that supports partitioned cookies, or use cookieless authentication in your embedding implementation.

**Through the REST API v2**

Send a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Set `enable_partitioned_cookies` to `true` to ensure a cookie is set with the partitioned attribute for applications using cookie-based authentication.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/configure' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
"cluster_preferences": {
    "enable_partitioned_cookies": true
}
}'
```

### Trusted authentication

To enable or disable trusted authentication at the cluster or Org level, send a request to the `POST /api/rest/2.0/auth/configure` endpoint.

To find the trusted authentication configuration for the specified auth type at the cluster or Org level, send a request to the `POST /api/rest/2.0/auth/search` endpoint.

For more information on the trusted authentication configuration through APIs, see [Configuring authentication settings]({{navprefix}}/{{authentication}}).

See [Trusted authentication]({{navprefix}}/{{trusted-authentication}}) and [Secret key management]({{navprefix}}/{{trusted-auth-secret-key}}) for other related information.

## Retrieve security settings

You can retrieve the security settings for your ThoughtSpot instance by sending a request to the `POST /api/rest/2.0/system/security-settings/search` API endpoint. You can define the `scope` to get the cluster-level settings (`scope` as `CLUSTER`), or the Org-level settings for the current Org (`scope` as `ORG`). If the `scope` is not specified, the API returns both cluster and Org settings based on user privileges.

```cURL
curl -X POST \
  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/system/security-settings/search' \
  -H 'Authorization: Bearer {access-token}'\
  -H 'Content-Type: application/json' \
--data-raw '{
  "scope": "CLUSTER"
}'
```