Authentication
Guest Token
Generate secure guest tokens for embedding DataBrain dashboards and metrics in your application.
POST
Guest tokens are designed for frontend embedding. Never expose your API key in frontend code - always generate tokens from your backend.
Simple Usage: Only
clientId and dataAppName are required. All other parameters (params, permissions, expiryTime, datasourceName, datamartName) are optional for advanced use cases.Guest tokens are free. There is no charge, metering, or purchase involved in generating them.
Advanced Features Available:
- Dashboard & metric-level filtering (
dashboardAppFilters,appFilters) - Embed allowlisting (
params.allowedEmbeds) - Fine-grained permissions control (
permissionsobject) - Private metrics for end users (
userIdentifier) - Timezone-aware queries (
params.timezone) - Multi-datasource support (
datasourceName) - Multi-datamart support (
datamartName) - Conditional filter visibility (
hideDashboardFilters,isShowOnUrl) - Token expiration management (
expiryTime)
Authentication
All API requests must include your API key in the Authorization header. Get your API token when creating a data app - see our data app creation guide for details. Finding your API token: For detailed instructions, see the API Token guide.Cloud Databrain Endpoint:
Self-hosted Databrain Endpoint:
Headers
Bearer token for API authentication. Use your API key from the data app.
Must be set to
application/json for all requests.Request Body
Unique identifier for the end user. This should be your user’s ID from your system. Used for row-level security and access control.
Use
"None" as the value if no tenancy is configured for your workspace (e.g. "clientId": "None").The name of your data application. Must match an existing data app in your workspace and be alphanumeric.
Additional parameters for token customization and filtering.
Optional allowlist of IDs this token can load.
- Each entry must match the ID you pass to the embed component’s
dashboardIdattribute — embed IDs and dashboard IDs both resolve. - If you provide
allowedEmbeds, loading any ID not in the list fails withUNAUTHORIZED. - If this is omitted, there is no restriction on which embeds can be loaded by the token.
- This is useful to restrict or enforce which dashboards or embedded analytics a guest can view, adding an extra layer of access control.
Row-level security rules per metric. Each entry is
{ "metricId": string, "values": object }, where values maps RLS variable names to the values enforced for this token. Unlike dashboard filters, RLS values are enforced server-side and cannot be changed by the end user.End-user dashboard-filter controls:
isAllowEndUserDashboardFilter (boolean) and dashboardFilterColumns (array of { "tableName": string, "columns": string[] }).Application-level filters for controlling access to individual metrics. Unlike RLS settings, app filters restrict access without requiring end user input.
Metric App Filter
Metric App Filter
The metric ID to apply filters to. Required if appFilters is provided.
Filter values to apply to the metric. Supports multiple data types:
Keys in
values can use either the filter label or internal filter name (case-insensitive).- Boolean:
"paid_orders": true - Number:
"amount": 500 - String:
"country": "USA" - Array (multi-select):
"countries": ["USA", "CANADA"] - Date preset shortcut:
"order_date": "Last 30 days" - SQL Query:
{ "sql": "SELECT...", "columnName": "name" }
Dashboard-level filters that apply to all metrics on a dashboard. Supports multiple filter types for flexible data filtering.
Dashboard AppFilters
Dashboard AppFilters
The dashboard ID to apply filters to. Required if dashboardAppFilters is provided.
Filter values to apply to the dashboard. Supports various filter formats:
Keys in
values can use either the dashboard filter label or internal filter name (case-insensitive).- Single string:
"name": "Eric" - Multi-select:
"country": ["USA", "CANADA"] - Date range:
"timePeriod": { "startDate": "2024-01-01", "endDate": "2024-03-23" } - Date preset shortcut:
"timePeriod": "Last 30 days" - Number range:
"price": { "min": 1000, "max": 5000 } - SQL query:
{ "sql": "SELECT...", "columnName": "name" }
Controls visibility of filter values in URL search parameters. When
false, filters are applied but not visible to end users in the URL.Array of filter names to hide from the dashboard interface. Use this to conditionally hide specific filters based on user permissions or context.
Optional advanced access controls for end-user dashboard filtering.
Enables or disables end-user dashboard filter controls in embedded mode.
Optional allowlist for dashboard filterable columns. Each item must include
tableName and columns.Fully qualified table name used in dashboard filters.
Column names allowed for dashboard filter evaluation for the specified table.
Unique identifier for the end user in your system. Enables features like creating private metrics and publishing metrics directly from the embed view.
IANA timezone string for timezone-aware queries and date/time formatting. When provided, SQL queries will be executed with this timezone setting, ensuring consistent date/time handling across different timezones.
The timezone is used to set the database session timezone for SQL queries, ensuring that date/time operations are performed in the specified timezone.
Supported Datasources:
- Clickhouse
- Trino
- Redshift
- CockroachDB
- Postgres
- MSSQL
Permission settings for the embedded interface.
Permission Options
Permission Options
Allow archiving metrics.
Allow managing metrics (view, edit, organize).
Allow creating custom dashboard views.
Allow updating metric configurations.
Allow customizing dashboard layout.
Allow viewing underlying data behind charts.
Allow downloading metric data.
Show the sidebar navigation.
Show the dashboard name in the interface.
Disable metric creation in embedded dashboards. When set to
true, end users cannot create new metrics.Optional. Token expiration time in milliseconds from now. If not provided, token never expires.
Optional. Scope the token to a specific Datamart.
Optional. Datasource name for multi-datasource connection setups. Required when your data app uses multiple datasources.
The datasource name is available in the Data Studio tab of your dashboard. This parameter is only necessary if you have configured multiple datasources for your data app.
Optional. Datamart name for multi-datamart connection setups. Use this when your data app can resolve multiple datamarts and you want to pin token execution to one datamart.
If both
datasourceName and datamartName are omitted, Databrain resolves defaults from the data app context.Response
UUID token for authentication. Pass this to your frontend component for embedding.
Error object if the request failed, otherwise
null for successful requests.HTTP Status Code Summary
Error Codes
These are the mint-time errors from this endpoint. At embed runtime (after minting), the distinct errors are
INVALID_TOKEN (token not found in this deployment), TOKEN_EXPIRED, UNAUTHORIZED_ORIGIN, UNAUTHORIZED, and INVALID_ID — see the Error Codes Reference. Rate limiting surfaces as HTTP 429 with a Retry-After header (see Rate Limiting).
Quick Start Guide
Getting Started
Next Steps
Embed a Pre-built Dashboard/Metric
Create embed configurations for your data apps
Create Data App
Create data apps and get your API tokens
How to Embed
Learn how to embed dashboards in your app
API Token Helper
Learn more about API token management

