Embrasure API authentication

Send a bearer token on every request:

Authorization: Bearer YOUR_TOKEN

A missing or invalid token returns 401.

Token types

SCIM provisioning under /scim/v2 uses its own token type and error schema; see SCIM provisioning.

Create a PAT in Embrasure

You must be a workspace administrator, and Personal access tokens must be allowed for the workspace.

1. Open Access Embrasure and find Personal access tokens.
2. If you belong to several workspaces, select the workspace, then choose Generate new token.
3. Enter a descriptive name, choose a Lifetime (7, 30, 90, 180, or 365 days), and select only the Scopes you need. Warehouse writes, such as dbt builds, require write.
4. Optionally, for a write token without admin, open Limit warehouse writes and list the databases the token can write to.
5. Choose Generate token, then copy the dpt_… value immediately and store it in your deployment's secret manager. Embrasure does not show the raw token again.

If token creation is disabled, ask a workspace administrator to allow PATs under Admin settings → Sign-in. Disabling PATs later blocks existing PATs from that workspace with personal_access_tokens_disabled; revoke tokens that are no longer needed. Workspaces that require SSO reject PATs with sso_required.

Create a PAT with the API

POST /v1/auth/tokens requires a signed-in session (session_required otherwise), admin scope, the workspace admin or owner role, and PATs allowed for the workspace.

curl --request POST https://api.embrasure.ai/v1/auth/tokens \
  --header "Authorization: Bearer $EMBRASURE_SESSION_JWT" \
  --header "Content-Type: application/json" \
  --data '{
    "workspace_id": "workspace-1",
    "name": "ci dbt",
    "expires_in_days": 30,
    "scopes": ["read", "write"],
    "client_kind": "automation"
  }'

The response contains the raw token once and its token_metadata.

Manage tokens

Scopes and roles

Available scopes are read, write, and admin; admin includes write, and write includes read. Endpoint scope checks are combined with workspace role checks, so a write-scoped token does not make a viewer into an editor.

Workspace roles, from least to most access, are viewer, billing_admin, editor, security_admin, admin, and owner. Writes need editor or higher. A token is denied with insufficient_scope when it lacks a scope and with insufficient_workspace_role when its user lacks the role.

A token with Limit warehouse writes can write only through warehouse SQL, and only to the listed databases. Other write operations, such as changing ingestion, return 403 with token_write_database_limited.

Use and rotate the token

Pass the raw PAT as a bearer token. Keep it in a credential manager or secret store, inject it at runtime, and never place it in source control, screenshots, agent chat, or build logs.

For writes, the token needs write scope and its user must remain an editor or higher in the same workspace. Revoke and replace a token before it expires or whenever its secret may have been exposed.