26-10-0-doc-publication

modules/ROOT/pages/about-rest-apis.adoc

@@ -12,7 +12,7 @@ You can use REST APIs to integrate ThoughtSpot capabilities into your applicatio
 
 * *Manage users, groups, and roles*. Create and manage user accounts, define groups and privileges, and automate provisioning workflows.
 * *Authenticate and manage sessions*. Get authentication tokens for users, including tokens for embedded application users with trusted authentication.
-* *Manage metadata objects*. Search, create, update, and delete objects such as Liveboards, Answers, Models, Worksheets, and Tables. Import and export objects as ThoughtSpot Modeling Language (TML) representations.
+* *Manage metadata objects*. Search, create, update, and delete objects such as Liveboards, Answers, Models, and Tables. Import and export objects as ThoughtSpot Modeling Language (TML) representations.
 * *Query data*. Run search queries against your data and fetch Liveboard, Answer, and visualization data in your application.
 * *Export reports*. Download Liveboards and Answers in PDF, PNG, CSV, or XLSX formats.
 * *Automate deployments*. Move content between environments and Orgs with TML and version control APIs, and manage multi-tenant deployments.
@@ -37,7 +37,7 @@ ThoughtSpot REST APIs are available in the following versions:
 The REST API v2 framework includes a wider set of xref:rest-api-v2-reference.adoc[API endpoints] with enhanced functionality and provides an interactive Playground for ease of use.
 
 * REST API v1 (Deprecated) +
-The xref:rest-api-reference.adoc[legacy REST v1 endpoints] to create, edit, administer and manage ThoughtSpot objects and data.
+The xref:rest-api-reference.adoc[legacy REST API v1 endpoints] let you create, edit, administer, and manage ThoughtSpot objects and data.
 +
 include::{path}/rest-apiv1-deprecation-note.adoc[]
 
@@ -55,18 +55,31 @@ In the Playground, you can:
 * View and copy generated code samples for your requests.
 
 == Rate limits for API requests
-To ensure API stability, optimize resource usage, and maintain service quality for all users, ThoughtSpot limits the number of public API requests allowed per client to prevent excessive requests from reaching application servers.
+To ensure operational stability, optimize resource usage, and maintain service quality for all users, ThoughtSpot enforces rate limits on the number of public API requests allowed per client.
 
-By default, on instances running 26.2.0.cl and later, a global rate limit of 100 requests per second per client IP is enforced at the cluster level for all public APIs. This limit is applied per client IP across all public APIs combined, not per endpoint. If a client IP exceeds this combined rate limit, a burst of 10 additional API requests is allowed before rejecting the requests with the 'HTTP 429: Too Many Requests' error.
+By default, a global rate limit of 100 requests per second (RPS) per client IP is enforced at the cluster level for all public APIs. This limit applies per client IP across all public APIs combined, not per individual endpoint. If a client IP exceeds this combined rate limit, a burst of up to 10 requests is allowed before requests are rejected with the `HTTP 429: Too Many Requests` error.
 
-For async status endpoints such as `/api/rest/2.0/metadata/tml/async/status`, up to 100 requests per minute per client IP are allowed, with a burst of 100 requests before requests are rejected with an HTTP 429 error.
+For async status endpoints such as `/api/rest/2.0/metadata/tml/async/status`, up to 100 requests per minute per client IP are allowed, with a burst of 100 requests before requests are rejected with an `HTTP 429` error.
 
-These rate limits are enforced by default on all ThoughtSpot instances. Currently, rate limits are applied at the cluster level; Org-level rate limits are not supported.
+=== Org-level rate limit
+Starting from the 26.11.0.cl release, a rate limit of 50 RPS per Org is enforced at the application layer in ThoughtSpot instances with Orgs enabled. This limit is applied per Org across all public REST API endpoints combined.
 
-To update rate limits or adjust the rate limit settings for your dev or prod environment, contact ThoughtSpot Support.
+The Org-level rate limit provides noisy-neighbor protection in multi-Org deployments. It ensures that API usage from one Org does not impact the service quality of other Orgs on the same cluster. If the Org-level limit is exceeded, the API returns an `HTTP 429: Too Many Requests` error.
 
-== REST API SDKs
+The Org-level and cluster-level rate limits operate independently. A request can be rejected by either limit:
+
+* If a single client IP sends more than 100 RPS across the cluster, the cluster-level limit rejects the request.
+* If all clients in a single Org collectively send more than 50 RPS, the Org-level limit rejects the request.
+
+=== Rate limit response
+When a request is rejected due to rate limiting, the API returns the `HTTP/1.1 429 Too Many Requests` response.
 
+If your application receives an `HTTP 429` response, reduce the request frequency or implement a retry mechanism with exponential backoff.
+
+=== Adjusting rate limits
+The default rate limits are designed for typical production workloads. To request a change to the rate limits for your deployment, contact ThoughtSpot Support.
+
+== REST API SDKs
 To integrate v2.0 APIs into your applications faster, ThoughtSpot provides SDK libraries in several languages, including TypeScript and Python. The SDKs wrap endpoint calls, authentication, and typed request and response models. For more information, see xref:rest-api-sdk-libraries.adoc[REST API SDK libraries].
 
 == Related information

modules/ROOT/pages/api-changelog.adoc

@@ -8,6 +8,105 @@
 
 This page documents the changes introduced in each release of the Visual Embed SDK. For information about the REST API v2.0 changes, see the xref:rest-apiv2-changelog.adoc[REST API v2.0 changelog].
 
+== Version 1.53.0, October 2026
+
+[width="100%", cols="1,4"]
+|====
+|[tag greenBackground]#NEW#
+a|
+[discrete]
+===== Spotter Analyst embed
+You can now embed a single, pinned Spotter Analyst in `SpotterEmbed` by using `spotterAnalystConfig.analystId`.
+For more information, see xref:embed-spotter-analyst.adoc[Embed Spotter Analyst].
+
+|[tag greenBackground]#NEW#
+a|
+[discrete]
+===== Spotter embedding
+
+`spotterChatPinConfig`::
+You can now let users pin conversations in the chat history sidebar. Use the `spotterChatPinConfig` object in `spotterSidebarConfig` to turn pinning on (`enabled`) and to customize the labels of the *Pin* and *Unpin* options (`pinLabel` and `unpinLabel`). For more information, see xref:customize-spotter-sidebar.adoc#pinning-conversations[Pinning conversations].
+
+`starterPrompts`::
+You can now customize the starter prompt pills in the embedded Spotter interface by using the `starterPrompts` object in `spotterChatConfig`. The object supports the `enable`, `quick`, `research`, `previewData`, and `liveboard` keys. To show or hide individual pills, use `Action.QuickSearchPill`, `Action.DeepAnalysisPill`, and `Action.DataLiteracyPill`. For more information, see xref:embed-spotter-analyst.adoc#_customizing_starter_prompt_pills[Customizing starter prompt pills].
+
+|[tag greenBackground]#NEW#
+a|
+[discrete]
+===== Liveboards in embedded view
+The SDK includes the following enhancements for the Liveboards in your embedded app.
+
+* `isScopedLiveboardFilteringEnabled` +
+Enables scoping filters and parameters to a group of visualizations on a Liveboard, in addition to the Liveboard and tab levels. Supported in `AppEmbed` and `LiveboardEmbed`.
+* `openSpotterOnLiveboardByDefault` +
+Opens the Spotter chat panel automatically when a Liveboard loads. Set this property in `spotterChatConfig`. The default value is `true`. Supported in `AppEmbed` and `LiveboardEmbed`.
+* `starterPrompts.liveboard` +
+Starter prompts for the Spotter chat panel on a Liveboard.
+
+|[tag greenBackground]#NEW#
+a|
+[discrete]
+===== Action IDs for embedded Spotter and Liveboard interfaces
+
+The following `Action` enum members are added in this release:
+
+* `Action.SpotterChatPin` +
+Controls the visibility and enabled state of the pin and unpin action in the Spotter conversation edit menu.
+* `Action.SpotterAnalystList` +
+Controls the visibility and enabled state of the *Show all* Analysts entry in the Analyst interface.
+* `Action.SpotterDefaultAnalyst` +
+Controls the visibility and enabled state of the default Spotter entry in the Analyst interface.
+* `Action.SpotterOnLiveboard` +
+Controls the visibility and enabled state of the *Spotter* button in the Liveboard header.
+* `Action.AllLiveboardFilters` +
+Shows, hides, or greys out all filter surfaces on a Liveboard: filter chips, parameter chips, and cross-filter chips at the Liveboard, tab, and group levels. Parameter and cross-filter chips can only be hidden.
+* `Action.EditInputTable` +
+Controls the *Edit input table* action, which lets users edit an input table used by an Answer directly from the Liveboard.
+* `Action.QuickSearchPill` +
+Controls the *Basic Search* starter prompt pill in the Spotter interface.
+* `Action.DeepAnalysisPill` +
+Controls the *Deep Analysis* starter prompt pill in the Spotter interface.
+* `Action.DataLiteracyPill` +
+Controls the *Data Literacy* starter prompt pill in the Spotter interface.
+
+|[tag greenBackground]#NEW#
+a|
+[discrete]
+===== Events
+
+Embed events::
+* `EmbedEvent.SpotterConversationPinned` +
+Emitted when a user pins a Spotter conversation. The event payload includes the `conversationId` and `pinnedAt` values.
+* `EmbedEvent.SpotterConversationUnpinned` +
+Emitted when a user unpins a Spotter conversation. The event payload includes the `conversationId` and `unpinnedAt` values.
+
+Host events::
+* `HostEvent.PinSpotterConversation` +
+Pins a saved Spotter conversation. Accepts `{ conversationId }`.
+* `HostEvent.UnpinSpotterConversation` +
+Unpins a previously pinned Spotter conversation. Accepts `{ conversationId }`.
+* `HostEvent.GetGroups` +
+Returns filter and parameter group details for the current Liveboard. The response includes `orderedGroupIds`, `numberOfGroups`, and `Groups`.
+* `HostEvent.OpenParameter` +
+Opens the parameter panel for a specific parameter on the Liveboard. Accepts an optional `applicability` object to scope the action to a tab or group.
+
+The pin and unpin events require `spotterChatPinConfig.enabled: true` and `enablePastConversationsSidebar: true` in the embed configuration. The host events also require chat history to be enabled on your ThoughtSpot instance.
+
+Updated events::
+The following existing events now include or accept an optional `applicability` attribute, which scopes filters and parameters to a Liveboard tab or group:
+
+* `EmbedEvent.FilterChanged`
+* `EmbedEvent.ParameterChanged`
+* `HostEvent.OpenFilter`
+* `HostEvent.GetFilters`
+* `HostEvent.UpdateFilters`
+* `HostEvent.GetParameters`
+* `HostEvent.UpdateParameters`
+
+Deprecated events::
+* `HostEvent.UpdatePersonalizedView` is deprecated. Use `HostEvent.SelectPersonalizedView` instead. `HostEvent.SelectPersonalizedView` additionally accepts an optional `viewName` to select a view by name, resets to the original view when the payload is empty, and reports an error when the named view isn't found.
+|====
+
 == Version 1.52.x, September 2026
 
 [width="100%" cols="1,4"]

modules/ROOT/pages/authentication.adoc

@@ -153,6 +153,7 @@ __Optional__
 |__Nullable__. `ENABLE` or `DISABLE` authentication for a particular Org.  When enabled, a new org-level access token is generated if one does not exist. When disabled, the existing org-level access token is revoked.
 
 |`org_identifier`
+|__String__. Name or ID of the Org for which to enable or disable trusted authentication. Specify this attribute within the `org_preferences` array.
 
 |=====
 
@@ -556,6 +557,125 @@ curl -X POST \
 If `auto_create` is set to `true` and the username specified in the API request already exists in ThoughtSpot, the `/api/rest/2.0/auth/token/custom` API does not update user properties such as display name, email, Org, or group assignments.
 ====
 
+[#multi-org-tokens]
+=== Multi-Org tokens [beta betaBackground]^Beta^
+By default, a token authorizes API requests in a single Org. From 26.10.0.cl, ThoughtSpot users with cluster administration privileges can request a token authorized for multiple Orgs by including the optional `scope` object in the token request, and then select the Org for each request using the `X-Org-Selector` header.
+
+[NOTE]
+====
+* This feature is in Beta and is disabled by default. To enable this feature, contact ThoughtSpot Support.
+* Only users with cluster administration privileges can generate a multi-Org token.
+====
+
+==== Supported endpoints
+
+The `scope` request property is supported on the following token endpoints:
+
+* `POST /api/rest/2.0/auth/token/full`
+* `POST /api/rest/2.0/auth/token/custom` (supports `SPECIFIC_ORGS` only)
+* `POST /api/rest/2.0/auth/token/object`
+
+==== The `scope` request property
+
+[width="100%" cols="2,4"]
+[options="header"]
+|=====
+|Parameter|Description
+|`scope` a|__Object__. Optional. The set of Orgs the token is authorized to operate in, recorded at issuance. Requires cluster administration privileges. Specify the following attributes:
+
+* `org_scope` +
+__String__. Org scope type. Valid values:
+
+** `SPECIFIC_ORGS`: authorizes the token for the Orgs listed in `org_identifiers`.
+** `ALL_MEMBER_ORGS`: authorizes the token for all Orgs the user is a member of. Not supported for custom (ABAC) tokens.
+
+* `org_identifiers` +
+__Array of strings__. ID or name of the Orgs the token is authorized for. Required when `org_scope` is `SPECIFIC_ORGS`; ignored when `org_scope` is `ALL_MEMBER_ORGS`.
+|=====
+
+==== Request example
+A multi-Org token request replaces `org_id` with the `scope` object. The issued token is authorized for every Org in the requested set, and each API request selects its target Org with the `X-Org-Selector` header.
+
+[source,cURL]
+----
+curl -X POST \
+  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/auth/token/full' \
+  -H 'Accept: application/json' \
+  -H 'Content-Type: application/json' \
+  --data-raw '{
+  "username": "tsAdminUser",
+  "secret_key": "{SECRET_KEY}",
+  "validity_time_in_sec": 86400,
+  "scope": {
+    "org_scope": "SPECIFIC_ORGS",
+    "org_identifiers": ["1", "2", "5"]
+  }
+}'
+----
+
+[NOTE]
+The `scope` object in a single-Org token response carries no `org_scope` or `org_ids` properties. API requests made with this token always execute in the Org the token was issued for; the `X-Org-Selector` header is not required.
+
+==== Response properties
+When a multi-Org token is issued, the `scope` object in the response includes the following additional properties.
+
+[source,JSON]
+----
+{
+  "token": "{AUTH_TOKEN}",
+  "creation_time_in_millis": 1675129264089,
+  "expiration_time_in_millis": 1675129564089,
+  "scope": {
+    "access_type": "FULL",
+    "org_id": 1,
+    "metadata_id": null,
+    "org_scope": "SPECIFIC_ORGS",
+    "org_ids": [
+      {
+        "id": 1,
+        "name": "Org-Finance"
+      },
+      {
+        "id": 2,
+        "name": "Org-Sales"
+      },
+      {
+        "id": 5,
+        "name": "Org-Marketing"
+      }
+    ]
+  },
+  "valid_for_user_id": "59a122dc0-38d7-43e7-bb90-86f724c7b602",
+  "valid_for_username": "tsAdminUser"
+}
+----
+
+The same properties appear in the `POST /api/rest/2.0/auth/token/validate` response, so API clients can inspect which Orgs an existing token is authorized for.
+
+[width="100%" cols="2,4"]
+[options="header"]
+|=====
+|Property|Description
+|`scope.org_scope`|__String__. Org scope the token is authorized for: `SPECIFIC_ORGS` or `ALL_MEMBER_ORGS`. This property is absent for a legacy single-Org token.
+|`scope.org_ids`|__Array__. The Orgs the token is authorized for when `org_scope` is `SPECIFIC_ORGS`.
+|=====
+
+==== Per-request Org selection
+Each API request made with a multi-Org token selects one Org from the token's authorized set using the `X-Org-Selector` request header:
+
+[source,cURL]
+----
+curl -X POST \
+  --url 'https://{ThoughtSpot-Host}/api/rest/2.0/users/search'  \
+  -H 'Accept: application/json' \
+  -H 'Content-Type: application/json' \
+  -H 'Authorization: Bearer {AUTH_TOKEN}' \
+  -H 'X-Org-Selector: 2' \
+  --data-raw '{}'
+----
+
+The header selects an Org from the authority the token already holds; it does not grant access to any Org outside the token's scope. Selecting an Org outside the authorized set fails the request.
+
 === Generating a session token
 To generate a new authentication token for an existing authenticated session, send a `GET` request to `/api/rest/2.0/auth/session/token`. This endpoint mints a fresh bearer token valid for 24 hours. It does not return the token currently held by the caller's session, but issues a new token derived from the authenticated session context.
 

modules/ROOT/pages/common/nav-embedding.adoc

@@ -11,6 +11,7 @@ Embed ThoughtSpot in a web app
 * link:{{navprefix}}/getting-started[Get started]
 * link:{{navprefix}}/embed-ai-search-analytics[Embed Spotter AI Analytics]
 ** link:{{navprefix}}/embed-spotter[Embed full Spotter experience]
+** link:{{navprefix}}/embed-spotter-analyst[Embed a Spotter Analyst]
 ** link:{{navprefix}}/customize-spotter-embed[Customize Spotter interface]
 ** link:{{navprefix}}/customize-spotter-chat-experience[Customize chat experience]
 ** link:{{navprefix}}/customize-spotter-sidebar[Customize sidebar panel]
@@ -61,6 +62,7 @@ Authentication and data security
 ** link:{{navprefix}}/saml-sso[SAML SSO authentication]
 ** link:{{navprefix}}/oidc-auth[OpenID Connect authentication]
 ** link:{{navprefix}}/just-in-time-provisioning[Just-in-time provisioning]
+** link:{{navprefix}}/jit-provisioning-best-practices[JIT provisioning best practices]
 * link:{{navprefix}}/security-settings[Security settings]
 
 * link:{{navprefix}}/embed-object-access[Authorization]

modules/ROOT/pages/common/nav-in-product-help.adoc

@@ -30,6 +30,7 @@ Embed ThoughtSpot in a web app
 * link:{{navprefix}}/tsembed[Quickstart guide]
 * link:{{navprefix}}/embed-ai-search-analytics[Embed Spotter AI Analytics]
 ** link:{{navprefix}}/embed-spotter[Embed full Spotter experience]
+** link:{{navprefix}}/embed-spotter-analyst[Embed a Spotter Analyst]
 ** link:{{navprefix}}/customize-spotter-embed[Customize Spotter interface]
 ** link:{{navprefix}}/customize-spotter-chat-experience[Customize chat experience]
 ** link:{{navprefix}}/customize-spotter-sidebar[Customize sidebar panel]
@@ -236,6 +237,7 @@ REST APIs
 *** link:{{navprefix}}/spotter-agent-sharing-apis[Spotter agent conversation sharing APIs]
 *** link:{{navprefix}}/spotter-agent-instructions[Spotter AI agent instructions]
 *** link:{{navprefix}}/spotter-agent-conversation-mgmt-apis[APIs for managing saved conversations]
+*** link:{{navprefix}}/spotter-analyst-api[Spotter Analyst APIs]
 *** link:{{navprefix}}/spotter-memory-migration[Spotter memory migration API]
 *** link:{{navprefix}}/spotter-apis-classic[AI APIs (Spotter Classic) ^BETA^]
 *** link:{{navprefix}}/spotter-nl-instructions[Data model instructions APIs ^BETA^]

modules/ROOT/pages/common/nav-rest-api.adoc

@@ -21,6 +21,7 @@ REST API endpoints
 ** link:{{navprefix}}/api-user-management[Users and group privileges]
 ** link:{{navprefix}}/rbac[Role-based access control]
 ** link:{{navprefix}}/audit-logs[Audit logs]
+** link:{{navprefix}}/feature-management[Feature Management]
 
 * Multi-tenancy and Orgs
 ** link:{{navprefix}}/orgs-api-op[Orgs APIs]
@@ -37,6 +38,7 @@ REST API endpoints
 ** link:{{navprefix}}/spotter-agent-sharing-apis[Spotter agent conversation sharing APIs]
 ** link:{{navprefix}}/spotter-agent-instructions[Spotter AI agent instructions]
 ** link:{{navprefix}}/spotter-agent-conversation-mgmt-apis[APIs for managing saved conversations]
+** link:{{navprefix}}/spotter-analyst-api[Spotter Analyst APIs]
 ** link:{{navprefix}}/spotter-memory-migration[Spotter memory migration API]
 ** link:{{navprefix}}/spotter-apis-classic[AI APIs (Spotter Classic)]
 ** link:{{navprefix}}/spotter-nl-instructions[Data model instructions APIs]