Embedding an App

An App embeds the same way a saved query or dashboard does — through the <saiku-embed> Web Component — but as one token-scoped unit. A single token grants the whole App: its navigation and all of its pages ride that one grant, and the guest browses it read-only, switching pages in place.

The markup

Set kind="app" and point path at the .saikuapp document:

<saiku-embed
  server="https://YOUR-WORKSPACE.saiku.bi"
  token="tx-..."
  kind="app"
  path="homes/admin/sales-portal.saikuapp"
  height="800px"
></saiku-embed>

Everything else about the component — install methods, events, theming via --saiku-embed-* variables, the React and Vue wrappers — works exactly as documented on the Embedding Saiku page. An App embed is purely presentational over the existing embed query path; it adds no new mechanics on the host side.

Minting an App token

Mint an App token like a dashboard token, but with resourceKind: "app" and a .saikuapp path:

curl -X POST 'https://YOUR-WORKSPACE.saiku.bi/rest/saiku/api/embed/tokens' \
  -u admin:admin \
  -H 'Content-Type: application/json' \
  -d '{
    "resourceKind": "app",
    "resourcePath": "homes/admin/sales-portal.saikuapp",
    "ttlHours": 72,
    "label": "Customer sales portal"
  }'

The minter must have read access to the App. The token pins exactly one App: replaying it against any other resource returns the same opaque EMBED_INVALID — a token for App A can’t read App B or any other repository path.

Security: RLS and PII are enforced server-side

Each page’s tiles run the same guarded per-tile query a dashboard embed uses. The query body is pulled server-side from the pinned App document — never from the client — so:

• Row-level security filters carried by the token are applied last and fail closed: if they can’t be spliced into a tile’s query, the tile errors rather than leaking unfiltered rows.
• PII redaction stays on: if any referenced column is PII-annotated, the token is elevated to forced redaction at mint time, same as a dashboard. The inspector resolves each referenced hierarchy and measure against the cube’s saiku.semantic.pii annotations, and fails closed — if it cannot resolve the resource at all, it refuses the grant rather than assuming the resource is clean. The audit line distinguishes the two cases (“annotated columns” vs “unresolvable resource”) so a refused grant can be diagnosed.
• A client-side filter override can only narrow a tile’s query, never widen it.

Note

An author’s per-App custom CSS is not applied to embeds. Theme the embedded surface through the standard --saiku-embed-* CSS variables and the theme attribute, like every other embed kind.

Plugin tiles in an embedded App

If an App page contains a plugin tile, the plugin is served token-scoped: the guest can load exactly the plugins referenced by the embedded App and nothing else. The same sandbox and CSP containment apply inside the embed.

Caution

Remember the plugin trust model still holds in an embed: the sandbox isolates the Saiku origin, but a plugin can navigate its own frame and send its tile’s rows off-site. To close that channel for embedded Apps, an operator sets a restrictive frame-src via saiku.security.csp. See Plugins.

Related

• Embedding Saiku — the full <saiku-embed> reference: tokens, events, theming, public grants, React / Vue.
• App Builder overview — building the App you embed.
• Plugins — the containment model for sandboxed-JS tiles.