ThoughtSpot Embed Playground
Connect → pick an embed → tweak → copy the code.
A tool-first playground for the ThoughtSpot Visual Embed SDK. Every setup is a shareable link.No build step, no framework.
Live demo · TSE best-practices guide · SDK docs
Quick start
npm install
npm start # http://localhost:3000
Paste your instance URL in the top bar and click Connect. It uses browser-session auth, so keep a
tab logged into ThoughtSpot in the same browser. No .env, no keys.
One-time CORS step: add http://localhost:3000 under Develop → Customizations → Security
Settings → CORS so the object pickers can load. The embed itself renders without it.
Pick an embed from the rail, choose a data object, tweak options, and copy from the SDK Code tab.
Share copies a link that reproduces the setup. Secrets are never serialized, and links are
sanitized on load.
Why use it
- Runnable code, not snippets. The SDK Code tab tracks every option you set, ready to paste.
- Contextual inspector. Data object, display options, actions, runtime filters and parameters,
custom actions, host events and custom styles, shown only where the active embed supports them.
- See what the SDK does. Event log, SDK lifecycle, and every REST call the setup depends on.
- Real integrations, wired up. Drill-through, callback actions, webhooks and Spotter over MCP.
- Safe to share. A fail-closed token server, and links sanitized on load.
Embed types
| Rail item | SDK | Needs |
|---|
| Search Data | SearchEmbed | Model |
| Spotter AI | SpotterEmbed | Model |
| Spotter Chat (MCP) | Custom chat UI over the Spotter 3 MCP server (docs) | Model + the local server |
| Liveboard | LiveboardEmbed | Liveboard |
| Custom Liveboard | LiveboardEmbed + a host-native filter bar | Liveboard |
| AI Highlights | LiveboardEmbed + HostEvent.AIHighlights | Liveboard |
| Single Viz | LiveboardEmbed + vizId, or a standalone Answer | Liveboard + viz, or Answer |
| Drill-through | LiveboardEmbed + a host-rendered detail list over searchdata | Liveboard + detail Model |
| Full App | AppEmbed | — |
| AI Insights (REST) | Spotter REST, no iframe | Model |
Integrations
| Integration | What it shows | Write-up |
|---|
| Drill-through | Point click → filtered detail Liveboard; "View detail" → event-grain rows rendered by the host | below |
| Download PDF | Callback action → viz rows → paginated client-side PDF | callback-action.md |
| Customize Export | Custom export flows from the embed | customize-export.md |
| Webhook Inbox | One webhook per recipient, with the rendered report attached | webhook-inbox-demo.md |
| Spotter Chat (MCP) | A chat UI over the Spotter MCP server, no iframe | spotter-mcp-chat.md |
Custom actions come in four types: Callback (runs host code), URL (opens a link with row
context), Write-back (POST /api/writeback stub) and Drill-down (re-renders a detail Liveboard).
Everything is configured in the Drill-through panel. No GUIDs are hardcoded, so it runs on any cluster.
- Point click → detail Liveboard.
EmbedEvent.VizPointClick attributes merge with host filters
and in-iframe filters (HostEvent.GetFilters); the detail Liveboard renders with them as runtime
filters.
- "View detail" → host record list. A context-menu custom action scoped with
dataModelIds.modelColumnNames fetches rows via POST /api/rest/2.0/searchdata, pages with
record_offset past the 1,000-row cap, and renders them outside the iframe as a modal or a panel.
View payload shows the raw EmbedEvent.CustomAction payload.
Gotchas:
modelColumnNames scopes to a visualization, not a column: the action shows on every cell of
that viz. Turn on Only drill from one column to refuse clicks on other cells.available_data_row_count equals the returned count on every page, so a short page is the only
end-of-data signal.- Runtime filters are not a security boundary. Detail rows are safe because
searchdata runs under
the viewer's own token, so RLS applies.
Requires SDK 1.43.0+ and cluster 10.14.0.cl+ for column scoping.
Trusted auth (optional)
For testing trusted-auth tokens, groups, JIT and RLS claims:
npm run setup # creates .env: set THOUGHTSPOT_HOST, TS_SECRET_KEY, TS_DEFAULT_USERNAME
npm run doctor # mints a real test token, or reports the exact upstream error
npm start # .env is read at boot
Enable trusted authentication in ThoughtSpot first (Develop → Customizations → Security Settings)
and copy the secret key. Then switch the top bar to Trusted token → Token claims…. The server
holds the secret and mints short-lived tokens; the secret never reaches the browser.
- full (
auth/token/full): username, auto_create, org_id, group_identifiers[].
- custom (
auth/token/custom): variable_values[] for ABAC via ts_var(), optional
objects[], and persist_option: REPLACE so entitlements can't accumulate.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
