403132 error publishing .twbx via REST API when datasource connects through Tableau Bridge - skipConnectionCheck=true ignored

Hello, 

My goal is simple: I want to duplicate an existing workbook on  

Tableau Cloud and update the custom SQL inside its embedded  

datasource — all programmatically via Python. 

I am using the Tableau Server Client (TSC) Python library to programmatically  

update the custom SQL inside an embedded datasource in a workbook, then  

republish it to Tableau Cloud as a new workbook. 

**Environment:** 

- Tableau Cloud (us-east-1) 

- Python tableauserverclient (TSC) library 

- Datasource: Amazon Redshift (embedded in workbook, not a published datasource) 

- Connection goes through Tableau Bridge (private network/VPN) 

**What I am doing:** 

1. Download the workbook WITHOUT extract using include_extract=False → get small .twb file 

2. Parse the .twb XML and replace the custom SQL in the embedded datasource 

3. Republish as a new workbook using server.workbooks.publish() 

**The Problem:** 

Every publish attempt fails with: 

    403132: Forbidden 

    <workbook_name> failed to establish a connection to your datasource. 

**Everything I have tried:** 

1. Passing ConnectionItem with credentials: 

    conn_item = ConnectionItem() 

    conn_item.server_address = "<redshift-host>" 

    conn_item.server_port    = "5439" 

    conn_item.username       = "<username>" 

    conn_item.password       = "<password>" 

    conn_item.embed_password = True 

    server.workbooks.publish(..., connections=[conn_item]) 

2. Using skip_connection_check=True: 

    server.workbooks.publish(..., skip_connection_check=True) 

    → Confirmed skipConnectionCheck=true IS in the POST URL 

3. Both combined — still 403132 

4. Neither (no connections parameter) — still 403132 

5. Confirmed the XML being sent is correct and contains  

   <connectionCredentials> with the right server address,  

   username, and embed="true" 

**Key observation:** 

The original workbook works fine on Tableau Cloud and its extract  

refresh runs through Tableau Bridge. Tableau Cloud has no direct  

network path to Redshift — it always goes through Bridge. 

My hypothesis is that Tableau Cloud ignores skipConnectionCheck  

for Bridge-dependent connections and always tries a direct  

connection validation, which fails because Redshift is on a  

private network. 

**Questions:** 

1. Is it possible to publish a .twb via REST API when the datasource  

   connects through Tableau Bridge? 

2. Does skipConnectionCheck=true not apply to Bridge connections? 

3. Is there a correct way to publish and tell Tableau Cloud to use  

   the existing Bridge-linked credentials rather than validating  

   directly? 

Code:

server = TSC.Server(SERVER_URL, use_server_version=True)
with server.auth.sign_in(auth):
    source_wb = server.workbooks.get_by_id(SOURCE_WORKBOOK_ID)
    buf = io.BytesIO()
    server.workbooks.download(
        SOURCE_WORKBOOK_ID,
        filepath=buf,
        include_extract=False,
    )
    buf.seek(0)
    new_wb_item = TSC.WorkbookItem(
        name=NEW_WORKBOOK_NAME,
        project_id=TARGET_PROJECT_ID,
    )
    new_wb_item.show_tabs = source_wb.show_tabs
    #
    # # 5. Publish using the modified source connection
    new_wb = server.workbooks.publish(
        new_wb_item,
        buf,
        mode=TSC.Server.PublishMode.CreateNew,
        # connections=[source_conn],  # <-- Tried with conn also 
        skip_connection_check=True
    )

Thank you. 

#Tableau Cloud  #Tableau