# Check the installation can be embedded

**GET** `/api/embed/v1/bootstrap`

Says whether this installation can be embedded, and whether the page asking may show it. Public.

Needs nothing: it is public.

Embed · Self-hosted with an Embed license

## Parameters

### Query

- `origin` · Optional · string: The page to ask about, when the frame itself asks. A page on another website is asked about by its own `Origin`, and this is ignored.

## Read it

`available` is `false` when Embed isn’t licensed or sign-in is off (`reason`). `originAllowed` says whether the page asking may show the embed; `allowedOrigins` holds that page’s own address when it may, and is empty otherwise. The lists of websites are never given out.

It needs no key and answers any website (`Access-Control-Allow-Origin: *`). Send its `ETag` back as `If-None-Match`.

## Responses

- 200 OK

  Whether the embed works here.

- 304

  Nothing changed since the `ETag` you sent.

- 500 `INTERNAL_ERROR`

  Something failed on the installation’s side. Try again.

Any call can also answer: [`429 RATE_LIMITED`](https://docs.gorunner.io/errors#RATE_LIMITED) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY). See [Errors](https://docs.gorunner.io/embed/api#errors).

Request

**curl**

```bash
GORUNNER="https://automations.example.com"

URL="$GORUNNER/api/embed/v1/"
URL="${URL}bootstrap?origin=https%3A%2F%2Fapp.bakery.example"
curl "$URL"
```

**JavaScript**

```js
const GORUNNER = "https://automations.example.com";

const res = await fetch(
  `${GORUNNER}/api/embed/v1/` +
    `bootstrap?origin=https%3A%2F%2Fapp.bakery.example`,
);
const { data } = await res.json();
```

**Python**

```python
import os, requests

GORUNNER = "https://automations.example.com"

res = requests.get(
    f"{GORUNNER}/api/embed/v1/bootstrap",
    params={
      "origin": "https://app.bakery.example",
    },
)
data = res.json()["data"]
```

Response · 200 OK

```json
{
  "data": {
    "protocol": "gorunner-embed/1",
    "protocols": [
      1
    ],
    "available": true,
    "reason": null,
    "originAllowed": true,
    "allowedOrigins": [
      "https://app.bakery.example"
    ]
  }
}
```

**Every field**

It takes no body.

### Response · 200 OK

- `data` · object
  - `protocol` · string
  - `protocols` · array of integers
  - `available` · boolean
  - `reason` · string or null: One of `not_licensed`, `sign_in_off`, `null`.
  - `originAllowed` · boolean: Whether the page asking may host the embed: one of the installation’s allowed websites, or a website the partner’s server allowed for one customer.
  - `allowedOrigins` · array of strings: The asking page’s own origin when it is allowed; empty otherwise. Never the lists.

Related: [SDK](https://docs.gorunner.io/embed/sdk) · [List allowed websites](https://docs.gorunner.io/embed/api/websites/list-websites)

Source: https://docs.gorunner.io/embed/api/sign-in/bootstrap