Allow a website for one account
This page needs your own installation with an Embed license.
POST/
Allows one exact website to show this account’s embed, and no other account’s.
Needs a partner key: Authorization: Bearer gre_…, from Platform › Partner keys. Call it from your server only.
Parameters
Path
accountIdRequired · stringYour ID for the customer’s account: 1 to 255 bytes of UTF-8, case-sensitive. URL-encode it: it may contain
/.
Headers
Idempotency-KeyOptional · stringUp to 255 characters. The same request with the same key within 24 hours answers the first result again, with
Idempotency-Replayed: true.
Body
originRequired · stringhttps://and a host, with an optional port. No wildcard.
Only this account
A login code of another account is refused there (ORIGIN_NOT_ALLOWED). It needs no two-factor code, and is recorded in the account’s audit log as your key.
Responses
- 201Created
Added.
The
accountIdisn’t valid or isn’t URL-encoded, the body isn’t a JSON object, ororiginisn’t text.details.fieldnames it.- 404
NOT_FOUNDYou have no account with this ID.
The list already has it.
The account is deleted. Restore it first, within 30 days.
- 409
CONFLICTA request with this
Idempotency-Keyis still running. Retry shortly. It can’t be allowed as written, or is a wildcard.
The account already has 20.
This
Idempotency-Keywas already used with a different request.Something failed on the installation’s side. Try again.
Any call can also answer: 401 UNAUTHORIZED · 403 EMBED_NOT_LICENSED · 403 IP_NOT_ALLOWED · 413 PAYLOAD_TOO_LARGE · 415 INVALID_CONTENT_TYPE · 429 RATE_LIMITED · 503 BUSY. See Errors.
Request
GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY" # gre_…
ACCOUNT_ID="acct-bakery"
URL="$GORUNNER/api/embed/v1/accounts/$ACCOUNT_ID/"
URL="${URL}websites"
curl -X POST "$URL" \
-H "Authorization: Bearer $GORUNNER_EMBED_KEY" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{
"origin": "https://crm.bakery.example"
}'const GORUNNER = "https://automations.example.com";
const KEY = process.env.GORUNNER_EMBED_KEY; // gre_…
const ACCOUNT_ID = encodeURIComponent("acct-bakery");
const res = await fetch(
`${GORUNNER}/api/embed/v1/accounts/` +
`${ACCOUNT_ID}/websites`,
{
method: "POST",
headers: {
Authorization: `Bearer ${KEY}`,
"Idempotency-Key": crypto.randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify({ origin: "https://crm.bakery.example" }),
},
);
const { data } = await res.json();import os, uuid, requests
from urllib.parse import quote
GORUNNER = "https://automations.example.com"
KEY = os.environ["GORUNNER_EMBED_KEY"] # gre_…
ACCOUNT_ID = quote("acct-bakery", safe="")
res = requests.post(
f"{GORUNNER}/api/embed/v1/accounts/"
f"{ACCOUNT_ID}/websites",
headers={
"Authorization": f"Bearer {KEY}",
"Idempotency-Key": str(uuid.uuid4()),
},
json={
"origin": "https://crm.bakery.example",
},
)
data = res.json()["data"]Response · 201 Created
{
"data": {
"origin": "https://crm.bakery.example",
"addedAt": "2026-10-25T09:00:00Z"
}
}Every field
Body
originRequired · stringAn origin:
https://and a host, an optional port, nothing after it.
Response · 201 Created
dataobjectoriginstringaddedAttime