GoRunner docs
Search or askSearch⌘K

Allow a website

Since v2026.10.4

POST/api/embed/v1/websites

Allows a website to show every customer’s embed.

Needs a partner key: Authorization: Bearer gre_…, from Platform › Partner keys. Call it from your server only.

Embed · Self-hosted with an Embed license

Parameters

Headers

Idempotency-KeyOptional · string

Up to 255 characters. The same request with the same key within 24 hours answers the first result again, with Idempotency-Replayed: true.

Body

originRequired · string

https:// and a host, with an optional port. https://*.bakery.example covers every subdomain of a domain you own.

One customer’s own website

For a website that should show only one account, use Allow a website for one account.

Responses

  • 201Created

    Added, as stored. It applies the next time the embed loads.

  • The body isn’t a JSON object, or origin isn’t text.

  • The list already has it.

  • A request with this Idempotency-Key is still running. Retry shortly.

  • It can’t be allowed as written. The message says why.

  • The list already has 200.

  • This Idempotency-Key was already used with a different request.

  • Something failed on the installation’s side. Try again.

Any call can also answer: 401 UNAUTHORIZED · 403 EMBED_NOT_LICENSED · 403 IP_NOT_ALLOWED · 413 PAYLOAD_TOO_LARGE · 415 INVALID_CONTENT_TYPE · 429 RATE_LIMITED · 503 BUSY. See Errors.

Request

GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…

curl -X POST "$GORUNNER/api/embed/v1/websites" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "origin": "https://app.bakery.example"
  }'

Response · 201 Created

json
{
  "data": {
    "origin": "https://app.bakery.example"
  }
}
Every field

Body

originRequired · string

An origin: https:// and a host, an optional port, nothing after it.

Response · 201 Created

dataobject
originstring