# Replace an account’s websites

**PUT** `/api/embed/v1/accounts/{accountId}/websites`

Replaces the whole list of websites that show only this account’s embed.

Needs a partner key: `Authorization: Bearer gre_…`, from [Platform › Partner keys](https://docs.gorunner.io/embed/platform-screens#partner-keys). Call it from your server only.

Embed · Self-hosted with an Embed license

## Parameters

### Path

- `accountId` · Required · string: Your ID for the customer’s account: 1 to 255 bytes of UTF-8, case-sensitive. URL-encode it: it may contain `/`.

### Body

- `websites` · Required · array of strings: Exact addresses, no wildcard, up to 20. Repeats are dropped. `[]` removes them all.

## Websites taken off

The account’s sessions open on a website you take off end (`website_removed`), unless the installation’s own list allows it.

## Responses

- 200 OK

  The list now. A website kept keeps the day it was added.

- 400 `VALIDATION_ERROR`

  `websites` is missing.

- 404 `NOT_FOUND`

  You have no account with this ID.

- 409 `ACCOUNT_DELETED`

  The account is deleted. Restore it first, within 30 days.

- 422 `INVALID_ORIGIN`

  A website can’t be allowed as written, or is a wildcard. `details.invalid` lists every problem.

- 422 `TOO_MANY_WEBSITES`

  More than 20.

- 500 `INTERNAL_ERROR`

  Something failed on the installation’s side. Try again.

Any call can also answer: [`401 UNAUTHORIZED`](https://docs.gorunner.io/errors#UNAUTHORIZED) · [`403 EMBED_NOT_LICENSED`](https://docs.gorunner.io/errors#EMBED_NOT_LICENSED) · [`403 IP_NOT_ALLOWED`](https://docs.gorunner.io/errors#IP_NOT_ALLOWED) · [`413 PAYLOAD_TOO_LARGE`](https://docs.gorunner.io/errors#PAYLOAD_TOO_LARGE) · [`415 INVALID_CONTENT_TYPE`](https://docs.gorunner.io/errors#INVALID_CONTENT_TYPE) · [`429 RATE_LIMITED`](https://docs.gorunner.io/errors#RATE_LIMITED) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY). See [Errors](https://docs.gorunner.io/embed/api#errors).

Request

**curl**

```bash
GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…
ACCOUNT_ID="acct-bakery"

URL="$GORUNNER/api/embed/v1/accounts/$ACCOUNT_ID/"
URL="${URL}websites"
curl -X PUT "$URL" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "websites": [
      "https://crm.bakery.example"
    ]
  }'
```

**JavaScript**

```js
const GORUNNER = "https://automations.example.com";
const KEY = process.env.GORUNNER_EMBED_KEY; // gre_…
const ACCOUNT_ID = encodeURIComponent("acct-bakery");

const res = await fetch(
  `${GORUNNER}/api/embed/v1/accounts/` +
    `${ACCOUNT_ID}/websites`,
  {
    method: "PUT",
    headers: {
        Authorization: `Bearer ${KEY}`,
        "Content-Type": "application/json",
      },
    body: JSON.stringify({
        websites: ["https://crm.bakery.example"],
      }),
  },
);
const { data } = await res.json();
```

**Python**

```python
import os, requests
from urllib.parse import quote

GORUNNER = "https://automations.example.com"
KEY = os.environ["GORUNNER_EMBED_KEY"]  # gre_…
ACCOUNT_ID = quote("acct-bakery", safe="")

res = requests.put(
    f"{GORUNNER}/api/embed/v1/accounts/"
    f"{ACCOUNT_ID}/websites",
    headers={"Authorization": f"Bearer {KEY}"},
    json={
      "websites": ["https://crm.bakery.example"],
    },
)
data = res.json()["data"]
```

Response · 200 OK

```json
{
  "data": {
    "websites": [
      {
        "origin": "https://crm.bakery.example",
        "addedAt": "2026-10-20T08:00:00Z"
      }
    ],
    "max": 20
  }
}
```

**Every field**

### Body

- `websites` · Required · array of strings

### Response · 200 OK

- `data` · object
  - `websites` · array of objects
    - `origin` · string
    - `addedAt` · time
  - `max` · integer

Related: [List an account’s websites](https://docs.gorunner.io/embed/api/websites/list-account-websites)

Source: https://docs.gorunner.io/embed/api/websites/put-account-websites