Resolve a composition UUID to a published widget URL

Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition’s owner listed the websites it may appear on (the workspace’s domain list, or the allowedDomains of a partner the owner administers), a request from any other website is refused with 403 DOMAIN_NOT_ALLOWED. The website is read from the Origin header, or the host of Referer when there is no Origin; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor’s own machine (localhost, 127.0.0.1 or [::1], on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (platformDomain in the answer of GET /partners/mine), for the widgets of that partner: a partner’s list never has to name it. The list stops other websites from showing the embed in a visitor’s browser; it does not hide the published content from someone who holds the composition ID. Address. https://api.widgetic.com/embed/compositions/{compositionId}: the root of the API host, NOT under /v1. A client generated from this description for https://api.widgetic.com/v1 must be given the base address https://api.widgetic.com for the calls of the Public Embed tag. Limit. 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 RATE_LIMITED with a Retry-After header.

GET /embed/compositions/{compositionId}

Resolve a composition UUID to a published widget URL

cURL

curl --request GET \
  --url https://api.widgetic.com/embed/compositions/{compositionId}

200

{
  "compositionId": "<string>",
  "widgetId": "<string>",
  "version": 123,
  "widgetVersion": 123,
  "playerVersion": 123,
  "dataSource": {
    "url": "<string>",
    "refreshSeconds": 123
  },
  "embedUrl": "<string>",
  "entryWriteToken": "<string>",
  "entries": {
    "url": "<string>",
    "writeToken": "<string>"
  },
  "adapters": {
    "url": "https://api.widgetic.com/embed/compositions/0f6f7f0e-3c2a-4b86-9e51-2d8d5f4a7c11/adapters",
    "captcha": {
      "siteKey": "<string>"
    }
  },
  "width": 123,
  "height": 123,
  "design": {},
  "content": {},
  "contentItems": [
    {}
  ],
  "iframeAllow": "camera; microphone",
  "media": {
    "optimize": true
  },
  "direct": {
    "moduleUrl": "<string>",
    "contractVersion": 123,
    "moduleHash": "<string>"
  }
}

Path Parameters

compositionId · string<uuid> · required

Response

200

application/json

Published embed URL and optional direct frameless module

compositionId · string

widgetId · string

version · integer

widgetVersion · integer

Published widget version on the CDN artifact this composition uses.

playerVersion · integer

Version of the player: the gateway frame wrapper that shows the widget, and the host bridge it speaks with the embedding page and the widget (currently 6). Raised when the messages between page, frame, and widget change in a way a widget could notice, such as a new widgetic:host field or a new forwarded event (2 added entries, 3 added adapters, 4 added entries.writeToken, 5 added the A/B goal: widgetic:ab-goal to the widget and widgetic:goal back, 6 added the watch of a workflow: widgetic:workflow-watch to the widget, the watched values in widgetic:submitted and the watched action in widgetic:goal). It is not widgetVersion (the version of the published widget) and not the version inside a widgetic:host message.

dataSource · object | null

Show child attributes

embedUrl · string

entryWriteToken · string

Signed per-composition write token for POST /embed/compositions/{compositionId}/entries/{table}, also handed to the widget inside widgetic:host as entries.writeToken.

entries · object

Where a direct or iframe embed writes visitor entries.

Show child attributes

adapters · object

Where the widget's adapter modules (e-mail, upload, AI answers, decision, ...) call the gateway, and the public key of the CAPTCHA an operation may ask a visitor to solve. The same two facts the frame page gives the widget, so an embed that does not use the frame page (the Embed SDK, a widget mounted directly) can tell the widget too: the SDK passes them to the widget with entries. entries.url is where the widget writes visitor entries; this is where it calls operations.

Show child attributes

width · integer

height · integer

design · object

content · object

contentItems · object[]

iframeAllow · string

The browser features the widget needs the iframe that shows it to be allowed to use, as the value of that iframe's allow attribute (for example camera; microphone; the words are camera, display-capture and microphone). Present only for a widget that uses a module that needs one, and absent for every other widget. A page that embeds the frame itself copies it onto its own iframe (allow="..."); a page that does not leaves the widget to say, in its own words, that the feature is blocked there. The frame wrapper already passes it on to the iframe it holds.

Example:

"camera; microphone"

media · object

How the owner wants the images of this embed delivered.

Show child attributes

direct · object | null

Present only when a confirmed direct (frameless) ESM artifact was published for this version

Show child attributes