---
title: "Create a polymorphic read-only embed link"
method: POST
path: "/api/v1/embed-links"
tags: ["Embed Links"]
---

# Create a polymorphic read-only embed link

`POST /api/v1/embed-links`

## Request

- Base URL: `https://api-docs.busabase.com`
- URL: `https://api-docs.busabase.com/api/v1/embed-links`
- Auth: HTTP bearer

Record detail requires write on the owning Base node; change requests require changeRequest on every affected node; whole-node links require manage. Listing and revoking links require manage.

## Request body

- object
  - `type` 'node' | 'change-request' | 'record-detail', required
  - `typeId` string, required
  - `expiresInMinutes` integer
  - `framePolicy` union
    - object
      - `mode` unknown, required
      - `allowedOrigins` string[]
    - object
      - `mode` unknown, required
      - `allowedOrigins` string[], required
    - object
      - `mode` unknown, required
      - `allowedOrigins` string[]

## Response `200`

The capability URL is returned once; only its secret hash is stored.

- object
  - `id` string, required
  - `type` 'node' | 'change-request' | 'record-detail', required
  - `typeId` string, required
  - `targetName` string, required
  - `nodeType` 'base' | 'doc' | 'file' | 'drive' | 'skill' | 'folder' | 'airapp', required
  - `createdAt` string, date-time, required
  - `expiresAt` string, date-time, required
  - `revokedAt` string, date-time, required
  - `active` boolean, required
  - `framePolicy` object, required
    - `mode` 'anywhere' | 'origins' | 'top-level-only', required
    - `allowedOrigins` string[], required
  - `url` string, uri, required
  - `iframeUrl` string, uri, required

## Other responses

- `400`: 400
- `401`: 401
- `403`: 403
- `404`: 404

---

[API](https://skmtc.dev/busabase/apis/busabase-api.md) · [All operations](https://skmtc.dev/busabase/apis/busabase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/busabase/apis/busabase-api/revisions/bc6a7d5ff4c1?raw)