---
title: "Serve an embedded data-app HTML artifact with the signed token injected"
method: GET
path: "/v4/data-apps/embed"
tags: ["v4", "Data Apps"]
---

# Serve an embedded data-app HTML artifact with the signed token injected

`GET /v4/data-apps/embed`

Serve the stripped data-app HTML with the embed token injected.

This is the top-level navigation URL that customers drop into an iframe on
their own site. The token lives in the URL query string (``?t=...``); there
is no separate header. Auth is handled by
:class:`DataAppEmbedTokenFromQuery` which verifies the signed token before
the handler body runs. On success, the HTML arrives with:

- Cache-Control: private, no-store  (tokens are per-request)
- Referrer-Policy: no-referrer       (prevents URL leak via Referer)
- Content-Security-Policy: frame-ancestors <hosts>  (click-jack protection)

The browser's ``definite-runtime`` reads ``window.__DEFINITE_EMBED`` from
the injected script tag and sends the token as ``Authorization: Bearer ...``
on every ``/v4/data-apps/query`` call.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/definite/apis/defapi.md) · [All operations](https://skmtc.dev/definite/apis/defapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/definite/defapi/revisions/3943d8deb3be/schema)