---
title: "oEmbed provider — a pasted board link, as a live embed"
method: GET
path: "/dashboards/oembed"
tags: ["Dashboard v3"]
---

# oEmbed provider — a pasted board link, as a live embed

`GET /dashboards/oembed`

## Request

- Base URL: `https://app.mammoth.io/api/v2`
- URL: `https://app.mammoth.io/api/v2/dashboards/oembed`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-KEY` and API key in header `X-API-SECRET` and API key in header `X-WORKSPACE-ID`

The oEmbed endpoint a consumer calls after finding the discovery tag on /url/{url}/share, or after matching this provider in the public registry. Takes the pasted page URL as `url` (the spec shape — a registry entry declares a URL scheme plus one endpoint of this form, so a token-keyed route could never be registered), with optional `maxwidth`/`maxheight`, and returns a `rich` response whose html is an iframe pointing at the EXISTING embed page. Nothing new renders. Unauthenticated for a published board, like the other two unfurl surfaces. Without credentials, 401 when the link is not ours or names an unknown or unpublished board (the auth exemption covers published boards only). 404 when a published board's embed tier is not public or its author restricted which sites may frame it — both are security controls, and each one silently disables embedding by design. 501 for `format=xml`, which the spec allows a provider to refuse.

## Query parameters

- `url` string, nullable
- `maxwidth` string, nullable
- `maxheight` string, nullable
- `format` string, nullable

## Response `200`

Request fulfilled, document follows

- unknown

## Other responses

- `400`: Bad request syntax or unsupported method

---

[API](https://skmtc.dev/mammoth/apis/mammoth-analytics.md) · [All operations](https://skmtc.dev/mammoth/apis/mammoth-analytics/llms.txt) · [OpenAPI document](https://skmtc.dev/mammoth/apis/mammoth-analytics/revisions/9d8804f81a10?raw)