NAnash
Embed Sessions

Mint Embed Session

Mint an Embed Session for one widget, one parent origin, and an explicit set of resources. Returns the browser envelope: client_secret, expires_at, session_id, api_region. Forward it to your page as-is; the client secret is the only value that authenticates the widget, and it is returned once.

Pass refresh_session_id to replace a live session before it expires. A replacement may narrow the parent's scopes and resources or keep them; widening requires a fresh mint.

Denials are deliberately uniform: FORBIDDEN covers every refusal, so a failed request never reveals whether a resource exists. Quote the X-REQUEST-ID response header when asking Nash why a specific call was denied; it is present on success and failure alike, and error bodies repeat it as RequestID.

post/v1/embed-sessions

Request

  • Base URL
    https://api.sandbox.usenash.com
  • Auth
    none declared

Request body

widgetstring required

Widget identifier, e.g. live_map (live-map is accepted).

scopesstring[] required

Scopes to grant, e.g. ['live_map:read']. Must be granted for the widget.

resourcesobject required

The exact resources this session may read, e.g. {'delivery_ids': ['del_1']}.

parent_originstring required

The page origin that will host the widget. Must match an allowed origin exactly.

ttlinteger nullable

Requested lifetime in seconds. Defaults to 900.

refresh_session_idstring nullable

Session id (wes_…) to replace. The replacement may narrow the parent's scopes and resources or preserve them; it can never widen them. Omit for a fresh mint.

Response

OK

client_secretstring required

Browser-held session secret (wcs_…). Shown once, never retrievable.

expires_atstring date-time required
session_idstring required
api_regionstring required

Changes

No recorded changes to this operation across all 1 revision of this API.