Redeem a one-use bootstrap secret

Used by the origin-restricted wrapper after exact-origin/source/nonce handshake. Redeem once; expired, revoked or already redeemed sessions are refused. Replies are no-store. Customer applications normally use the browser mount helper.

post/embed/sessions/{session}/redeem

Request

  • Base URL: https://rendry.io/api/v1
  • URL: https://rendry.io/api/v1/embed/sessions/{session}/redeem
  • Auth: none required

Path parameters

sessionstring required

Request body

bootstrap_secretstring required

Response

Redeem a one-use bootstrap secret

idstring required
account_idstring required
actor_idstring required
subjectstring required
parent_originstring required
mode'live' | 'test' required
role'editor' | 'viewer' required
expires_atstring date-time required
bootstrap_secretstring

Only in issue response; one-use secret delivered by the customer server to its authenticated host page in memory.

tokenstring

Only in redeem response; em_... credential for the same-origin editor child.

Changes

No recorded changes to this operation across all 1 revision of this API.