---
title: "Embed frame-ancestors allowlist for a property"
method: GET
path: "/properties/embed-config/{state}/{slug}"
tags: ["Propertys"]
---

# Embed frame-ancestors allowlist for a property

`GET /properties/embed-config/{state}/{slug}`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/properties/embed-config/{state}/{slug}`
- Auth: none declared

Return the parent origins permitted to iframe this property's embed widget.

Consumed by the Next.js `/embed/*` proxy (`proxy.ts`) to build a per-request
CSP `frame-ancestors` header (see Stage 3 of the embeddable-checkout roadmap).
Deliberately a thin, embed-only surface — kept off the shared
`GET /properties/by-location` response so the agent-facing property schema
stays free of GUI-embed-only fields (AGENT_HUMAN_PARITY). Returns an empty
list (default-deny) when the property has no registered origins; 404 when
no visible property matches.

## Path parameters

- `state` string, required
- `slug` string, required

## Query parameters

- `country` 'AU' | 'NZ': ISO country code used to scope public property inventory.

## Headers

- `API-Version` '1'

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/totalparks/apis/total-parks-public-api.md) · [All operations](https://skmtc.dev/totalparks/apis/total-parks-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/totalparks/apis/total-parks-public-api/revisions/dcb4c822e2c6?raw)