Spaces Embed Service REST APIs overview

The Spaces Embed Service allows you to seamlessly integrate Boomi Spaces features, such as private marketplaces and publisher catalogs, directly into your application through a secure, embeddable interface. Instead of redirecting users to an external Boomi portal, the embed service surfaces curated content and workflows directly within your existing application. This delivers a consistent, co-branded user experience while Boomi manages authentication, data retrieval, and UI rendering behind the scenes.

Prerequisites for API execution

Before you make your first API call, confirm the following:

• You have an active Boomi account with Spaces Administrator access enabled.
• You have a Platform API token or a Platform JWT bearer token. To learn more about creating Platform API tokens, refer to Platform API Authentication.
• You know your Boomi account ID, and the account IDs and email IDs of your child accounts. This appears in the Boomi Platform under Settings > Account Information.
• (/v1/partners/**) requires a pre-issued Boomi-internal JWT with the BOOMI_INTERNAL authority. This token is issued out-of-band by Boomi's internal auth service and is not minted by this API.
• (/embed, /embed-auth/**, /logout) require an Auth0-issued launch id_token for a partner/tenant already registered with a reachable JWKS endpoint in this service's tenant configuration.

Important

The token generation must be triggered through an actual browser launch flow (GET /embed?token=...). Swagger's "Try it out" feature is not supported for this entry point.

Invoking Spaces within your application

The embed API is the entry point to launch Boomi spaces from within your application. The embed API requires an encoded JWT that decodes to JSON data (an example is shown below). The email, iss, and aud parameters are required inputs.

{
  "header": {
    "alg": "RS256",
    "typ": "JWT",
    "kid": "iR56drwti2atEbcShXs-D"
  },
  "payload": {
    "given_name": "SpacesOEM",
    "family_name": "Test",
    "nickname": "spacesoemtest",
    "name": "SpacesOEM Test",
    "picture": "https://lh3.googleusercontent.com/a/ACg8ocL499YCVhbVa-o8z-ON39dxdToAFfmIXWSlZViTnoJumv2biA=s96-c",
    "updated_at": "2026-09-01T08:44:00.224Z",
    "email": "spacesoemtest@gmail.com",
    "email_verified": true,
    "iss": "https://dev-7lpjrxtuiqabb305.us.auth0.com/",
    "aud": "vQpfuHf8flLMggaCZ7uXzpZwdnDVi4Uh",
    "sub": "google-oauth2|116599237663125626968",
    "iat": 1788252244,
    "exp": 1788288244,
    "sid": "lQQ6Rl9nSD1gruqHr6AiQzYkorpu3V9F",
    "nonce": "dzBpX19udXJBUEQwbn5ZZ2tXSnI1TVJZMlpEeTMwVEJNMVFHUjJBQ0RWZw=="
  }
}

For more information on the embed endpoint, refer to EmbedLaunch API reference.

Authentication

Two independent models are in play across this service:

1. /v1/partners/** — Boomi-internal JWT bearer token (BOOMI_INTERNAL authority). Click Authorize to supply it.

2. /embed, /embed-auth/**, /logout — a server-managed, httpOnly, SameSite=None session cookie minted by GET /embed. There is no bearer credential to enter here; these are documented for reference but are best exercised from a real browser session rather than Swagger's Try-it-out.

Important

JWT tokens expire after 5 minutes. If you make a request with an expired token, you will receive a 401 error. For detailed information on authentication, refer to JWT authentication tokens.

Required privileges

/v1/partners/** requires the BOOMI_INTERNAL authority on the bearer token, enforced before the request reaches the controller. A token without it is rejected with 401 (empty body). The embed/session group has no separate privilege beyond holding a valid, unexpired session. Any caller who completed the /embed launch flow may call /embed-auth/** and /logout for that session.

Base URL

The following base URLs are available based on your account's region:

• US: https://spaces-embed-service.boomi.com
• UK: https://spaces-embed-service.gb.boomi.com

Request and Response format

All API requests and responses use JSON format, unless explicitly highlighted. (For example, GET /v1/partners/jwt-platform-token returns a plain-text redirect URL, and GET /embed issues a 302 redirect with no body).

Content-Type: application/json

Paged list endpoints (For example, GET /v1/partners) wrap results in the PageResponse schema: {content, page, size, totalElements, totalPages}. Error bodies use the shared ErrorResponse schema: {errors: [{field, code, message}]}, with one entry per validation or business-rule failure.

note

A few specific operations document an ad-hoc error payload structure; refer to those individual operation specifications for details.

Error codes

Standard HTTP status codes (400, 401, 403, 404, 409, 422, 500, and 503) are used throughout this API. See each operation's Response for the list of codes it can return. For information about HTTP status codes and error responses, refer to Boomi Platform REST API errors.

API usage limits

No application-level rate limiting (per-account or otherwise) is currently enforced by this service.

Interactive API Testing

Import the Spaces Embed Service REST API collection into Postman to test endpoints, view request examples, and accelerate your integration development.

For more information about Postman collections, forking, and making your first API call, refer to the Working with Boomi APIs on Postman page.