Spaces Embed Service APIs - EmbedSession
Download OpenAPI Specification: Download
For more information about Postman collections, forking, and making your first API call, refer to the Working with Boomi APIs on Postman page.
Session identity + lifecycle for the embedded consumer UI. /embed-auth/** requires an active session (a server-managed httpOnly cookie, enforced by SessionFilter before the controller runs); /logout is public.
Log out of the embed session
Invalidates the session and clears the session cookie. Public — no auth required. Only 204 is ever returned: internal DynamoDB failures during session deletion are caught and logged, never surfaced to the caller, so there is no observable error path for this endpoint.
Responses
Record the SPA's current route
Records the active path on the caller's session so a subsequent GET /embed request carrying the same session cookie can preserve the path in the new session. Best-effort: the consumer UI fires this on every route change and ignores failures.
Request Body schema: application/jsonrequired
The SPA's current in-app route.
| path | any The active in-app path of the consumer UI, sanitized and validated server-side (see the 400 response). It is then replayed by GET /embed to restore state in the caller's next session. |
Responses
Request samples
- Payload
{- "path": "/settings/profile"
}Get the caller's embed identity
Returns the non-secret identity the SPA needs to skip login and set the active space. No token is ever returned. Requires an active session (session cookie set by GET /embed).
Responses
Response Schema: application/json
| spaceAccountId | any The child account ID the SPA uses to build API URLs for the child's own resources; falls back to the parent accountId in single-tenant/demo mode (no childDetails). |
| spaceGuid | any The Space GUID for the caller's active session. Empty string when none was resolved. |
| allowedOrigin | any Per-session OEM parent origin, resolved from this partner's registered allowed origins. Used by the embedded UI as the postMessage target / inbound origin check. Empty string when none is configured. |
Response samples
- 200
{- "spaceAccountId": "acme-child-001",
- "spaceGuid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
}