Skip to navigation
APIEmbed

Get iframe handle

Retrieves an iframe handle by id: its status (pending, exchanged, expired or revoked) and, once exchanged, the session_id its revoke takes. The key that minted the handle reads it; a workspace administrator reads any handle in the organization.

Requires the embed:write scope. Rate limit: 200 requests per minute per key (the api lane).

Authentication

AuthorizationBearer

Bearer token. Use ss_live_… for live data or ss_test_… for the sandbox (test mode). See Authentication.

Path parameters

handle_idstringRequired
The iframe handle's id.

Headers

SpreadSpace-VersionstringOptionalformat: "^\d{4}-\d{2}-\d{2}$"

Pin the API version, e.g. 2026-10-07. Omit to get the latest. See Versioning.

Response headers

X-Request-IDstringOptional
Correlation ID for this request. Quote it in support tickets.
SpreadSpace-VersionstringOptional

The API surface version the server resolved for this request. Always present, regardless of whether the client supplied the request-side SpreadSpace-Version header. Default: 2026-10-07.

RateLimit-Limitinteger

Request budget of the endpoint’s rate-limit policy per 60-second sliding window. See Rate limits.

RateLimit-Remaininginteger

Requests left in the current window. Suppressed on 429 responses produced outside the rate limiter (for example a usage throttle), where a remaining budget would be misleading.

RateLimit-Resetinteger

Seconds until a guaranteed-fresh window.

RateLimit-PolicystringOptional

The active policy in limit;w=window-seconds form.

Response

OK
handle_idstring
statusenum

pending (not yet exchanged, not expired), exchanged, expired (never exchanged) or revoked. A revoked handle reads revoked whether or not it was exchanged or has expired.

Allowed values:
surfaceenum
Allowed values:
loan_idstring
scopeslist of strings
The scopes the session carries once exchanged.
token_lifetime_secondsinteger
Lifetime, in seconds, of the session an exchange mints.
expires_atdatetime
created_atdatetime
external_user_idstring or nullOptional

The external_user_id the mint named; null when it named none.

exchanged_atdatetime or nullOptional
revoked_atdatetime or nullOptional
session_idstring or nullOptional

The embed session the exchange minted: the id DELETE /api/embed/sessions/{session_id} takes. Null until exchanged.

Errors

400
Bad Request Error
401
Unauthorized Error
402
Payment Required Error
403
Forbidden Error
404
Not Found Error
429
Too Many Requests Error
500
Internal Server Error