> ## Documentation Index > Fetch the complete documentation index at: https://docs.blujay.io/llms.txt > Use this file to discover all available pages before exploring further. # Create an embedded view URL > Reseller partner keys (`admin` or `messaging`) only, with `Blujay-Workspace`. Returns a single-use URL for the embedded messaging view, acting as one of the customer's teammates, either on one conversation (`thread`) or on the customer's whole inbox (`inbox`). The URL works once and only for 60 seconds, so create it when the page that shows it loads, and never log, store or share it. Only the page at `parent_origin` can frame it. Any other credential gets `404`. See the partner embed guide for framing and the view's messages. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/embed/sessions openapi: 3.1.0 info: title: Blujay API version: 1.0.0 description: >- The Blujay API lets you send and receive iMessage, RCS and SMS messages from your Blujay phone numbers, manage contacts, and receive real-time webhooks. Every response uses the same JSON envelope and carries a `trace_id` you can share with support. Authenticate with your workspace API key. servers: - url: https://api.blujay.io description: Production security: - PublicApiKey: [] tags: - name: Auth description: Check which workspace and credential a request is using. - name: Chats description: >- Direct and group conversations between your Blujay numbers and your contacts. - name: Messages description: Send, read, edit, unsend and react to messages. - name: Phone Numbers description: >- Your Blujay numbers, whether each can send right now, and their live sending limits. - name: Capability description: >- Check whether a phone number can be reached by iMessage, RCS or SMS before you send. - name: Contacts description: Create, find, update, tag, assign and opt out contacts. - name: vCards description: >- Saved contact cards that you can send in a message. Recipients get a native contact card over iMessage, SMS or RCS. - name: Team Members description: People in your workspace you can assign contacts to. - name: Workflows description: Enroll contacts in workflows you start manually. - name: Attachments description: >- Upload files once and reuse them in messages, or download files from messages. - name: Calls description: Download call recordings referenced by call webhooks. - name: Webhooks description: Subscribe to events, inspect delivery attempts and verify signatures. - name: Partners description: >- For Blujay reseller partners. A partner runs many customer workspaces through one integration. Partner keys carry a role (`admin` or `messaging`) and name a customer in the `Blujay-Workspace` header. paths: /v1/embed/sessions: post: tags: - Partners summary: Create an embedded view URL description: >- Reseller partner keys (`admin` or `messaging`) only, with `Blujay-Workspace`. Returns a single-use URL for the embedded messaging view, acting as one of the customer's teammates, either on one conversation (`thread`) or on the customer's whole inbox (`inbox`). The URL works once and only for 60 seconds, so create it when the page that shows it loads, and never log, store or share it. Only the page at `parent_origin` can frame it. Any other credential gets `404`. See the partner embed guide for framing and the view's messages. operationId: createPartnerEmbedSession parameters: - $ref: '#/components/parameters/BlujayWorkspace' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreatePartnerEmbedSessionRequest' responses: '201': description: The view URL was created. headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object required: - data properties: data: $ref: '#/components/schemas/PartnerEmbedSession' '400': description: >- `parent_origin` is not one of your registered framing origins (`EMBED_PARENT_ORIGIN_NOT_REGISTERED`), the mode and conversation don't match (`VALIDATION_ERROR`), or the header is missing (`WORKSPACE_HEADER_REQUIRED`). headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '401': $ref: '#/components/responses/Unauthorized' '404': description: >- The teammate or chat isn't in that customer, or the credential isn't a partner key (`NOT_FOUND`). headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '409': description: >- The customer is paused (`CUSTOMER_PAUSED`) or closing (`CUSTOMER_CLOSING`). headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '503': description: >- The embedded view can't be opened right now (`EMBED_UNAVAILABLE`). Retry later. headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' security: - PublicApiKey: [] components: parameters: BlujayWorkspace: name: Blujay-Workspace in: header required: false schema: $ref: '#/components/schemas/WorkspaceId' description: >- Reseller partner keys only. The `workspace_` ID of one of your customers; the request runs as that customer. schemas: CreatePartnerEmbedSessionRequest: type: object additionalProperties: false required: - team_member_id - mode - parent_origin description: >- `thread` mode needs exactly one of `phone_number` or `chat_id`; `inbox` mode takes neither. properties: team_member_id: type: string minLength: 1 maxLength: 200 description: >- An active teammate of the customer, from `POST /v1/team-members`. The view acts as this teammate. mode: type: string enum: - thread - inbox description: >- `thread` shows one conversation; `inbox` shows the customer's whole inbox with the assignee filter. phone_number: type: string minLength: 1 maxLength: 64 examples: - '+14805550101' description: Thread mode only. A US number, with or without a contact yet. chat_id: type: string minLength: 1 maxLength: 200 description: Thread mode only. A direct or group chat of the customer. parent_origin: type: string minLength: 1 maxLength: 255 examples: - https://app.yourproduct.com description: >- The exact origin of the page that will frame the view; one of your registered framing origins. SuccessEnvelope: type: object description: Wraps every successful response. The result is in `data`. required: - status - trace_id - timestamp properties: status: type: string enum: - success trace_id: $ref: '#/components/schemas/TraceId' timestamp: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time client_request_id: type: string description: >- Your `X-Request-ID` header value, echoed back when you send one. Not included on the send responses (`POST /v1/chats` and `POST /v1/chats/{chat_id}/messages`); keep your own mapping from your request ID to the returned message ID there. PartnerEmbedSession: type: object additionalProperties: false required: - url - expires_at properties: url: type: string format: uri description: >- The single-use view URL. Frame it from `parent_origin`; never log, store or share it. expires_at: type: string format: date-time description: When the URL stops working (60 seconds after it was created). ErrorEnvelope: type: object description: >- Wraps every error response. Branch on `error.code`, and include `trace_id` when you contact support. required: - status - error - trace_id - timestamp properties: status: const: error error: $ref: '#/components/schemas/PublicError' trace_id: $ref: '#/components/schemas/TraceId' timestamp: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time client_request_id: type: string description: Your `X-Request-ID` header value, echoed back when you send one. WorkspaceId: type: string examples: - workspace_abc123 pattern: ^workspace_[A-Za-z0-9_-]+$ TraceId: type: string examples: - trc_8f2a1c0e4b7d pattern: ^trc_[A-Za-z0-9_-]+$ PublicError: type: object required: - code - message - type - http_status - retryable - doc_url - details properties: code: type: string description: Stable, machine-readable error code. Branch on this value. examples: - RATE_LIMIT_EXCEEDED - QUEUE_UNAVAILABLE - FEATURE_NOT_ENABLED message: type: string description: Human-readable explanation. It can change, so don't parse it. type: type: string description: Broad error category. examples: - validation - auth - idempotency - rate_limit - queue - feature_gate http_status: type: integer description: The HTTP status code of the response. enum: - 400 - 401 - 403 - 404 - 409 - 413 - 415 - 422 - 429 - 500 - 502 - 503 retryable: type: boolean description: Whether sending the same request again later can succeed. doc_url: type: string format: uri description: Link to documentation for this error code. details: type: array description: >- Extra structured context, such as the fields that failed validation or the limit you hit. items: type: object additionalProperties: true retry_after: type: integer minimum: 1 description: >- Seconds to wait before retrying. Also sent as the `Retry-After` header. reset_at: type: string examples: - '2026-10-14T17:01:00.000Z' format: date-time description: When the limit you hit resets. headers: XTraceID: description: >- Unique ID for this request. It matches `trace_id` in the body. Include it when you contact Blujay support. schema: $ref: '#/components/schemas/TraceId' responses: Unauthorized: description: >- The API key is missing or invalid (`UNAUTHORIZED`), revoked (`API_KEY_REVOKED`) or expired (`API_KEY_EXPIRED`). headers: X-Trace-ID: $ref: '#/components/headers/XTraceID' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: PublicApiKey: type: http scheme: bearer bearerFormat: blu_... description: > Your workspace API key, sent as `Authorization: Bearer blu_...`. Workspace admins can find it in the Blujay app under **API**. An API key has full access to your workspace and works on every endpoint. There is no test mode: every key sends real messages and changes real data, so keep it secret and use it only from your server. Each API key can make 600 read requests and 120 write requests per minute, plus 60 attachment requests per minute. Over a limit you get `429 RATE_LIMIT_EXCEEDED` with `Retry-After`. **Reseller partner keys.** A partner key acts for one of the partner's customers when the request names it in the `Blujay-Workspace` header (the customer's `workspace_` ID). Without the header it reaches only `/v1/partner/*` and `/v1/me`. Each customer gets the limits above for each partner key, and all of a partner's requests together get ten times those limits; a `429` says which in `error.details[0].scope` (`partner_customer` or `partner`). A `messaging` key can read anything for a customer and change chats, messages, contacts, attachments and vCards; everything else needs an `admin` key (`403 PARTNER_ROLE_FORBIDDEN`). Paused or closing customers can be read but not changed (`409 CUSTOMER_PAUSED` or `CUSTOMER_CLOSING`). Any other workspace ID in the header returns `404 NOT_FOUND`; using the header with any other credential returns `400 WORKSPACE_HEADER_NOT_ALLOWED`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.