curl --request POST \
--url https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions \
--header 'Authorization: Bearer <token>'import requests
url = "https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"token": "f4b7c1a29d3e40518c6b2f7a9e0d3b81",
"url": "https://www.getprescience.com/embed/partners/bolto/groups/grp_8c2f41d09a3e?token=f4b7c1a29d3e40518c6b2f7a9e0d3b81",
"expiresAt": "2026-08-08T23:10:00.000Z"
}{
"error": "unauthorized",
"message": "<string>",
"details": [
{
"field": "zip",
"message": "zip must be a 5-digit ZIP code",
"index": 7
}
]
}{
"error": "unauthorized",
"message": "<string>",
"details": [
{
"field": "zip",
"message": "zip must be a 5-digit ZIP code",
"index": 7
}
]
}{
"error": "unauthorized",
"message": "<string>",
"details": [
{
"field": "zip",
"message": "zip must be a 5-digit ZIP code",
"index": 7
}
]
}Mint an iframe embed session
Creates a short-lived session for the company-specific plan reveal and verified handoff to hosted onboarding. Call this from your backend when the employer opens the offer, pass the returned url to your frontend, and render it in an iframe. Do not call it inside the census-sync handler. Sessions last 30 minutes, are scoped to one group, and should be recreated for each open or reload. Returns 409 once the group is enrolled, since there is nothing left to review. See the Bolto iframe guide for the exact backend-to-frontend flow.
curl --request POST \
--url https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions \
--header 'Authorization: Bearer <token>'import requests
url = "https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://www.getprescience.com/api/partner/v1/groups/{groupId}/embed-sessions")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"token": "f4b7c1a29d3e40518c6b2f7a9e0d3b81",
"url": "https://www.getprescience.com/embed/partners/bolto/groups/grp_8c2f41d09a3e?token=f4b7c1a29d3e40518c6b2f7a9e0d3b81",
"expiresAt": "2026-08-08T23:10:00.000Z"
}{
"error": "unauthorized",
"message": "<string>",
"details": [
{
"field": "zip",
"message": "zip must be a 5-digit ZIP code",
"index": 7
}
]
}{
"error": "unauthorized",
"message": "<string>",
"details": [
{
"field": "zip",
"message": "zip must be a 5-digit ZIP code",
"index": 7
}
]
}{
"error": "unauthorized",
"message": "<string>",
"details": [
{
"field": "zip",
"message": "zip must be a 5-digit ZIP code",
"index": 7
}
]
}Authorizations
Partner API key. psk_test_<32 hex> for test mode, psk_live_<32 hex> for live mode. Keys are stored hashed and cannot be recovered; store them in your secrets manager on issue.
Path Parameters
Group ID, e.g. grp_8c2f41d09a3e.
^grp_[0-9a-f]{12}$Response
Embed session created.
Short-lived session token. Send it to the embed endpoints as x-prescience-embed-token. Never expose your partner API key to the browser — only this token belongs client-side.
Fully formed iframe URL with the token already applied. Return this field from your backend to your frontend and use it as the iframe src. Do not persist it.
Expiry, 30 minutes after minting. Mint a fresh session rather than reusing an expired one.