> ## Documentation Index > Fetch the complete documentation index at: https://docs.getprescience.com/llms.txt > Use this file to discover all available pages before exploring further. # Mint an iframe embed session > Creates a short-lived session for the company-specific plan reveal and verified handoff to hosted onboarding. Call this from your backend when the employer opens the offer, pass the returned `url` to your frontend, and render it in an iframe. Do not call it inside the census-sync handler. Sessions last 30 minutes, are scoped to one group, and should be recreated for each open or reload. Returns `409` once the group is enrolled, since there is nothing left to review. See the [Bolto iframe guide](/guides/bolto-iframe) for the exact backend-to-frontend flow. ## OpenAPI ````yaml /api-reference/openapi.json post /groups/{groupId}/embed-sessions openapi: 3.1.0 info: title: Prescience Partner API version: 1.1.0 description: >- Create employer groups, submit census records, generate preliminary market-rate quotes, create iframe sessions, create enrollments, and read aggregate account data. Money is always integer cents. Dates are `YYYY-MM-DD`; timestamps are ISO 8601 UTC. Final pricing, eligibility, network availability, and plan documents are confirmed during underwriting and onboarding. A BAA and data processing agreement are executed before live mode is enabled. contact: name: Prescience partner engineering email: partners@getprescience.com servers: - url: https://www.getprescience.com/api/partner/v1 description: >- Production. Test and live traffic share this host; mode comes from your API key. security: - bearerAuth: [] tags: - name: Health description: Connectivity and key checks. - name: Plans description: Static plan metadata. - name: Groups description: 'Employer groups: the root resource of every integration.' - name: Census description: Pre-enrollment census intake and ongoing member sync. - name: Quotes description: >- Preliminary quotes built from the stored census and current local market-plan snapshot. - name: Enrollments description: Plan selection and employer provisioning. - name: Account description: Aggregate, de-identified employer account data. - name: Webhooks description: Signed event delivery (standard-webhooks scheme). paths: /groups/{groupId}/embed-sessions: post: tags: - Groups summary: Mint an iframe embed session description: >- Creates a short-lived session for the company-specific plan reveal and verified handoff to hosted onboarding. Call this from your backend when the employer opens the offer, pass the returned `url` to your frontend, and render it in an iframe. Do not call it inside the census-sync handler. Sessions last 30 minutes, are scoped to one group, and should be recreated for each open or reload. Returns `409` once the group is enrolled, since there is nothing left to review. See the [Bolto iframe guide](/guides/bolto-iframe) for the exact backend-to-frontend flow. operationId: createEmbedSession parameters: - $ref: '#/components/parameters/GroupId' responses: '201': description: Embed session created. content: application/json: schema: $ref: '#/components/schemas/EmbedSession' example: token: f4b7c1a29d3e40518c6b2f7a9e0d3b81 url: >- https://www.getprescience.com/embed/partners/bolto/groups/grp_8c2f41d09a3e?token=f4b7c1a29d3e40518c6b2f7a9e0d3b81 expiresAt: '2026-08-08T23:10:00.000Z' '401': description: Missing or invalid partner API key. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Group not found for this partner. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- Group is already enrolled. Direct the employer to the employer portal instead. content: application/json: schema: $ref: '#/components/schemas/Error' components: parameters: GroupId: name: groupId in: path required: true description: Group ID, e.g. `grp_8c2f41d09a3e`. schema: type: string pattern: ^grp_[0-9a-f]{12}$ example: grp_8c2f41d09a3e schemas: EmbedSession: type: object required: - token - url - expiresAt properties: token: type: string description: >- Short-lived session token. Send it to the embed endpoints as `x-prescience-embed-token`. Never expose your partner API key to the browser — only this token belongs client-side. url: type: string format: uri description: >- Fully formed iframe URL with the token already applied. Return this field from your backend to your frontend and use it as the iframe src. Do not persist it. expiresAt: type: string format: date-time description: >- Expiry, 30 minutes after minting. Mint a fresh session rather than reusing an expired one. Error: type: object required: - error - message properties: error: type: string enum: - unauthorized - live_mode_disabled - forbidden - not_found - invalid_request - conflict - quote_expired - census_required - rate_limited - server_error - not_configured description: Stable machine-readable error code. message: type: string description: >- Human-readable explanation. Wording may change; branch on `error`, not `message`. details: type: array description: Present on `invalid_request`. One entry per failed field. items: type: object required: - field - message properties: field: type: string example: zip message: type: string example: zip must be a 5-digit ZIP code index: type: integer description: >- For array payloads (census rows), the zero-based index of the failing row. example: 7 securitySchemes: bearerAuth: type: http scheme: bearer description: >- Partner API key. `psk_test_<32 hex>` for test mode, `psk_live_<32 hex>` for live mode. Keys are stored hashed and cannot be recovered; store them in your secrets manager on issue. ````