Bolto iframe census review

Bolto can keep employers inside its benefits UI while Prescience handles census confirmation, preliminary pricing, spouse/dependent collection, and onboarding.

Flow

Bolto creates the employer group and syncs census from Check.
Bolto mints an embed session server-side.
Bolto renders the returned iframe URL in its marketplace UI.
The employer reviews the roster, excludes employees if needed, previews a preliminary estimate, and clicks Finalize in Prescience.
Prescience provisions hosted employer onboarding and emails employees for missing demographics and dependents.
Bolto continues daily reconciliation with GET /members and GET /account.

Mint an embed session

curl -X POST https://www.getprescience.com/api/partner/v1/groups/grp_8c2f41d09a3e/embed-sessions \
  -H "Authorization: Bearer $PRESCIENCE_API_KEY"

Response (201)

{
  "token": "f4b7...",
  "url": "https://www.getprescience.com/embed/partners/bolto/groups/grp_8c2f41d09a3e?token=f4b7...",
  "expiresAt": "2026-07-28T23:10:00.000Z"
}

Render url in an iframe. Sessions expire after 30 minutes.

Never put the partner API key in browser code. Only the short-lived embed token belongs in the iframe URL or request header.

Embed token API

All embed endpoints accept the session token via:

x-prescience-embed-token: <token>

Endpoint	Purpose
`GET /api/partner/embed/v1/groups/{groupId}`	Bootstrap group + census
`PUT /api/partner/embed/v1/groups/{groupId}/census`	Confirm edits and exclusions
`POST /api/partner/embed/v1/groups/{groupId}/estimate`	Create preliminary quote
`POST /api/partner/embed/v1/groups/{groupId}/finalize`	Enroll with hosted onboarding

Excluding employees

The iframe lets employers deselect employees from the quoting census without deleting them from Bolto’s source data. Persist this with:

{ "memberId": "mem_...", "excludedFromQuote": true }

Excluded employees stay in the stored census but are omitted from quoting and enrollment readiness checks.

Finalize handoff

POST /finalize creates the quote (if needed), enrolls the group with onboardingMode: "hosted", and returns:

{
  "redirectUrl": "https://www.getprescience.com/signin",
  "enrollment": { "...": "..." }
}

Redirect the top-level browser window to redirectUrl so the employer can complete onboarding in Prescience. Prescience then emails employees directly to collect spouse and dependent details.

Framing configuration

Embed pages send a CSP frame-ancestors directive for Bolto origins. Override allowed ancestors with:

PARTNER_EMBED_FRAME_ANCESTORS=https://app.bolto.com,https://staging.bolto.com

Per-partner overrides can also be stored on the partner record as embedAllowedOrigins from internal.getprescience.com → Partners.

Internal admin setup

Prescience ops uses the Partners tab in the internal admin portal to:

Create the Bolto partner (slug: bolto)
Configure iframe embed origins for Bolto staging and production hosts
Enable production keys when go-live is approved
Invite Bolto engineers by email to the Partner API key portal

Invited engineers sign in at internal.getprescience.com and mint their own sandbox (psk_test_...) and production (psk_live_...) keys. They cannot access other internal operations screens.

Get Started

Guides

Resources

Flow

Mint an embed session

Embed token API

Excluding employees

Finalize handoff

Framing configuration

Internal admin setup

​Flow

​Mint an embed session

​Embed token API

​Excluding employees

​Finalize handoff

​Framing configuration

​Internal admin setup

​Related guides

Flow

Mint an embed session

Embed token API

Excluding employees

Finalize handoff

Framing configuration

Internal admin setup

Related guides