Embed

The embed flow renders Pathway’s Book interface inside your application. The person viewing it does not need a Pathway login or API token. Your server creates a book-scoped emb_... token with its PAT. Your frontend places that embed token in an iframe URL.

Create embed tokens on your server. The PAT used to create them must never be shipped to the browser.

Create an embed token

POST /embed/token
Content-Type: application/json

string

required

UUID of the Book the viewer can access.

boolean

default:"false"

Temporary tokens expire after 24 hours. Permanent tokens have no scheduled expiration.

import requests

API_BASE = "https://api.lendpathway.com/api"
APP_BASE = "https://app.lendpathway.com"
TOKEN = "pat_your_token_here"
BOOK_ID = "99cc93e6-1f3f-42b1-9fe4-ba5a95be9c78"

response = requests.post(
    f"{API_BASE}/embed/token",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json={"book_id": BOOK_ID, "permanent": False},
    timeout=30,
)
response.raise_for_status()

embed = response.json()
embed_url = f"{APP_BASE}/embed/book/{embed['embed_token']}?theme=light"
print(embed_url)

const API_BASE = "https://api.lendpathway.com/api";
const APP_BASE = "https://app.lendpathway.com";
const TOKEN = "pat_your_token_here";
const BOOK_ID = "99cc93e6-1f3f-42b1-9fe4-ba5a95be9c78";

const response = await fetch(`${API_BASE}/embed/token`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ book_id: BOOK_ID, permanent: false }),
});

if (!response.ok) {
  throw new Error(`${response.status}: ${await response.text()}`);
}

const embed = await response.json();
const embedUrl = `${APP_BASE}/embed/book/${embed.embed_token}?theme=light`;
console.log(embedUrl);

curl --fail-with-body \
  "https://api.lendpathway.com/api/embed/token" \
  -H "Authorization: Bearer pat_your_token_here" \
  -H "Content-Type: application/json" \
  --data '{"book_id":"99cc93e6-1f3f-42b1-9fe4-ba5a95be9c78","permanent":false}'

Response

class EmbedTokenResponse(BaseModel):
    embed_token: str
    book_id: str
    expires_at: str | None = None

{
  "embed_token": "emb_VWUCi3ml0L05CSkgZNBli4hKs8ObZrzaO9XGRUySJ8A",
  "book_id": "99cc93e6-1f3f-42b1-9fe4-ba5a95be9c78",
  "expires_at": "2026-07-22T18:30:00+00:00"
}

expires_at is null for a permanent token. Pathway keeps one active embed token per Book. When a valid token already exists, the endpoint returns that token and its current expiration.

Render the Book

<iframe
  src="https://app.lendpathway.com/embed/book/emb_your_token_here?theme=light"
  title="Pathway underwriting report"
  width="100%"
  height="900"
  style="border: 0"
  loading="lazy"
  allow="clipboard-write"
></iframe>

URL parameters

string

Set light or dark. Set this explicitly when the embed should match the surrounding application.

string

Opens the Book on a specific available tab. Omit it to use the Book’s normal default.

The embedded Book reuses the same synopsis, transactions, credit, tax, application, file, and contract surfaces as the Pathway app. Available tabs depend on the parsed document types.

Render the funder directory

The same token can render the organization funder directory:

<iframe
  src="https://app.lendpathway.com/embed/funders/emb_your_token_here?theme=light"
  title="Funder directory"
  width="100%"
  height="900"
  style="border: 0"
></iframe>

The directory is read-only under an embed token.

Fetch the embed payload directly

GET /embed/book/{embed_token}

The embed token in the URL is the credential. Do not send the PAT.

from typing import Any

from pydantic import BaseModel


class EmbedBookResponse(BaseModel):
    book: Book
    analytics: BookAnalytics | None
    tagConfig: dict[str, Any]
    documents: list[Document]

response = requests.get(
    f"{API_BASE}/embed/book/{embed_token}",
    timeout=60,
)
response.raise_for_status()

payload = response.json()
print(payload["book"]["name"])
print(payload["analytics"])

analytics is null when the Book does not contain canonical bank data. Document objects include temporary presigned URLs used by the embedded viewer.

Validate a token

GET /embed/validate/{embed_token}

class EmbedValidateResponse(BaseModel):
    valid: bool
    org_id: str
    book_id: str

An invalid or expired token returns 401. A valid token returns the Book and organization context used by the iframe.

Security model

An embed token can read one Book and organization-level read surfaces used by the embed.
Mutating requests made with X-Embed-Token return 403.
Temporary tokens live for 24 hours.
Permanent tokens persist until removed from Pathway’s storage.
Anyone holding the embed URL can open it, so handle the URL as a secret share link.

Prefer temporary tokens for short sessions. Use permanent tokens when the same embedded report must remain available across visits.

Overview

Endpoints

Cookbook

Create an embed token

Response

Render the Book

URL parameters

Render the funder directory

Fetch the embed payload directly

Validate a token

Security model

​Create an embed token

​Response

​Render the Book

​URL parameters

​Render the funder directory

​Fetch the embed payload directly

​Validate a token

​Security model

Create an embed token

Response

Render the Book

URL parameters

Render the funder directory

Fetch the embed payload directly

Validate a token

Security model