A signed URL for the partner dashboard embed
const url = 'http://localhost:8000/api/partner/embed/';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url http://localhost:8000/api/partner/embed/ \ --header 'Authorization: Bearer <token>'Signs a Metabase static embed of «Ambassador · Partner view» with the ambassador’s slug LOCKED into the token — the dashboard’s filter can only take the value the server signed. Valid for an hour. The app’s partner tab draws its own tables from /ledger/ and /statements/ and no longer mounts this; kept for a deployment that still embeds the dashboard elsewhere. 404 without an ambassador record; 503 on a deployment where Metabase embedding is not configured (embed_available on /api/partner/me/ says so in advance); 401 without a session; 403 for a partner API key. A platform admin passes ?ambassador=<slug> to read any ambassador’s page (#2517).
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Query Parameters
Section titled “Query Parameters”A platform admin (the support account) reads THIS ambassador’s page, exactly as the ambassador sees it, and the read is written to the admin_action trail. Anyone else may pass only their own slug; any other value is the same 404 as having no record.
Responses
Section titled “Responses”GET /api/partner/embed/ — a short-lived signed URL for the partner dashboard.
object
Metabase static-embed URL, signed server-side with the ambassador’s slug locked into the token. Mount it in an <iframe>.
When the signature stops validating (an hour); fetch a fresh one before then.
Examples
A signed embed, valid for an hour
{ "url": "https://bi.ai.aikynetix.app/embed/dashboard/eyJhbGciOiJIUzI1NiJ9.eyJyZXNvdXJjZSI6eyJkYXNoYm9hcmQiOjE0fS…#bordered=false&titled=false", "expires_at": "2026-09-23T11:03:00Z"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Example generated
{ "detail": "example"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Example generated
{ "detail": "example"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Examples
No ambassador record on this account
{ "detail": "No ambassador record is linked to this account."}object
503 — a downstream dependency was unavailable and the request could not be served (e.g. enqueue_failed when the analysis queue can’t accept the job). Safe to retry with backoff.
Examples
Metabase embedding not configured on this deployment
{ "detail": "The partner dashboard is not enabled on this deployment."}