Interface: WidgetEmbedPolicyResponse

Defined in: packages/sdk/src/types/generated/workspace_widget_domain.ts:66

Edge origin-gate policy for one (workspace, widget slug) — the P2 gate.

Consumed by src/proxy.ts at the edge to decide whether a widget document request may render and with what frame-ancestors. frameAncestors is the set of verified-domain origins that have this slug enabled, already formatted as edge matcher rules (e.g. https://acme.com or, for subdomain-enabled entries, https://*.acme.com).

This DB-backed gate is the sole origin authority — an empty list means no verified domain enables this slug for the workspace, so the edge denies every parent origin (fail-closed).

organizationUuid / ssoEnabled / ssoProviderType are public display fields the widget auth-redirect flow uses to send the operator through org SSO when the embedder opted into a top-level redirect. They match GET /api/v2/o/{org}/config and carry no secrets. They are omitted (null / false) when the workspace is unknown so an enumeration of org uuids is not possible from a random wid.

Properties

frameAncestors

frameAncestors: string[]

Defined in: packages/sdk/src/types/generated/workspace_widget_domain.ts:67

---

organizationUuid?

optional organizationUuid: string | null

Defined in: packages/sdk/src/types/generated/workspace_widget_domain.ts:68

---

ssoEnabled?

optional ssoEnabled: boolean

Defined in: packages/sdk/src/types/generated/workspace_widget_domain.ts:69

---

ssoProviderType?

optional ssoProviderType: string | null

Defined in: packages/sdk/src/types/generated/workspace_widget_domain.ts:70