Embedded designer
Embedded template API reference
Reference for session creation, layout ownership, validation, rendering, and security behavior.
Reviewed 2026-08-05 · PDFDesignAPI Engineering
Create editor session
POST /api/v1/embedded-templates/:baseTemplateUuid/:externalUuid/session authenticates with a team API token.
The optional expiresInMinutes value accepts 5 through 1440 minutes and defaults to 60. The operation is idempotent for the template pair.
Generate and validate
POST /api/v1/generate/single/:baseTemplateUuid/:externalUuid returns the PDF bytes.
POST /api/v1/templates/:baseTemplateUuid/:externalUuid/validate runs the same data-contract validation without rendering. Both calls require the team API token.
Immutable data boundary
The first editor session clones pages, dataSchema, and exampleData from the latest base version. Embedded saves may update pages and their layout components only.
The API rejects any changed dataSchema or exampleData with EMBEDDED_DATA_CONTRACT_READ_ONLY, even if a client bypasses the editor UI. Keep calculations and authorization in the host backend.
Ownership and security
Both UUIDs must be valid UUIDs. Every lookup is scoped to the authenticated team and cross-team base templates appear not found.
The external UUID is an application identifier, not a secret. Editor access requires the short-lived encrypted capability returned by session creation. Do not create sessions for unauthorized host users.