The widget posts the key, the visitor's origin, and the target URL to POST /v1/embed/audit — the lead then lands in your Lead inbox
Every run starts and ends on public endpoints — no visitor account, no session cookie. The iframe handles the interaction; the server validates the key, the origin, and the quota before a single page is fetched.
1. The visitor submits a URL#
The form's field is placeholdered https://yoursite.com. On submit the widget first fires an audit_start event to POST /v1/embed/event, then POSTs { publishableKey, origin, targetUrl } to POST /v1/embed/audit. The origin in the body is document.referrer falling back to the widget's own location, but the allowlist check reads the browser-sent Origin/Referer header server-side, so it cannot be spoofed from the form.
2. Server-side checks, in order#
Missing fields return 400. An invalid, rotated, or inactive key returns 401 Invalid or inactive publishable key. An origin missing from the allowlist returns 403 This origin is not allowed for this embed. A spent daily quota returns 429 This embed's daily audit limit (N) has been reached. The target URL must be a public HTTP(S) address — a server-side URL guard rejects otherwise — and the endpoint itself is rate-limited to 10 requests per minute per client. Only then does the audit run at the config's reportDepth.
3. The result back in the widget#
Success returns the audit under an X-Audit-Cache header (HIT or MISS, so repeated runs of the same URL can be served from cache), and the widget shows Health Score for <final URL> plus the findings. An audit_complete event records the run; a failure surfaces the server's message and records audit_fail. If the visitor then submits the lead form (name, email, company, phone, consent), a lead event stores the row with targetUrl and reportHealthScore attached.
4. Where the run shows up for you#
The lead appears in your Lead inbox — columns Lead, Source, Captured, Status, Assigned, Actions, with All sources / All statuses filters, notes, and assignment. Per-embed run counts live behind GET /v1/embed-configs/:id/analytics.
Expected result#
A URL in, a score out for your visitor; an auditable lead row plus per-embed analytics for you — all governed by the key and origin rules from Get a publishable key.