> ## Documentation Index > Fetch the complete documentation index at: https://rubie.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Get embedded credential session > Confirm widget completion and retrieve the selected Blueprint and credential id. Returns the authoritative state of an Embedded Credential Capture session. Call this endpoint from your backend after the widget posts a completion event. ```bash theme={null} curl --fail-with-body -sS \ "$RUBIE_API_URL/api/v1/embedded-credential-sessions/ecs_..." \ -H "Authorization: Bearer $RUBIE_API_KEY" ``` ## Notes * Only trust `credential_id` and `selected_blueprint_key` from this authenticated response, never from browser input. * Persist both values only when `status` is `completed`. * `embed_url` is `null` after the session completes or expires. * If the status is non-terminal after a completion event, poll every 2 seconds for a short period. See [Embedded Credential Capture](/guides/embedded-credential-capture) for the complete integration flow. ## OpenAPI ````yaml GET /embedded-credential-sessions/{id} openapi: 3.0.3 info: title: Rubie API version: 1.0.0 description: > Collect end-user credentials through a Rubie-hosted form, then run Rubie Blueprints against them asynchronously. This API is deliberately thin. Rubie does not model your domain: what a Blueprint accepts as input, what it does with a connected system, and what it produces are all defined by that Blueprint's configuration. The endpoints below are the transport around it. All endpoints require bearer authentication. Responses use opaque prefixed IDs (`cred_`, `sess_`, `ecs_`, `strat_`, `run_`, `bp_`), snake_case fields, and a single top-level error envelope — never a `success` wrapper. servers: - url: https://app.rubiehq.com/api/v1 description: Production security: - BearerAuth: [] tags: - name: Credential Sessions description: Start and poll Rubie-hosted credential collection flows. - name: Embedded Credential Sessions description: Embed a Blueprint picker and credential capture flow in your product. - name: Credentials description: Revoke vaulted credentials. - name: Blueprints description: Trigger a Rubie Blueprint run. - name: Blueprint Runs description: Poll run status and retrieve completed outputs. paths: /embedded-credential-sessions/{id}: get: tags: - Embedded Credential Sessions summary: Get embedded credential session status description: > Returns the authoritative state of an embedded credential session. Confirm completion through this authenticated endpoint after receiving a browser event; never trust credential or Blueprint identifiers supplied by the browser. operationId: getEmbeddedCredentialSession parameters: - name: id in: path required: true schema: type: string example: ecs_MQ responses: '200': description: Embedded credential session content: application/json: schema: $ref: '#/components/schemas/EmbeddedCredentialSession' examples: pending: summary: Waiting on the end user value: id: ecs_MQ status: pending embed_url: https://app.rubiehq.com/embed/credential-capture/abc123 blueprint_keys: - adp-worker-sync - gusto-worker-sync selected_blueprint_key: null credential_id: null parent_origin: https://app.example.com expires_at: '2026-08-17T23:00:00.000Z' completed_at: null created_at: '2026-08-17T22:45:00.000Z' completed: summary: Credential ready value: id: ecs_MQ status: completed embed_url: null blueprint_keys: - adp-worker-sync - gusto-worker-sync selected_blueprint_key: adp-worker-sync credential_id: cred_NDc parent_origin: https://app.example.com expires_at: '2026-08-17T23:00:00.000Z' completed_at: '2026-08-17T22:48:12.000Z' created_at: '2026-08-17T22:45:00.000Z' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: schemas: EmbeddedCredentialSession: type: object required: - id - status - blueprint_keys - parent_origin - expires_at - created_at properties: id: type: string example: ecs_MQ description: Opaque embedded credential session id. status: $ref: '#/components/schemas/EmbeddedCredentialSessionStatus' embed_url: type: string format: uri nullable: true description: > Origin-bound iframe URL. Present while the session is pending and null after it completes or expires. blueprint_keys: type: array minItems: 1 maxItems: 50 uniqueItems: true items: type: string description: Exact set of Blueprints displayed in the widget. selected_blueprint_key: type: string nullable: true description: > Blueprint selected by the end user. Present when status is completed and guaranteed to belong to blueprint_keys. credential_id: type: string nullable: true example: cred_NDc description: > Vaulted credential id. Present only when status is completed. Retain it against the initiating user and selected Blueprint. parent_origin: type: string format: uri example: https://app.example.com description: Exact allowlisted HTTPS origin permitted to frame the widget. expires_at: type: string format: date-time completed_at: type: string format: date-time nullable: true created_at: type: string format: date-time EmbeddedCredentialSessionStatus: type: string description: > Lifecycle status of an embedded credential session. `completed` and `expired` are terminal. Treat this as an open string set and keep polling on statuses you do not recognise. enum: - pending - completed - expired ErrorResponse: type: object required: - error properties: error: $ref: '#/components/schemas/Error' Error: type: object required: - type - message properties: type: type: string enum: - authentication_error - authorization_error - not_found - validation_error - conflict - rate_limit_exceeded - internal_error message: type: string details: type: array items: $ref: '#/components/schemas/ErrorDetail' ErrorDetail: type: object required: - message properties: message: type: string code: type: string nullable: true field: type: string nullable: true responses: Unauthorized: description: Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: API key is not authorized for this resource content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found in this account content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: APIKey description: Your Rubie API key as a bearer token. ````