Create a Vitals Scan Embed Session

POST

/businesses/{businessId}/vitals/scans/{scanId}/embed-sessions

curl --request POST \
  --url https://api.upvio.com/v1/businesses/example/vitals/scans/example/embed-sessions \
  --header 'Authorization: Bearer <token>'

• production

Create a URL that opens a pending or started vitals scan inside an iframe on one of the business’s embedAllowedOrigins, without the patient signing in. The URL is valid for one hour and can be loaded more than once until it expires. Create a new session each time the page that embeds the scan is rendered. Requires the VitalsScanEmbedSession:write:all scope, the vitals.embed feature and at least one embed allowed origin.

Authorizations

• apiKey

Parameters

Path Parameters

businessId

required

string

The ID of the Business.

scanId

required

string

The ID of the Vitals Scan.

Responses

201

The embed session was created.

Media typeapplication/json

object

data

object

url

required

The URL to load in an iframe on one of the business’s embedAllowedOrigins. It opens the scan without the patient signing in.

string format: uri

expiresAt

required

When the URL stops working.

string format: date-time

Example ^generated

{
  "data": {
    "url": "https://example.com",
    "expiresAt": "2026-04-15T12:00:00Z"
  }
}

400

The business has no embed allowed origins, or the Business ID does not match the API key.

Media typeapplication/json

object

error

object

code

number

type

The specific error that occurred.

string

Allowed values: BadRequestError

title

Human-readable description of the error.

string

Example

{
  "error": {
    "code": 400,
    "type": "BadRequestError",
    "title": "Add an embed allowed origin before embedding scans"
  }
}

403

The API key is missing or invalid, the Business cannot be accessed with it, the VitalsScanEmbedSession:write:all scope is missing, or the vitals.embed feature is not enabled.

Media typeapplication/json

object

error

object

code

number

type

The specific error that occurred.

string

Allowed values: ActionUnauthorizedError UnauthorizedError BusinessArchivedError BusinessDisabledError

title

Human-readable description of the error.

string

Example

{
  "error": {
    "code": 403,
    "type": "UnauthorizedError",
    "title": "Embedding the Scan Interface is not enabled"
  }
}

404

The Business or the vitals scan does not exist.

Media typeapplication/json

object

error

object

code

number

type

The specific error that occurred.

string

Allowed values: NotFoundError BusinessNotFoundError

title

Human-readable description of the error.

string

Example

{
  "error": {
    "code": 404,
    "type": "NotFoundError",
    "title": "Vitals Scan not found"
  }
}

409

The vitals scan has already succeeded, failed or been aborted.

Media typeapplication/json

object

error

object

code

number

type

The specific error that occurred.

string

Allowed values: ConflictError

title

Human-readable description of the error.

string

Example

{
  "error": {
    "code": 409,
    "type": "ConflictError",
    "title": "Vitals Scan has already finished"
  }
}