# Embed a data question window in a webpage

Embed a data question window in business pages and control visitors' data permissions through a bound role.

使用指南 · 模块: integrations · 应用开发者 · 部署形态：资料未说明 · 已确认产品版本：资料未说明 · 来源：现有文档

Embedding turns a data Agent into a public URL you can place in your own page using an iframe. Visitors do not log in to AskTable or select data sources or roles. Each URL binds to one fixed role, and all visitors ask questions within that role's data scope.

WeCom and WPS here are only host pages for the iframe, not AskTable messaging channels or WeCom/WPS login. Those login methods use [WeCom and WPS identity integration](https://docs.asktable.com/en/admin/identity).

## Before you begin

- Permissions: your project role must be “Project owner” or “Project administrator.”
- Prerequisite: a configured data Agent; see [Create and configure a data Agent](https://docs.asktable.com/en/agent/overview).
- Choose a role first: its data scope is exposed to all visitors. Confirm it is suitable for external access before binding.
- Host page: its HTML must be editable so you can add an `<iframe>`.
- Entry: left main navigation → “More” → open target Agent → top “Embed” tab.

## Steps

**Create an embed URL**

The “Embed” tab has an “Embed URLs” section, explaining that it creates embeddable URLs for placing this Agent on external sites via iframe. An empty list shows No embed URLs and suggests creating one to embed the Agent on an external site. Click “New URL” to open the creation dialog.

**Enter a name and role**

- Name is required, with a placeholder such as Official website embed, and supports up to 255 characters.
- Role is required; choose an existing role from the dropdown. If it has required variables, the dialog requires their values before submission; the variables apply identically to all visitors.

All visitors share this role and see the same data boundaries. To isolate data by visitor identity, use [Feishu](https://docs.asktable.com/en/integrations/feishu) or [Slack](https://docs.asktable.com/en/integrations/slack) channels with person authorization, or enterprise identity login.

**Choose whether to enable trusted domains**

The form has a Trusted domains switch, off by default. When off, the explanation says any website can embed this URL without origin domain checks, so any site can embed the iframe.

Enabling it reveals an Allowed domains input with a placeholder such as example.com or \*.example.com. Enter the domain of the outer embedding site (the page containing the iframe), not AskTable's own domain. Enter domains without `http://` or `https://`; `*.example.com` covers all subdomains. Enabling checks with an empty allowlist blocks all sites, so enter at least one domain.

**Save and copy the embed code**

Click “Save”; success shows Created successfully. New URLs are enabled immediately, and the status on the right of the list entry says Enabled.

Use “Copy embed code” in the entry's “More” menu on the right; successful copying shows a message. Paste the code into the host page:

```html
<iframe src="https://<your-AskTable-site>/embed/emb_xxxx" referrerpolicy="strict-origin-when-cross-origin" style="width:100%;height:600px;border:0" />
```

Do not remove `referrerpolicy`. Firefox cannot read the iframe's parent-page origin and relies on this fallback. If it is removed and the host page also sets global `no-referrer`, trusted-domain checks return 403 directly.

**Check the list entry's status**

Each entry shows its name, role badge, domain badge (domain count when checks are enabled, Any domain otherwise), usage statistics (active conversations over the last 7 days), and latest activity time (No conversations if none exist). The far right has status text and a switch.

Turning the switch off changes the status to Disabled and disconnects ongoing visitor conversations immediately. After re-enabling it, visitors can refresh to continue.

**Verify with a real host domain**

Verify at least four things: an allowed origin opens the page and completes a question; an origin outside the allowlist is rejected; follow-up questions stay within the bound role's scope; and disabling the URL disconnects existing conversations.

## Key constraints

| Item                                    | Value or default                                                                                  | Where to change it                            |
| --------------------------------------- | ------------------------------------------------------------------------------------------------- | --------------------------------------------- |
| Name                                    | Required, up to 255 characters                                                                    | Agent → “Embed” → “New URL”                   |
| Role                                    | Required; one role per URL                                                                        | Agent → “Embed” → “New URL”                   |
| Trusted domains                         | Off by default (no origin checks)                                                                 | Agent → “Embed” → “New URL”                   |
| Allowed domains                         | Available only when enabled; stores bare hostnames and supports `*.example.com`                   | Agent → “Embed” → “New URL”                   |
| Enabled state                           | Enabled on creation                                                                               | Switch on the right of the “Embed” list entry |
| Visitor conversation token validity     | 24 hours                                                                                          | No UI switch                                  |
| Visitor page fast mode                  | On initially for a new conversation (fast answers); visitors can turn it off for longer reasoning | Toolbar below the visitor page input          |
| When a tightened allowlist takes effect | At latest on the next token renewal or after 24-hour expiration                                   | No UI switch                                  |

## Troubleshooting

| Symptom                                                                     | Identifying condition                                                          | Resolution                                                                                      |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- |
| Visitor page says this embed is temporarily unavailable                     | Request returns `EMBED_DISABLED` (HTTP 403) and URL switch is Disabled         | Enable the switch in the Agent's “Embed” list                                                   |
| Visitor page says origin is not allowed                                     | Request returns `EMBED_ORIGIN_NOT_ALLOWED` (HTTP 403)                          | Add the host page domain to Allowed domains; confirm iframe `referrerpolicy` was not removed    |
| Visitor page says resource not found                                        | Request returns `RESOURCE_NOT_FOUND` (HTTP 404)                                | URL was deleted or the iframe's `emb_` identifier is incorrect                                  |
| No “New conversation” button on visitor page                                | Error is `EMBED_DISABLED`, `EMBED_ORIGIN_NOT_ALLOWED`, or `RESOURCE_NOT_FOUND` | New conversations fail for these same three reasons; resolve using the corresponding rows above |
| An old page still opens after allowlist changes                             | Visitor's conversation token has not expired                                   | Wait for token renewal or 24-hour expiration; disable the URL first in an emergency             |
| Visitor can query only some data                                            | The bound role defines that data scope                                         | Change the role or adjust scope in “Roles”                                                      |
| Visitor wants to resume a previous conversation, but refreshing starts over | More than 24 hours have passed and the token expired                           | Expected behavior; refreshing within 24 hours in the same browser resumes the conversation      |

## Next steps

- Isolate data by visitor identity instead of sharing a public URL: [Control data permissions for Feishu channel users](https://docs.asktable.com/en/permissions/feishu), [WeCom and WPS identity integration](https://docs.asktable.com/en/admin/identity)
- Narrow public scope with “Roles” and “Policies”: [Permissions and data security](https://docs.asktable.com/en/permissions)
- Send scheduled reports without waiting for visitor questions: [Scheduled analysis reports](https://docs.asktable.com/en/integrations/scheduled-reports)