> ## Documentation Index > Fetch the complete documentation index at: https://docs.trycactus.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a private, read-only report embed session > Call from your authenticated backend. Checks partner, customer, and underwriting ownership. Only completed runs with results can be embedded. The parent origin must be registered on your partner account. The returned URL contains a one-time launch ticket in its fragment, valid for 60 seconds. Loading it exchanges the ticket for a renewable 15-minute report-only lease. The authenticated host can renew it without reloading the iframe. No public share link is created. Do not cache or log the returned URL. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/underwritings/{underwriting_id}/embed-sessions openapi: 3.1.0 info: title: Cactus Partner API version: 1.0.0-draft.1 summary: Document extraction and automated underwriting for CRE. description: | # Overview The Cactus Partner API provides two products: - **Extraction** — upload commercial real estate documents (offering memoranda, rent rolls, T-12 / operating statements, and other business documents) and receive structured, validated JSON with per-field confidence. - **Underwriting** — provide a property address, asset class, and notification email (documents optional) to run a full automated underwriting; results are delivered as a hosted financial-analysis report link plus a machine-readable summary. ## Authentication Every request carries an API key: `Authorization: Bearer ck_live_...` (or `ck_sandbox_...`). Keys are issued by Cactus at kickoff and can be rotated or revoked at any time. ## Products and access Accounts are enabled per product, so not every endpoint below is available to every account: | Product | Endpoints | | --- | --- | | Extraction | `/v1/extractions` | | Underwriting | `/v1/underwritings` | | Usage reporting | `/v1/usage` | `/v1/documents` and `/v1/webhook-endpoints` are available to every account — uploads and webhook delivery underpin both products. Calling an endpoint your account is not enabled for returns `403` with code `product_not_enabled`; contact api@trycactus.com to add a product. A `403` with code `missing_scope` means the account *is* enabled but this particular key was issued without that scope — use a key that carries it. The MCP server advertises only the tools your key can use, so the same rules apply there. ## Sandbox `ck_sandbox_` keys hit the same endpoints but never debit your usage pool: uploads are accepted, and jobs return deterministic fixture output within seconds. Use sandbox keys for integration development and CI. Registering a sandbox document under a documented example filename (e.g. `example-rent-roll-1.xlsx`) returns the real extracted output of that reference document — see the Sandbox guide for the full list. ## Asynchronous jobs Extractions and underwritings are asynchronous. Create the job (`202 Accepted`), then either poll the job resource or register a webhook endpoint to receive signed events (recommended). Typical extraction turnaround is minutes. ## Billing semantics A document is **accepted** when it passes validation (size caps, page/row counts, type resolution). Acceptance debits your usage pool at the fixed rate-card price for the document type — before processing, so pricing is deterministic. Rejected documents are never charged. Documents exceeding their type's size cap bill as multiple units of the same type; the accept response discloses `billed.units`. Files over 500 pages or 100 MB are rejected outright. ## Idempotency All `POST` endpoints accept an `Idempotency-Key` header (any unique string, e.g. a UUID). Retrying a request with the same key returns the original response instead of creating a duplicate. ## Errors Errors follow RFC 9457 (`application/problem+json`) and always include a stable machine-readable `code` and the `request_id` to quote in support requests. ## Versioning The path major version (`/v1`) changes only for breaking API changes. Extraction output schemas are versioned independently per document type (e.g. `rent_roll.v1`) and declared in every result; breaking output changes ship as a new schema version with advance notice and an overlap window. --- All field-level output schemas — `RentRollData` (`rent_roll.v1`), `T12Data` (`t12.v1`), `OfferingMemorandumData` (`offering_memorandum.v1`), and `GenericDocumentData` (`facts.v1`) — are finalized against the extraction engine's real output. contact: name: Cactus API Support email: api@trycactus.com license: name: Proprietary — Cactus API License Agreement identifier: LicenseRef-Cactus-Partner-Agreement servers: - url: https://api.trycactus.com description: Production (live and sandbox keys) security: - apiKey: [] tags: - name: Documents description: Upload and manage documents via presigned URLs. - name: Extractions description: Structured data extraction jobs and results. - name: Underwritings description: Automated underwriting runs. - name: Usage description: Usage pool balance and metered activity. - name: Webhook Endpoints description: Manage endpoints that receive signed event notifications. paths: /v1/underwritings/{underwriting_id}/embed-sessions: post: tags: - Underwritings summary: Create a private, read-only report embed session description: > Call from your authenticated backend. Checks partner, customer, and underwriting ownership. Only completed runs with results can be embedded. The parent origin must be registered on your partner account. The returned URL contains a one-time launch ticket in its fragment, valid for 60 seconds. Loading it exchanges the ticket for a renewable 15-minute report-only lease. The authenticated host can renew it without reloading the iframe. No public share link is created. Do not cache or log the returned URL. operationId: createUnderwritingEmbedSession parameters: - name: underwriting_id in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - end_user_ref - parent_origin properties: end_user_ref: type: string minLength: 1 maxLength: 255 parent_origin: type: string example: https://app.partner.example responses: '201': description: One-time iframe launch URL. Cache-Control is no-store. content: application/json: schema: type: object required: - id - object - underwriting_id - url - launch_expires_at - session_ttl_seconds properties: id: type: string example: emb_01J9ZK3M object: type: string const: underwriting_embed_session underwriting_id: type: string url: type: string format: uri launch_expires_at: type: string format: date-time session_ttl_seconds: type: integer const: 900 '400': description: Invalid request '401': description: Missing or invalid API key '403': description: Missing scope or parent origin is not registered '404': description: Underwriting does not belong to this partner and customer '409': description: Underwriting result is not ready '503': description: Embedding is not configured components: securitySchemes: apiKey: type: http scheme: bearer bearerFormat: ck_live_* or ck_sandbox_* description: Partner API key issued by Cactus. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.