Start an embedded form session
Mints a handle asserting the given user into a microsoft or google authType form and returns the embedUrl to iframe: the visitor lands already signed in. For a microsoft form give the user’s object ID or UPN plus their tenant (microsoftTenantId, or clientId and it is looked up); for a google form the Workspace email alone. A none (public) form takes a session too: give the portal user’s identifier and their clientId (or microsoftTenantId), and the submission is attributed to them and that client (provider portal) — nothing is looked up in a directory. With no user, a public form returns its plain embedUrl (provider none, no handle) and submits anonymously, as before. password and internal forms cannot take a session. Refusals carry a SessionError code. The handle is single-use and expires after 2 minutes: mint one per page load, server-side. The user must belong to a client this organisation manages — their Microsoft tenant connected, or their Google Workspace domain mapped to a client — otherwise 403. The signed-in session lasts 30 minutes from when you mint it; after that a submit is refused and the page must be reloaded with a fresh handle. Every session is audited against the key that minted it, and a submission — and every workflow it triggers, as metadata.custom.apiKeyId — records which key embedded the form. The form’s own access rules still apply to the asserted identity.
Authorizations
Organisation API key. Scoped operations carry x-triggr-scope; the scopes themselves are described in x-triggr-scopes.
Path Parameters
Body
Response
OK
Seconds the single-use handle stays redeemable (120). 0 when no handle is issued (provider none). Not the signed-in session's lifetime, which is 30 minutes from mint
microsoft, google, portal, none Absent only for a none form requested with no user

