Every sample on every page follows this. Change it any time.

Get a test key
BashBrainTeammatesPricingDevelopersGet a test key

embed

Put Bash inside your own app, for the user who is signed in. One iframe gives your user chat, approvals, Bash's live screen and voice. Your server opens a session, a short-lived link for that user, and your page shows its url.

Open a session on your server

Do this for the user signed in to your app. It gives them chat, approvals, the live screen and voice.

TypeScript
const session = await vestra.user('traveller-42').embed();// Put session.url in an iframe on your page: <iframe src={session.url} allow="microphone" />console.log(session.url, session.expires_at);

Show the memory panel

Your company must turn it on first.

TypeScript
const withMemory = await vestra.user('traveller-42').embed({ memory: true });

End the session

Its token stops working at once.

TypeScript
await withMemory.end();

Open a session on your server

Do this for the user signed in to your app. It gives them chat, approvals, the live screen and voice.

Python
session = vestra.user("traveller-42").embed()# Put session.url in an iframe on your page: <iframe src="{{ session.url }}" allow="microphone"></iframe>print(session.url, session.expires_at)

Show the memory panel

Your company must turn it on first.

Python
with_memory = vestra.user("traveller-42").embed(memory=True)

End the session

Its token stops working at once.

Python
with_memory.end()

Preview what your users see

It opens chat, approvals, the live screen and voice. In your app, open one session per visit on your server, with the SDK or over HTTP.

CLI
vestra embed --user traveller-42

Show the memory panel

Your company must turn it on first.

CLI
vestra embed --user traveller-42 --memory

Open a session on your server

Do this for the user signed in to your app. It gives them chat, approvals, the live screen and voice. The response has a url and a token, valid for 15 minutes. Put the url in an iframe with allow="microphone".

HTTP
curl "$VESTRA_BASE_URL/v1/sessions" \  -H "Authorization: Bearer $VESTRA_API_KEY" \  -H "Content-Type: application/json" \  -d '{ "user_id": "traveller-42", "chat": true, "screen": "view", "voice": true }'

Check the session

See whether it is still open.

HTTP
curl "$VESTRA_BASE_URL/v1/sessions/ses_8h2" \  -H "Authorization: Bearer $VESTRA_API_KEY"

End the session

Its token stops working at once.

HTTP
curl -X DELETE "$VESTRA_BASE_URL/v1/sessions/ses_8h2" \  -H "Authorization: Bearer $VESTRA_API_KEY"
MCP
{  "method": "tools/call",  "params": {    "name": "embed",    "arguments": { "user": "traveller-42", "memory": true }  }}

Good to know

What the session token can see

A session's token lasts 15 minutes and can only reach that user and the session's conversation. It never shows what anything costs, never lists interactions, and never sees calls to your tools.

Which sites can show it

Your company's allowed_embed_origins setting decides which of your sites may show a session in an iframe. With none set, the session still works as a page of its own.

Ending a session

DELETE /v1/sessions/{id} ends a session at once. Its token stops working, its streams close, and a session.ended event says so.

The routes behind embed4 routes, each with every field in the API reference
POST/v1/sessionsOpen a session for one of your users (user_id), or for the company's own Bash: chat, a screen to watch or drive, a voice call, and what Bash remembers (memory, when your company turned the panel on). Answers a 15 minute token for the user's browser, a ready page url and the sites allowed to frame it. The token reaches only that user, and only the session's conversation.Key scope: runtime (or all)
GET/v1/sessions/{session_id}Whether a session is still open, and what it was opened with. Your key, or the session's own token.Key scope: runtime (or all)
DELETE/v1/sessions/{session_id}End a session now: its token stops working, its streams close and its call hangs up. Your key, or the session's own token.Key scope: runtime (or all)
GET/v1/sessions/{session_id}/frame-policyWhich sites may show a session's page. The page asks this itself; you never need to.