# GET /v1/sessions/{session_id}/frame-policy

> Which sites may show a session's page.

In [Sessions API](https://vestra.ai/developers/reference/api/sessions.md): Bash in a browser: its live screen, a voice call, or the whole of Bash inside your app.

Send `Authorization: Bearer vk_test_...` on every call.

Which sites may show a session's page. The page asks this itself; you never need to.

No key: anyone may call it. On the card: [`embed`](https://vestra.ai/developers/embed.md). Over HTTP it is made from the contract: fill in each {…} and every value.

## Request

Path:

- `session_id` (`string`, required): The session's id (`ses_...`).

## Answers 200

- `object` (`"frame_policy"`): Always frame_policy.
- `frame_ancestors` (`string[]`): The sites that may frame the session's page; empty when it may open only as a page of its own.

## Code

**HTTP**

```bash
curl "$VESTRA_BASE_URL/v1/sessions/{session_id}/frame-policy"
```

**TypeScript, Python, CLI, MCP**: No sample in your language for this route, so here it is over HTTP.