Returns the current visitor's own submissions for a tracking page. Used by the widget's "Your submissions" section to show pending / approved status after a visitor submits.

The session is identified by the embed_session cookie, which the iframe sets automatically when the page is first loaded.

Request

GET /api/embed/session/submissions?trackingPageId=abc123 HTTP/1.1
Host: walletsleuth.app
Authorization: Bearer ws_pub_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Origin: https://example.com
Cookie: embed_session=<session-cookie>

Query parameters

Name	Type	Required	Notes
trackingPageId	string	yes	Tracking page ID. Must match the key.

Headers

Header	Required	Notes
Authorization	yes	Bearer <api_key>.
Origin	yes for public keys	Must be allowlisted.
Cookie: embed_session=...	effectively yes	Without it, the response is always an empty list.

Success response

200 OK:

{
  "submissions": [
    {
      "id": "WvE7aB9c2D4f…",
      "walletAddress": "7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU",
      "nickname": "Early holder",
      "status": "pending",
      "rejectReason": null,
      "createdAtIso": "2026-04-21T14:32:16.245Z",
      "decidedAtIso": null
    },
    {
      "id": "XkL2mN9p0Q…",
      "walletAddress": "8abcXYZdef8…",
      "nickname": "Co-founder",
      "status": "approved",
      "rejectReason": null,
      "createdAtIso": "2026-04-20T09:11:03.102Z",
      "decidedAtIso": "2026-04-20T10:04:11.899Z"
    }
  ]
}

Response fields

Field	Type	Notes
submissions	array	Up to 50 most recent submissions for this session + page, newest first. Empty array if no session cookie.
submissions[].id	string	Submission document ID.
submissions[].walletAddress	string	Base58 address submitted.
submissions[].nickname	string	Normalized nickname as stored.
submissions[].status	string	pending, approved, rejected, auto_approved, or soft_rejected.
submissions[].rejectReason	string | null	manual, rate_limited, queue_full, duplicate, ca_gate, cooldown, or null if not rejected.
submissions[].createdAtIso	string	ISO 8601 UTC timestamp.
submissions[].decidedAtIso	string | null	ISO 8601 UTC timestamp of approve/reject. Null while pending.

Ordered by createdAt descending, limit 50.

Error responses

Status	error	Meaning
400	missing_tracking_page_id	trackingPageId query parameter wasn't provided.
401	missing_key / invalid_key / revoked_key	See Authentication.
401	missing_origin	Public key with no Origin/Referer.
403	origin_not_allowed	Origin not on the key's allowlist.
429	rate_limit_key / rate_limit_ip	Global rate limits. Retry-After included.

How sessions work

The embed session is a signed, server-sealed cookie:

• Name: embed_session.
• Scope: Path=/embed, SameSite=None; Secure; HttpOnly.
• Lifetime: 30 days.
• Content: opaque to the client.

The cookie is set by the iframe route on first visit (and only the iframe route — the API routes don't mint sessions). That means:

• Iframe-loaded widgets: the cookie rides along on every fetch to /api/embed/* because the widget uses credentials: 'include'. The visitor sees their submissions.
• Custom UIs that never load the iframe: no session cookie is ever set. Calls to this endpoint return { "submissions": [] } with a 200 even when the visitor has submitted via the API. To build a custom "your submissions" view, you'd need to track the mapping server-side or display the most recent submissionId the client received from POST /submissions.

Polling

Safe to poll at a low rate (e.g. every 5–10 seconds) to reflect status changes. Global per-key and per-IP rate limits apply. There's no dedicated websocket or SSE feed in the public API.

Example (fetch)

const res = await fetch(
  `https://walletsleuth.app/api/embed/session/submissions?trackingPageId=${pageId}`,
  {
    headers: {
      Authorization: `Bearer ${publicKey}`,
    },
    credentials: 'include', // crucial — sends the embed_session cookie
  },
);
const { submissions } = await res.json();

Preflight (OPTIONS)

Returns 204 with:

Access-Control-Allow-Origin: <request origin>
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Headers: Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 600
Vary: Origin

Related

• POST /submissions — creates records this endpoint reads.
• SIWS signing — full submission flow.