> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bootstrap the widget on a visitor's page

> Called from the visitor's browser before the launcher renders: confirms the embed is live and returns the brand to draw it with. Takes a widget key, no API key.

Call this from the visitor's browser when your page loads, before you render the widget launcher. It does not take an API key or a console session. It takes the embed's **public widget key** in the `X-ARUKZ-Widget-Key` header, and the browser's `Origin` must be allowed by both the deployment's `allowed_origins` and the platform-wide widget allowlist. See [Website widget](/channels/widget).

A `200` is the whole answer: it proves the key names a live deployment, the page's origin is permitted and the organization is active. `status` is always `active`. The response deliberately says nothing about the organization, the assistant or the deployment's name.

`brand` carries your organization's public brand overrides so the widget can render in your colours without a custom build. It is sparse: it contains only the fields your organization has set, and is `{}` when none are. Documentation, support and legal links are never included. See [Branding](/administration/branding).

When a request is refused, the response carries no `Access-Control-Allow-Origin` header. In a cross-origin browser request, `fetch` therefore rejects with a network error instead of exposing the error body. An unknown, malformed, revoked or expired widget key all return the same `401`.

<ParamField header="X-ARUKZ-Widget-Key" type="string" required>
  The deployment's public widget key, `arukz_wk_…`. An `arukz_sk_` API key is not accepted here.
</ParamField>

<ParamField header="Origin" type="string" required>
  Set by the browser. It must exactly match an origin allowed for this deployment. When you call
  from outside a browser, set it yourself.
</ParamField>

## Response

<ResponseField name="status" type="string" required>
  Always `active`.
</ResponseField>

<ResponseField name="brand" type="object" required>
  Your organization's public brand overrides, in camelCase. Every section and field is optional.

  <Expandable title="properties">
    <ResponseField name="identity" type="object">
      `productName`, `productShortName`, `companyName`, `companyLegalName`, `tagline`.
    </ResponseField>

    <ResponseField name="assets" type="object">
      `logoLight`, `logoDark`, `logoMark`, `favicon`, `ogImage`.
    </ResponseField>

    <ResponseField name="theme" type="object">
      `colors` (with `light` and `dark` palettes), `typography` (`fontFamilySans`, `fontFamilyMono`,
      `baseSizePx`), `shape` (`radiusSm`, `radiusMd`, `radiusLg`, `radiusXl`) and `modeDefault`
      (`light`, `dark` or `system`).
    </ResponseField>

    <ResponseField name="surfaces" type="object">
      `widget` (`showBranding`) and `console` (`showLogo`, `showPoweredBy`).
    </ResponseField>
  </Expandable>
</ResponseField>

<RequestExample>
  ```javascript JavaScript theme={"theme":{"light":"github-light","dark":"github-dark"}}
  // Runs on your website. The widget key is public and belongs in page source.
  const MITHUNAI_API = `${MITHUNAI_URL}/arukz/api/v1`
  const WIDGET_KEY = 'arukz_wk_8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e'

  const response = await fetch(`${MITHUNAI_API}/widget/bootstrap`, {
    headers: { 'X-ARUKZ-Widget-Key': WIDGET_KEY },
  })
  const { status, brand } = await response.json()
  console.log(status, brand.identity?.productName)
  ```

  ```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
  curl --request GET "$MITHUNAI_URL/arukz/api/v1/widget/bootstrap" \
    --header "X-ARUKZ-Widget-Key: arukz_wk_8d0f5a2e-3c41-4b7a-9e6d-1f2a3b4c5d6e" \
    --header "Origin: https://docs.example.com"
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  {
    "status": "active",
    "brand": {
      "identity": { "productName": "Example Docs Assistant", "companyName": "Example Inc." },
      "assets": { "logoMark": "https://docs.example.com/static/logo-mark.svg" },
      "theme": {
        "colors": { "light": { "brand": "#0F6E56", "brandContrast": "#FFFFFF" } },
        "modeDefault": "system"
      },
      "surfaces": { "widget": { "showBranding": true } }
    }
  }
  ```

  ```json 401 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "authentication_error", "message": "Authentication is required." }
  ```

  ```json 403 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "authorization_error", "message": "This widget may not be embedded from that origin." }
  ```

  ```json 429 theme={"theme":{"light":"github-light","dark":"github-dark"}}
  { "code": "rate_limit_exceeded", "message": "Too many requests. Please retry later." }
  ```
</ResponseExample>