Proxy-Based Embedded CPQ Guide
Introduction
This guide covers the proxy/hub embedded CPQ mode. This mode uses api.decoloop.com as a centralized proxy/gateway to handle connections to multiple CPQ applications, suppliers, or instances through a single API connection.
The base URL for the Embedded API is:
https://api.decoloop.com/api/embeddedWhen to use this guide
Use this proxy-based mode when:
- The host application needs to connect to multiple different CPQ applications or suppliers dynamically.
- A partner or supplier integration requires a centralized hub instead of individual integration setups.
- You want to avoid hardcoding individual, supplier-specific CPQ instance URLs.
Use the direct Embedded CPQ Developer Guide instead when:
- The integration targets one known, direct CPQ instance.
- The iframe URL and gateway API calls are made directly against that instance's unique URL.
Integration Flow
The complete flow consists of the following steps:
- Authenticate against
api.decoloop.comto receive a token. - Retrieve the list of available applications.
- Choose an
applicationIdto load. - Request the embedded iframe URL for that specific application.
- Open and display the iframe to the user.
- Proxy CPQ API requests through the proxy URL using the application ID.
Authentication
Authentication is token-based. You will need to obtain a Bearer token by POSTing to the /token endpoint with your credentials.
Security Warning To keep your credentials secure, do not expose the
apiKey,password, or long-lived credentials in client-side code. Always obtain the token via a secure backend and pass only the temporary token or iframe URL to the frontend.
Step 1: Create a token
Generate a short-lived token using your integration credentials.
Endpoint
POST /tokenRequest Body
{
"emailAddress": "user@example.com",
"password": "example-password",
"apiKey": "example-api-key"
}Response
{
"token": "eyJ...",
"expiresIn": 3600
}Example cURL
curl -X POST https://api.decoloop.com/api/embedded/token \
-H "Content-Type: application/json" \
-d '{
"emailAddress": "user@example.com",
"password": "example-password",
"apiKey": "example-api-key"
}'Step 2: Get available applications
Retrieve a list of CPQ applications/instances configured for your account.
Endpoint
GET /getapplicationsHeaders
Authorization: Bearer {token}Response
[
{
"id": "application-id",
"name": "Application name"
}
]Step 3: Get the embedded iframe URL
Obtain the unique embed URL for the selected application.
Endpoint
GET /geturl?applicationId={id}Headers
Authorization: Bearer {token}Response
{
"url": "https://..."
}Usage in frontend
Use the returned URL inside an iframe in your application:
<iframe
src="EMBEDDED_URL_FROM_GETURL"
width="100%"
height="800"
title="Decoloop CPQ"
></iframe>Proxying CPQ API Requests
Instead of calling separate CPQ endpoints directly, all Gateway API requests should be routed through the centralized api.decoloop.com proxy URL.
Proxy Base URL
https://api.decoloop.com/cpq-proxy/{applicationId}/...The proxy supports GET, POST, PUT, and DELETE requests. All request headers (including Authorization and Content-Type) are forwarded to the underlying CPQ application as-is.
URL Mapping Example
For a direct CPQ endpoint:
/gateway/embedded/browsematerialsYour proxied endpoint becomes:
https://api.decoloop.com/cpq-proxy/{applicationId}/gateway/embedded/browsematerialsExample Proxy Request
POST https://api.decoloop.com/cpq-proxy/{applicationId}/gateway/embedded/browsematerials
Authorization: Bearer {token}
Content-Type: application/json
Accept: application/jsonError Handling
When interacting with the proxy API or the embedded endpoint, expect the following standard HTTP status codes:
401 Unauthorized: Missing, invalid, or expired Bearer token.403 Forbidden: Authenticated user does not have permission for the specifiedapplicationId.404 Not Found: The specified application or proxied API endpoint could not be found.5xx: Upstream CPQ instance or proxy gateway issue.
Ensure you check and log the response status code and any returned message safely. Never log passwords, API keys, or raw bearer tokens.
Comparison with Direct Embedded Mode
| Area | Direct Embedded Mode | Proxy-Based Embedded Mode |
|---|---|---|
| Base URL | Specific CPQ instance URL | https://api.decoloop.com |
| Application Selection | Usually fixed | Dynamic via /getapplications |
| Iframe URL | Constructed from instance + direct token | Retrieved dynamically via /geturl |
| API Calls | Direct to instance gateway endpoints | Proxied via /cpq-proxy/{applicationId}/... |
| Best For | Integrations targeting a single CPQ instance | Multi-instance or multi-supplier integrations |
Troubleshooting
- Token expired: Acquire a new token via
POST /token. - Empty application list: Verify that your API key and account are properly configured with permissions.
- Iframe fails to load: Verify the
applicationIdand ensure the URL was not modified. - Proxy returns authorization error: Check if the bearer token is valid and belongs to the account authorized to access that application ID.
Embedded CPQ Developer Guide
Implementation guidance for embedding CPQ experiences.
CPQ Embedded
# Decoloop CPQ Embedded Guide ## Introduction Decoloop CPQ can be embedded in a website using an iframe. This enables other websites or applications to display the Decoloop CPQ order page. ## Integration Flow The typical integration flow works as follows: 1. **User initiates**: A user on a third-party website wants to add products from Decoloop CPQ 2. **Third-party embeds**: The third-party application starts the iframe with Decoloop CPQ (see Getting Started below) 3. **User configures**: The user configures products in Decoloop CPQ and saves the order 4. **Event notification**: Decoloop CPQ sends a message to the parent window with the project ID 5. **Retrieve project data**: The third-party application retrieves the complete project information using the project ID and the Decoloop CPQ Gateway API ## Getting Started #### Prerequisites To connect to a Decoloop CPQ instance, third-party applications need an API key provided by Decoloop. This API key is specific to the third-party application and can be re-used across multiple CPQ instances. #### Step 1: Create A Token Create a token for Decoloop CPQ using the Decoloop CPQ Gateway. ##### Generating a Token **URL:** `/token` **Method:** POST This endpoint can be called to generate a token, which in turn can be used for authentication in the Decoloop CPQ Gateway API. An example request: ``` POST http://127.0.0.1:50750/token Content-Type: application/json { "domainName": "test", "username": "test", "password": "test", "apiKey": "test-123-test" } ``` The response will contain the following data: ```json { "access_token": "aaabbbccc", "token_type": "bearer", ".issued": "8-10-2018 15:39:41", ".expires": "2018-10-22T15:39:41.1959628+02:00", "refresh_token": "dddeeefff" } ``` ##### Creating an Authorized Request With the received `access_token`, an authorized request can be made. Set the `Authorization` header like so: ```json "Authorization": "{token_type} {access_token}" ``` Using the above response as an example, the header would be: ```json "Authorization": "bearer aaabbbccc" ``` #### Step 2: Create An Iframe Now, create an iframe with a Decoloop CPQ url and the following parameters `token=ACCESS_TOKEN&isEmbedded=true`. With the `ACCESS_TOKEN` here being the token we have created in step 1. Your url should look something like this: `http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true`. Set this url as the source of your iframe. ```html <iframe src="http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true"></iframe> ``` The Decoloop CPQ order page should now be displayed. :tada: :tada: :tada: #### Step 3: Listen To Event When an order is saved or closed, Decoloop CPQ will emit an event to its parent window. This event will contain the id of the saved project. The parent window can listen to this event using the following code: ```typescript window.addEventListener('message', event => { const data = event.data; const projectId = data.payload; switch (data.type) { case 'CLOSE_PROJECT': this.onCloseProject(projectId); break; case 'SAVE_PROJECT': this.onSaveProject(projectId); break; } }); ``` #### Step 4: Retrieve and Send Project Data The saved project can now be loaded or sent using the project ID received in step 3. Use the Decoloop CPQ Gateway API to load the project data (`Project/Load`) and send the project (`Project/Send`) ## Optional URL Parameters The iframe URL can be customized with various optional parameters to control the initial state of Decoloop CPQ. #### Loading An Existing Project If an existing project needs to be loaded, pass the project's id as a query parameter: `http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true&projectId=1` This will load the saved project into Decoloop CPQ. #### Start With Material Starting a new project with a material can be done using either the material id or the material (EAN)code. When starting Decoloop CPQ with a material, Decoloop CPQ will select the first product from the menu for the first polygon. The `Material/Export` API method can be used to retrieve all available materials of the user in this CPQ instance. **Material Id:** `http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true&materialId=1` **Material Code:** `http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true&materialCode=EXAMPLE123` **Invalid Materials:** When an invalid material id or material code is passed in the query parameter, Decoloop CPQ will show an error message. #### Copy Project To copy an existing project, use the `copy` parameter along with the `projectId`: `http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true©=true&projectId=1` #### Copy Polygon To copy a specific polygon from a project, use the `copyPolygonId` parameter along with the `projectId`: `http://127.0.0.1:50750?token=ACCESS_TOKEN&isEmbedded=true&projectId=1©PolygonId=5`