Environments & Base URLs

Blueprint provides two environments. You will be provisioned separate credentials for each — a
sandbox set for development and a production set for live clinical use.

API base URLs

The /v2 path segment is part of the base URL. Every endpoint path in the API Reference is relative
to it:

POST https://api.blueprint.ai/v2/partners/authenticate
GET  https://api.blueprint.ai/v2/sessions/{sessionId}/progress-note

If you omit /v2 you will get 403 {"message":"Missing Authentication Token"}. That message is
misleading — it comes from our API gateway and means the route does not exist, not that your
credentials are wrong. See Errors for how to tell the two apart.

Widget URLs

The embedded UI is loaded from a different host than the API.

You never reference the iframe hosts directly — the loader script chooses the right one based on your
settings. You do need them for your Content Security Policy.

Content Security Policy

If your application enforces a CSP, add the following. This is the most common reason an embed
appears to do nothing.

Production:

script-src  https://embed.blueprint.ai;
frame-src   https://clinician.blueprint.ai https://mini-widget.blueprint.ai;

Sandbox:

script-src  https://embed.staging.blueprint.ai;
frame-src   https://clinician.staging.blueprint.ai https://mini-widget.staging.blueprint.ai;

If you enforce style-src, the loader injects a stylesheet into your page and needs a nonce. Pass
it with the cspNonce setting:

window.blueprintSettings = {
  containerId: 'blueprint-container',
  cspNonce: 'YOUR_PER_REQUEST_NONCE'
}

The widget also loads fonts from res.cloudinary.com and fonts.googleapis.com /
fonts.gstatic.com. Those are fetched inside our iframe, not your page, so they are governed by our
CSP rather than yours — but if you set your own fonts via fontHref, that origin must be reachable.

See Widget Troubleshooting for microphone permissions and other
embedding issues.

Differences between sandbox and production

Sandbox runs the same API version and the same widget code as production. It is a full environment,
not a mock — data you create there is real data in a separate database.

Two things to know:

• Sandbox is a staging environment. It receives new releases before production, so behavior can
  briefly differ. Treat it as a preview.
• Credentials are not interchangeable. Sandbox credentials do not work against production and
  vice versa.

Webhook callback URLs

Webhooks are sent to a single callbackUrl per partner organization, which you can read with
GET /partners and change with PATCH /partners/{partnerId}. There is one callback URL per
environment, and all event types are delivered to it.

The resource URLs inside webhook payloads (progressNoteUrl, transcriptUrl, mdmUrl,
assessmentScoreUrl) are absolute and already environment-correct — fetch them directly rather than
reconstructing the path. See Listening to Webhooks.