URL parameters

The embed URL sets the map's initial state. It works with no JavaScript on the host page, which makes it the whole of the static iframe integration and the starting point for every other one.

Parameters set state on load. They do not track it: navigating inside the map does not rewrite the frame's URL.

Examples use a demonstration campus. Every snippet on this site addresses ucba, a publicly available campus with the building muntz-hall and the room 170. Substitute your own campus slug once you have one. Slugs for your campus are listed in your Waylocate console, and the addressing rules are in the reference grammar.

Path

https://waylocate.com/{campus}
https://waylocate.com/{campus}/{building}
https://waylocate.com/{campus}/{building}/{room}

The room segment is bare, relative to the building in the segment before it. /ucba/muntz-hall/170 selects room 170 in muntz-hall.

Query parameters

Parameter	Values	Meaning
embed	1	Turns on embed mode
host	origin	The one origin allowed to command this map
ui	comma-separated tokens	Chrome flags
from	reference	Route origin
to	reference	Route destination
nav	preview or live	Directions mode
sdk	version	SDK build that produced the URL

embed=1

Embed mode does two things: it enables the message bridge, and it makes the ui parameter meaningful.

It is otherwise neutral. It hides nothing on its own, and every chrome element keeps its normal default apart from the expand button, which is on in embed mode and off outside it.

ui is ignored when embed=1 is absent. This prevents a crafted link to the public map from stripping its interface.

host, the origin gate

When embed=1 is set, host names the single origin permitted to send commands to the map.

?embed=1&host=https%3A%2F%2Fexample.edu

The value must be a bare origin. Paths, wildcards, and credentials are rejected, and http: is accepted only on loopback addresses. Remember to URL-encode it.

The map compares the sender of every incoming message against this value by exact string equality. Substring matching would let https://example.edu.attacker.net through, so there is none. Messages from any other origin are dropped without a reply.

When host is missing or malformed, the map does not attach a listener at all. It renders normally and ignores everything, which is the symptom described in diagnosing a silent map.

buildEmbedUrl(), mount(), and the React component all fill this in from window.location.origin, so you only set it by hand when writing the URL yourself or generating it on a server.

Routes

?embed=1&from=here&to=muntz-hall/170&nav=live

Both endpoints take any reference from the reference grammar, including here for the visitor's position and pin:{lat},{lng} for a coordinate. nav chooses between showing the whole route and following the visitor along it, and defaults to preview.

sdk

buildEmbedUrl() stamps the package version that produced the URL into an sdk parameter. Nothing reads it at runtime.

It exists so that map operators can see which SDK builds are deployed from ordinary access logs, including integrations that load the page but never complete a handshake. Knowing what is actually in use is what makes it possible to keep old versions working rather than guessing. Pass reportVersion: false to omit it.

A complete example

<iframe
  src="https://waylocate.com/ucba/muntz-hall/170?embed=1&ui=-search,-events&host=https%3A%2F%2Fexample.edu"
  style="width: 100%; height: 600px; border: 0"
  title="Campus map"
  allow="clipboard-write; geolocation"
  loading="lazy"
></iframe>

Next

• Chrome flags for the ui token grammar.
• Existing iframe to add control to a URL you have already built.