[Question]: Embedded website Agent fails with 405 errors

[VVX94]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (Language Policy).
• Non-english title submitions will be closed directly ( 非英文标题的提交将会被直接关闭 ) (Language Policy).
• Please do not modify this template :) and fill in all the required fields.

Describe your problem

description

I am trying to use the Embedded Agent feature (embedding website/iframe). While the Agent works perfectly inside the RAGFlow Canvas/Playground, it fails to function when accessed via the shared/embedded link.

The embedded frontend sends requests to /api/v1/agentbots/..., butthe backend returns 405 Method Not Allowed.

Steps to Reproduce

1. Create an Agent in RAGFlow.

2. Go to the "Embed" tab and copy the "Embedded Website" link or iframe code.

3. Open the link in a browser.

4. Attempt to send a message to the agent.

5. The webpage crashes or hangs, and the browser console shows 405 errors.

snipaste

[dosubot]

The 405 errors when using Embedded Agent via shared/iframe links are caused by backend API method restrictions and authentication requirements. The /api/v1/agentbots/<agent_id>/completions endpoint only allows POST requests with a valid API token in the Authorization header, and /api/v1/agentbots/<agent_id>/inputs only allows GET requests with the same requirement. If the HTTP method or token is missing or incorrect, you'll get a 405 or 401 error respectively. There is no special handling for embedded/iframe contexts—these endpoints work the same way as in the main interface, so the same rules apply source.

Embedding agents via iframe only works for agents that do not require input parameters in the Begin node. If your agent needs variables or files as input, embedding via iframe will not work due to security restrictions—use the API or Python SDK instead source.

Troubleshooting checklist:

• Make sure the embedded agent does not require input parameters.
• Use the correct HTTP method for each endpoint.
• Include a valid API token in the Authorization header.
• Confirm agent/session ownership matches the API token.
• Ensure frontend and backend versions match and clear your browser cache if you recently upgraded.

If you follow these steps and still see 405 errors, double-check the network requests for method and token issues, and verify the agent is embeddable source.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[VVX94]

@dosu I do use POST to request, while the console shows 200 OK, the message is 405 method not allowed

[dosubot]

This happens because the backend wraps all errors—including 405 Method Not Allowed—in a JSON response with HTTP 200 OK, so the browser shows 200 OK but the actual error is in the response body. This is standard for all API endpoints, not just embedded/iframe requests. The 405 in your response body is the real backend error, usually triggered by an unsupported HTTP method or a routing mismatch, even if you are using POST as expected.

To troubleshoot, double-check the full request details in your browser’s network tab: make sure the Authorization header is present and valid, the endpoint URL is correct, and the agent doesn’t require input parameters (which aren’t supported in embedded mode). If everything looks correct, sharing a sanitized request/response example could help pinpoint the issue.
Reference: backend error handling

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[VVX94]

@dosu Here is an example
curl -X POST 'http://localhost:9090/api/v1/agentbots/265478a4b5a711f0a015d66e8ab70620/completions' -H 'Authorization: Bearer diYjU1OTEwMGQzZTExZjBhZjg3NjZhMz' -H 'Content-Type: application/json' --data-raw '{"query":"test","inputs":{},"session_id":null}'
{"code":100,"data":null,"message":"<NotFound '404: Not Found'>"}