Skip to main content
GET
For products with inventorySelectionType: SEATMAP. Returns an HTML page that renders the Headout-hosted seat selection UI. Embed this endpoint as an iframe in your integration. Domain whitelisting required — contact the Headout partnerships team to register your domain. The seatmap iframe is a Headout-hosted, fully interactive seat selection UI. Embed it to support seatmap products without building custom seat selection. The endpoint returns a rendered HTML page — not a JSON payload. No API key is required; access is controlled by domain allowlisting.

Domain whitelisting

The iframe enforces an allowlist of permitted embedding domains. Before going live, contact the Headout partnerships team and provide the domain(s) you intend to embed the iframe on. Headout will add your domain to ALLOWED_DOMAINS.
  • Requests from domains not on the allowlist return 403 Forbidden.
  • The allowlist is matched against the browser-sent Referer header.
  • Ensure the page embedding the iframe does not apply a Referrer-Policy of no-referrer or strict-origin-when-cross-origin — either setting suppresses the header and every embed request will return 403.
  • Subdomains of a whitelisted domain are automatically permitted — whitelisting example.com also allows www.example.com.
  • The iframe sets a Content-Security-Policy: frame-ancestors response header scoped to your domain to prevent embedding from unauthorised origins.

Embedding

Add the iframe to your page with the product ID substituted in the src URL:
Replace 3023 with the actual product ID. The iframe container must have a defined height — height="100%" requires the parent element to have an explicit height set, otherwise the iframe collapses to 0px and nothing renders.

postMessage events

The iframe communicates with the parent page via window.postMessage. All messages in both directions are JSON-stringified in the following envelope:
Parse incoming messages with JSON.parse(event.data).

Initialisation sequence

The iframe does not load seats automatically. After embedding, you must complete the handshake and pass the selected show slot. 1. Send init once the iframe has loaded
2. Listen for iframeInitCompleted, then send initPlugin
Without initPlugin the map renders empty — no seats will be displayed.

Outbound events

All outbound events follow the envelope { "type": "...", "data": { ... } }.

Map lifecycle

Seat events

Handling onSeatSelectionSubmitted:

Inventory events

Emitted on initial seatmap load (after initPlugin) and on every subsequent setInventorySlot call.

Price filter events

Zoom events

Other

Seat object

Each item in the seats array (from onSeatAdded, onSeatRemoved, onSeatSelectionChanged, and onSeatSelectionSubmitted) has the following shape:

Inbound commands

The parent can send commands to the iframe after initialisation:

Security

The iframe only accepts messages originating from the whitelisted parentOrigin. Send all messages to https://www.headout.com as the target origin and ensure your domain is registered in ALLOWED_DOMAINS.

Next steps

Once onSeatSelectionSubmitted fires, pass the returned seat data to Validate to confirm availability, then proceed to Booking.

Path Parameters

productId
integer
required

Product ID of the seatmap product.

Response

Seat selection HTML page rendered successfully.