> For the complete documentation index, see [llms.txt](https://partner-docs.covergenius.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://partner-docs.covergenius.com/xcover-journeys/integration/messaging/web.md).

# Web

Send and receive journey events over postMessage in a web iframe.

{% hint style="info" %}
This page shows the CG specific envelope and events. For the underlying `window.postMessage` API itself, see [MDN: Window.postMessage()](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage).
{% endhint %}

### Prerequisites

The journey must already be embedded per [Web Embedding (iframe)](/xcover-journeys/integration/web-embedding-iframe.md), including its `sandbox`/CSP requirements.

Messaging depends on the iframe loading and its scripts executing. A sandboxed iframe that blocks script execution, or a CSP that blocks the frame from loading, will prevent messaging as a direct consequence.

### Listening for events from the journey

```html
<iframe id="cg-journey" src="https://xcj.xcover.com/acme-travel/en/?country=AU"></iframe>

<script>
  const JOURNEY_ORIGIN = 'https://xcj.xcover.com'; // use the sandbox origin in non-prod

  window.addEventListener('message', (event) => {
    // Always verify the origin before trusting the payload.
    if (event.origin !== JOURNEY_ORIGIN) return;

    const { source, type, payload } = event.data ?? {};
    if (source !== 'xcover-journeys') return;

    switch (type) {
      case 'CG_JOURNEY_READY':
        console.log('Journey mounted and ready to receive messages');
        break;
      case 'CG_JOURNEY_COMPLETE':
        console.log('Journey finished:', payload.outcome, payload.policy_id);
        break;
      // ...handle other event types as needed
    }
  });
</script>
```

### Sending events into the journey

```html
<script>
  const journeyFrame = document.getElementById('cg-journey');
  const JOURNEY_ORIGIN = 'https://xcj.xcover.com';

  function sendToJourney(type, payload = {}) {
    journeyFrame.contentWindow.postMessage(
      { source: 'xcover-journeys', type, payload },
      JOURNEY_ORIGIN,
    );
  }

  // Example: ask the journey to hide itself
  sendToJourney('CG_JOURNEY_HIDE');
</script>
```

### Origin and security requirements

`postMessage` has no built-in authentication. Origin checking is the entire security model. Both sides must get this right.

The journey only accepts inbound messages from an explicit allowlist of trusted origins, configured per environment during onboarding. Messages from any other origin are dropped, not queued, not errored, silently discarded.

{% hint style="info" %}
Always check `event.origin` before trusting `event.data`, as shown above. Never branch on message content alone.
{% endhint %}

<table><thead><tr><th width="179">Requirement</th><th>Detail</th></tr></thead><tbody><tr><td>What to provide</td><td>The exact origin(s) (scheme, host, and port) your page is served from, for each environment you integrate against (sandbox and production).</td></tr><tr><td>Matching</td><td>Exact string match against <code>event.origin</code>. No wildcard or subdomain matching: <code>https://acme.com</code> will <strong>not</strong> match a message sent from <code>https://www.acme.com</code>.</td></tr><tr><td>When to update it</td><td>Any time your integration domain changes (new environment, domain migration, added subdomain). Contact your integration manager before the change ships, not after.</td></tr></tbody></table>

{% hint style="warning" %}
If the journey's trusted-origin configuration is empty or missing for your environment, the journey will not process **any** inbound messages. This fails closed, not open.
{% endhint %}

For Outbound target origin, the journey sends outbound events to a single configured origin per environment, set up during onboarding alongside the trusted-origin allowlist above. You do not configure this yourself.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://partner-docs.covergenius.com/xcover-journeys/integration/messaging/web.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.