Add minimum required endpoints for embedding

Document API endpoints that must be whitelisted for embedding dashboards behind a reverse proxy or firewall.

Generated-By: mintlify-agent

Author: mintlify[bot]

references/embedding.mdx

@@ -22,6 +22,35 @@ This document provides complete API reference for JWT structure and configuratio
 
 Embedded Lightdash content is available to view by anyone (not just folks with a Lightdash login). Content is secured using JWT (JSON Web Tokens) with configurable expiration times.
 
+## Minimum required endpoints for embedding
+
+If you're running Lightdash behind a reverse proxy or firewall, the following endpoints must be whitelisted for embedding to work. The embed system uses JWT-based authentication via the `Lightdash-Embed-Token` HTTP header, separate from Lightdash's session-based auth.
+
+### SPA entry point and static assets
+
+| Endpoint | Description |
+|----------|-------------|
+| `/embed/*` | SPA entry point that serves the embed UI |
+| `/assets/*` | Static assets (JS, CSS, fonts, images) |
+
+### API endpoints
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/api/v1/health` | App config, feature flags, embedding settings (unauthenticated) |
+| GET | `/api/v1/user/account` | Loads the anonymous embed account with its permissions |
+| GET | `/api/v1/org` | Org-level settings (appearance/theming) |
+| GET | `/api/v1/projects/*` | Project config and explore/table metadata |
+| GET | `/api/v1/saved/*` | Chart definitions for each dashboard tile |
+| POST | `/api/v1/embed/*` | Embed-specific endpoints (dashboard, tile queries, filters, totals) |
+| GET | `/api/v2/projects/*/query/*` | Query result polling and pagination |
+| POST | `/api/v2/projects/*/query/*` | Query execution |
+| GET | `/api/v2/feature-flag/*` | Runtime feature toggles |
+
+<Info>
+All API endpoints except `/api/v1/health` require JWT authentication via the `Lightdash-Embed-Token` header. The JWT scopes access to only the specific dashboard/chart and project in the token.
+</Info>
+
 ## Known limitations
 
 - Embedding only works for dashboards and charts directly. To embed explores, use the `canExplore` flag in a dashboard.