Nothing renders in the iframe
Check these first:- Iframe is loaded: call
postMessage()only after the iframeloadevent fires. - Required fields are present:
fraud(stringified JSON) andfileData(ArrayBuffer) must be provided. - Correct payload types:
fraud,decision,classificationmust be strings (JSON.stringify(...))fileDatamust be anArrayBuffer(not Blob, not base64 string)
- Same stage + cell: confirm you fetched results from the same stage/cell where the submission was created.
- Serving over HTTP: don’t open the page via
file://. Use a local server (e.g.,python3 -m http.server) because browsers restrict behavior underfile://.
postMessage is sent but the iframe does not receive it
Most common causes:
- Target origin mismatch:
targetOriginmust match the iframe’s origin exactly.- Tip: compute it from the iframe URL:
new URL(iframe.src).origin
- Tip: compute it from the iframe URL:
- Wrong iframe URL: confirm the iframe
srcis the enabled Offline iFrame bundle URL (or your self-hosted bundle URL).
Highlights / localized detections are missing
If you expect overlays (bounding boxes) but don’t see them:- Fetch fraud using:
GET .../fraud?with_metadata=true - Confirm the response contains indicator metadata (some findings do not produce localized overlays).
Blank screen or error screen after posting the message
- Check browser console for errors (Console + Network tabs).
- Validate
fraudis valid JSON before posting: - Verify the file bytes in
fileDatamatch the result payload (wrong file can lead to confusing UI behavior). - Ensure you send
fileDataas a transferable (third argument topostMessage) to avoid large buffer copies.
CSP errors in console
- For the inline quickstart example, inline scripts may require:
script-src 'unsafe-inline' - For production, move scripts to external files and remove
unsafe-inline. - Ensure
frame-src(orchild-src) allows the iframe origin (self-hosted or enabled Resistant AI origin).
Clipboard functionality not working
- Ensure the iframe has:
allow="clipboard-read; clipboard-write" - Ensure browser policies allow clipboard access.
Still stuck?
When contacting support, include:- stage + cell (e.g., prod
us-1) - iframe
src(redacted if needed) and thetargetOriginyou used submission_id- browser + version
- console error screenshot or text