Assessments
Receive body alignment initialization, result, and report events from an embedded flow.
The body alignment pages can be embedded in an iframe. The flow sends messages
to its parent window as it initializes, saves its result, and finishes report
generation. The message type values are lower-case, hyphenated strings.
Use the redirectUrl returned by Create an assessment:
<iframe
id="bodyAlignmentIframe"
title="Body alignment assessment"
src="https://your-client.gofa.app/assessment/body-alignment/result-id"
allow="camera"
></iframe>The production page currently posts to window.parent with a wildcard target
origin. Your receiver must still check the actual event.origin and the
expected message shape before accepting a payload.
type | data | When it is sent |
|---|---|---|
body-alignment-initialized | bodyAlignmentResultId, result | The capture page has initialized or loaded its record. |
body-alignment-result-saved | bodyAlignmentResultId, result | The initial result has been saved or loaded in the result view. |
body-alignment-report-generated | bodyAlignmentResultId, result | Report generation has completed and the result includes the generated report when available. |
Example envelope:
{
"type": "body-alignment-result-saved",
"data": {
"bodyAlignmentResultId": "result-id",
"result": {
"id": "result-id",
"clientId": "your-client-id",
"createdAt": "2026-01-01T00:00:00.000Z"
}
}
}Example receiver:
const iframe = document.getElementById("bodyAlignmentIframe") as HTMLIFrameElement | null;
const expectedOrigin = "https://your-client.gofa.app";
window.addEventListener("message", (event) => {
const message = event.data;
if (
event.origin !== expectedOrigin ||
event.source !== iframe?.contentWindow ||
!message ||
![
"body-alignment-initialized",
"body-alignment-result-saved",
"body-alignment-report-generated",
].includes(message.type)
) {
return;
}
const { bodyAlignmentResultId, result } = message.data ?? {};
if (typeof bodyAlignmentResultId !== "string" || !result) return;
// Update the host application using the validated result.
});Health data can be present in result. Keep it in memory only as long as
needed, avoid logging the full payload, and do not treat a message as proof of
authorization. Fetch the result through the authenticated detail endpoint when
the host needs an authoritative record.