yEd is a desktop application, it is neither a web application nor a server application. Thus yEd cannot be embedded into a webpage nor can it receive messages from a webpage.
The proper way to read GraphML files and show the corresponding graphs in a web application would be to use the commercial yFiles for HTML programming library.
Other than that, you could send the diagram to the web-based editor yEd Live, which supports two ways of directly loading external GraphML files (that explicitly prompts the user before loading the external file):
1) Provide a ?file=... parameter with an URL pointing to the content of a GraphML file. For example, https://www.yworks.com/yed-live/?file=https://gist.githubusercontent.com/fskpf/51cbd1d159a9fcca83a7df421ed54670/raw/cd944ccdb2c6a1f1348ad59b89e7e15b8566d589/organic1 which points to a Gist. The only requirement on that URL is that it must be cross-origin accessible.
2) Use the postMessage API to send the GraphML to the yEd Live window (though I'm not sure whether this can be triggered from your environment):
Once yEd Live is loaded and ready to accept a data message, it posts a message to the opener with 'yed-live-listening'.
After that, you can post a message to yEd Live with an object with {graphml: <string>, source: <string>}. The 'source' is just a hint that indicates from which application the diagram originates.
A simple TypeScript implementation of this would look like this: https://gist.github.com/fskpf/1568f491bc00f1ebfc0a93db310b6460
That said, we do not provide any guarantees about the external triggers of yEd Live. They may change (or be limited) at any time without further notice.
