API: Ingest
Public event ingestion API (ingest-api binary, base URL = PUBLIC_INGEST_URL, Bearer write key). NOT served under /api/v1.
На этой странице
- POST /v1/alias
- OPTIONS /v1/alias
- GET /v1/cfg
- OPTIONS /v1/cfg
- POST /v1/identify
- OPTIONS /v1/identify
- POST /v1/picker/capture
- OPTIONS /v1/picker/capture
- POST /v1/replay
- OPTIONS /v1/replay
- GET /v1/sdk/browser/0.6.4/diagnostics.js
- OPTIONS /v1/sdk/browser/0.6.4/diagnostics.js
- GET /v1/sdk/browser/0.6.4/manifest.json
- OPTIONS /v1/sdk/browser/0.6.4/manifest.json
- GET /v1/sdk/browser/0.6.4/picker.js
- OPTIONS /v1/sdk/browser/0.6.4/picker.js
- GET /v1/sdk/browser/0.6.4/replay.js
- OPTIONS /v1/sdk/browser/0.6.4/replay.js
- GET /v1/sdk/browser/0.6.4/tracker.js
- OPTIONS /v1/sdk/browser/0.6.4/tracker.js
- POST /v1/site-stat
- OPTIONS /v1/site-stat
- GET /v1/t-diag.js
- GET /v1/t-picker.js
- GET /v1/t-replay.js
- GET /v1/t.js
- POST /v1/track
- OPTIONS /v1/track
Раздел собран из спецификации OpenAPI продукта: 28 метод(ов). Поверхность — ingest-api (приём событий, отдельный базовый адрес). Без токена доступа доступны 23 из 28.
Методы раздела
- POST
/v1/alias - OPTIONS
/v1/alias - GET
/v1/cfg - OPTIONS
/v1/cfg - POST
/v1/identify - OPTIONS
/v1/identify - POST
/v1/picker/capture - OPTIONS
/v1/picker/capture - POST
/v1/replay - OPTIONS
/v1/replay - GET
/v1/sdk/browser/0.6.4/diagnostics.js - OPTIONS
/v1/sdk/browser/0.6.4/diagnostics.js - GET
/v1/sdk/browser/0.6.4/manifest.json - OPTIONS
/v1/sdk/browser/0.6.4/manifest.json - GET
/v1/sdk/browser/0.6.4/picker.js - OPTIONS
/v1/sdk/browser/0.6.4/picker.js - GET
/v1/sdk/browser/0.6.4/replay.js - OPTIONS
/v1/sdk/browser/0.6.4/replay.js - GET
/v1/sdk/browser/0.6.4/tracker.js - OPTIONS
/v1/sdk/browser/0.6.4/tracker.js - POST
/v1/site-stat - OPTIONS
/v1/site-stat - GET
/v1/t-diag.js - GET
/v1/t-picker.js - GET
/v1/t-replay.js - GET
/v1/t.js - POST
/v1/track - OPTIONS
/v1/track
POST
/v1/alias Alias an anonymous id to a known user id
Base URL: PUBLIC_INGEST_URL (ingest-api), NOT /api/v1. The mapping is applied to subsequent events. Alias is intentionally unavailable to a browser credential to bound identity-poisoning risk. Bearer accepts legacy or server credentials with `identity:alias`; only legacy `pp_wk` may use the deprecated `key` query fallback. Credentials issued before the tenant-bound alias capability migration must be rotated and receive `403 credential_rotation_required` until then.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
key необязателен | Query | string | Full legacy `pp_wk` accepted only for the documented compatibility endpoints. Browser `pp_bt` and server `pp_sk` credentials are rejected in query strings. URLs containing this value are credentials and must be redacted from proxy, CDN, tracing and browser tooling. |
X-PP-SDK-Name необязателен | Заголовок | string | Accepted for transport compatibility; alias does not persist SDK metadata. |
X-PP-SDK-Version необязателен | Заголовок | string | Accepted for transport compatibility; alias does not persist SDK metadata. |
X-PP-App-Version необязателен | Заголовок | string | Accepted for transport compatibility; alias does not persist SDK metadata. |
X-PP-Release необязателен | Заголовок | string | Accepted for transport compatibility; alias does not persist SDK metadata. |
Тело запроса application/json , обязательно
| Поле | Тип | Описание |
|---|---|---|
anon_id обязательно | string | Opaque exact identifier; NUL is rejected |
user_id обязательно | string | Opaque exact identifier; NUL is rejected |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 202 | Accepted Заголовки: Deprecation.
| object |
| 401 | Missing or invalid credentials (code=unauthorized) | Error |
| 402 | Product access is not active. `code=trial_expired` means the organization's trial ended without payment; `code=subscription_required` means there is no current paid subscription or live trial. In both cases ingest, mutations and plan-gated read/write capabilities are paused until a plan is paid; details.billing_url, when present, points to the cabinet billing page. | Error |
| 403 | The authenticated credential cannot exercise this ingest boundary. `credential_scope_forbidden` means its kind or explicit scope is not allowed; `credential_origin_forbidden` means a browser credential's exact Origin policy did not match; `credential_rotation_required` means an otherwise authenticated pre-migration credential must be rotated before identify/alias writes. Endpoint-specific 403 policies such as `trial_pending_review`, `feature_locked` or an invalid picker capability can also use this response. No credential value or submitted Origin is echoed. | Error |
| 409 | An active project privacy deletion temporarily fences identify and alias changes (code=privacy_job_active, details.retryable=true) | Error |
| 413 | Request body exceeds the endpoint-specific byte limit (code=validation_failed) | Error |
| 422 | Request failed validation (code=validation_failed) | Error |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
OPTIONS
/v1/alias CORS preflight for legacy or server alias clients
The transport preflight is public and cookie-free. Browser pp_bt credentials remain forbidden by the POST authorization policy.
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin POST preflight accepted without cookies. The wildcard response is not authorization: the POST still requires an allowed credential kind, scope and, for browser credentials, exact Origin. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age, Vary.
| пусто |
GET
/v1/cfg Fetch privacy-safe browser collection configuration
Base URL: PUBLIC_INGEST_URL (ingest-api), NOT /api/v1. Public and safe to cache for 60 seconds with `Vary: Origin`. Unknown, malformed or server-key prefixes return the same inert configuration, so the endpoint does not disclose project or credential existence. Legacy/browser prefixes can return real configuration; browser allowed-origin policy is defense in depth and may narrow the representation. Responses permit cross-origin GET without credentials.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
key необязателен | Query | string | Exactly the safe eight-character prefix of a legacy or browser credential. Missing, malformed, unknown, revoked, expired and server-credential prefixes all receive the inert configuration. |
If-None-Match необязателен | Заголовок | string | ETag from a previous response. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Effective collection flags (or the inert fail-closed shape) Заголовки: ETag, Cache-Control, Access-Control-Allow-Origin, Vary.
| PublicBehaviorConfig |
| 304 | The supplied If-None-Match matches the effective configuration. Заголовки: ETag, Vary.
| пусто |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
| 503 | Configuration store unavailable; the tracker remains fail-closed. | Error |
OPTIONS
/v1/cfg CORS preflight for collection configuration
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin GET preflight accepted. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age.
| пусто |
POST
/v1/identify Attach identity traits to a user
Base URL: PUBLIC_INGEST_URL (ingest-api), NOT /api/v1. Bearer auth accepts legacy, browser and server credentials with `identity:identify`. Only legacy `pp_wk` clients may use the deprecated `key` query fallback; browser/server credentials are rejected in URLs. Credentials issued before the tenant-bound alias capability migration must be rotated and receive `403 credential_rotation_required` until then.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
key необязателен | Query | string | Full legacy `pp_wk` accepted only for the documented compatibility endpoints. Browser `pp_bt` and server `pp_sk` credentials are rejected in query strings. URLs containing this value are credentials and must be redacted from proxy, CDN, tracing and browser tooling. |
X-PP-SDK-Name необязателен | Заголовок | string | |
X-PP-SDK-Version необязателен | Заголовок | string | |
X-PP-App-Version необязателен | Заголовок | string | |
X-PP-Release необязателен | Заголовок | string |
Тело запроса application/json , обязательно
| Поле | Тип | Описание |
|---|---|---|
anon_id обязательно | string | Opaque exact identifier; NUL is rejected |
user_id обязательно | string | Opaque exact identifier; NUL is rejected |
traits необязательно | object |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 202 | Accepted Заголовки: Deprecation.
| object |
| 401 | Missing or invalid credentials (code=unauthorized) | Error |
| 402 | Product access is not active. `code=trial_expired` means the organization's trial ended without payment; `code=subscription_required` means there is no current paid subscription or live trial. In both cases ingest, mutations and plan-gated read/write capabilities are paused until a plan is paid; details.billing_url, when present, points to the cabinet billing page. | Error |
| 403 | The authenticated credential cannot exercise this ingest boundary. `credential_scope_forbidden` means its kind or explicit scope is not allowed; `credential_origin_forbidden` means a browser credential's exact Origin policy did not match; `credential_rotation_required` means an otherwise authenticated pre-migration credential must be rotated before identify/alias writes. Endpoint-specific 403 policies such as `trial_pending_review`, `feature_locked` or an invalid picker capability can also use this response. No credential value or submitted Origin is echoed. | Error |
| 409 | An active project privacy deletion temporarily fences identify and alias changes (code=privacy_job_active, details.retryable=true) | Error |
| 413 | Request body exceeds the endpoint-specific byte limit (code=validation_failed) | Error |
| 422 | Request failed validation (code=validation_failed) | Error |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
OPTIONS
/v1/identify CORS preflight for browser identify
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin POST preflight accepted without cookies. The wildcard response is not authorization: the POST still requires an allowed credential kind, scope and, for browser credentials, exact Origin. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age, Vary.
| пусто |
POST
/v1/picker/capture Relay one sanitized element-picker capture
Conditional ingest-api route, mounted only when PICKER_TOKEN_SECRET is configured. Authentication has two factors: a legacy or browser credential with `picker:capture`, plus a short-lived signed picker token in the JSON body. Bearer accepts both credential kinds; the deprecated `key` query fallback accepts legacy `pp_wk` only. Both credentials must resolve to the same project. Server credentials are always rejected.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
key необязателен | Query | string | Full legacy `pp_wk` accepted only for the documented compatibility endpoints. Browser `pp_bt` and server `pp_sk` credentials are rejected in query strings. URLs containing this value are credentials and must be redacted from proxy, CDN, tracing and browser tooling. |
Тело запроса application/json , обязательно
| Поле | Тип | Описание |
|---|---|---|
token обязательно | string | Ten-minute HMAC token issued by the authenticated query-api picker-token route. |
selector обязательно | string | |
url обязательно | string | |
text обязательно | string | |
base_event обязательно | string | |
attributes обязательно | object |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 202 | Sanitized capture stored with a ten-minute TTL. Заголовки: Deprecation.
| пусто |
| 400 | Request failed validation (code=validation_failed) | Error |
| 401 | Missing or invalid credentials (code=unauthorized) | Error |
| 403 | The authenticated credential cannot exercise this ingest boundary. `credential_scope_forbidden` means its kind or explicit scope is not allowed; `credential_origin_forbidden` means a browser credential's exact Origin policy did not match; `credential_rotation_required` means an otherwise authenticated pre-migration credential must be rotated before identify/alias writes. Endpoint-specific 403 policies such as `trial_pending_review`, `feature_locked` or an invalid picker capability can also use this response. No credential value or submitted Origin is echoed. | Error |
| 409 | The single-use picker token has already been consumed (code=picker_token_consumed). | Error |
| 413 | Capture body exceeds 8 KiB. | Error |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
| 503 | Picker capture storage is unavailable. | Error |
OPTIONS
/v1/picker/capture CORS preflight for browser picker capture
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin POST preflight accepted without cookies. The wildcard response is not authorization: the POST still requires an allowed credential kind, scope and, for browser credentials, exact Origin. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age, Vary.
| пусто |
POST
/v1/replay Ingest one independently compressed session-replay chunk
Base URL: PUBLIC_INGEST_URL (ingest-api), NOT /api/v1. Each gzip chunk is at most 512 KiB and is published idempotently by project, session and sequence. A session is capped at 60 minutes and 10 MiB; capped chunks, and over-quota chunks when a reviewed quota is configured, are quietly acknowledged with dropped=true. A new browser sendBeacon tail supplies a `pp_bt` public browser token in the JSON `credential` field, never the URL. Only legacy `pp_wk` clients may use the deprecated `key` query fallback. Server credentials are rejected even if they carry a similarly named scope.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
key необязателен | Query | string | Full legacy `pp_wk` accepted only for the documented compatibility endpoints. Browser `pp_bt` and server `pp_sk` credentials are rejected in query strings. URLs containing this value are credentials and must be redacted from proxy, CDN, tracing and browser tooling. |
Тело запроса application/json , обязательно
| Поле | Тип | Описание |
|---|---|---|
credential необязательно | string | Optional public browser token for a sendBeacon replay tail. Accepted only when no Authorization/query credential is present; browser tokens are never accepted in the URL. |
session_id обязательно | string | Opaque identifier except for the path-normalizing values `.` and `..`. |
actor_id обязательно | string | |
seq обязательно | integer (int32) | |
ts_start обязательно | integer (int64) | Chunk start as Unix epoch milliseconds, inside the 48-hour ingest window. |
ts_end обязательно | integer (int64) | Chunk end as Unix epoch milliseconds, not before ts_start and inside the 48-hour ingest window. |
format обязательно | enum(rrweb-gzip) | |
size_bytes обязательно | integer (int32) | Exact compressed byte length of decoded data. |
data обязательно | string (byte) | Base64-encoded independent gzip member containing rrweb events. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 202 | Chunk accepted, deduplicated, or deliberately dropped by a bounded policy. Заголовки: Deprecation.
| ReplayIngestAccepted |
| 401 | Missing or invalid credentials (code=unauthorized) | Error |
| 402 | Product access is not active. `code=trial_expired` means the organization's trial ended without payment; `code=subscription_required` means there is no current paid subscription or live trial. In both cases ingest, mutations and plan-gated read/write capabilities are paused until a plan is paid; details.billing_url, when present, points to the cabinet billing page. | Error |
| 403 | The authenticated credential cannot exercise this ingest boundary. `credential_scope_forbidden` means its kind or explicit scope is not allowed; `credential_origin_forbidden` means a browser credential's exact Origin policy did not match; `credential_rotation_required` means an otherwise authenticated pre-migration credential must be rotated before identify/alias writes. Endpoint-specific 403 policies such as `trial_pending_review`, `feature_locked` or an invalid picker capability can also use this response. No credential value or submitted Origin is echoed. | Error |
| 413 | JSON/base64 request framing exceeds 800 KiB. | Error |
| 422 | Request failed validation (code=validation_failed) | Error |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
| 503 | Replay entitlement or bounded session state is temporarily unavailable. | Error |
OPTIONS
/v1/replay CORS preflight for browser replay ingest
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin POST preflight accepted without cookies. The wildcard response is not authorization: the POST still requires an allowed credential kind, scope and, for browser credentials, exact Origin. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age, Vary.
| пусто |
GET
/v1/sdk/browser/0.6.4/diagnostics.js Fetch the immutable browser SDK diagnostics bundle
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
If-None-Match необязателен | Заголовок | string | ETag from a previous immutable browser SDK asset or manifest response. A matching strong or weak validator returns 304 with no response body. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Exact immutable JavaScript bytes for @actionpulse/browser@0.6.4. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| string |
| 304 | The supplied If-None-Match validator matches the immutable bytes; no body is returned. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
OPTIONS
/v1/sdk/browser/0.6.4/diagnostics.js CORS preflight for the immutable browser SDK diagnostics bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin GET preflight accepted for an immutable SDK artifact. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
GET
/v1/sdk/browser/0.6.4/manifest.json Fetch the immutable browser SDK integrity manifest
Binds the four versioned JavaScript files to their exact byte sizes, reproducible fflate reference sizes, SHA-256/SHA-384 digests, SRI values and public paths.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
If-None-Match необязателен | Заголовок | string | ETag from a previous immutable browser SDK asset or manifest response. A matching strong or weak validator returns 304 with no response body. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Exact immutable integrity manifest for @actionpulse/browser@0.6.4. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| BrowserSDKManifest |
| 304 | The supplied If-None-Match validator matches the immutable bytes; no body is returned. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
OPTIONS
/v1/sdk/browser/0.6.4/manifest.json CORS preflight for the immutable browser SDK integrity manifest
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin GET preflight accepted for an immutable SDK artifact. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
GET
/v1/sdk/browser/0.6.4/picker.js Fetch the immutable browser SDK picker bundle
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
If-None-Match необязателен | Заголовок | string | ETag from a previous immutable browser SDK asset or manifest response. A matching strong or weak validator returns 304 with no response body. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Exact immutable JavaScript bytes for @actionpulse/browser@0.6.4. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| string |
| 304 | The supplied If-None-Match validator matches the immutable bytes; no body is returned. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
OPTIONS
/v1/sdk/browser/0.6.4/picker.js CORS preflight for the immutable browser SDK picker bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin GET preflight accepted for an immutable SDK artifact. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
GET
/v1/sdk/browser/0.6.4/replay.js Fetch the immutable browser SDK replay bundle
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
If-None-Match необязателен | Заголовок | string | ETag from a previous immutable browser SDK asset or manifest response. A matching strong or weak validator returns 304 with no response body. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Exact immutable JavaScript bytes for @actionpulse/browser@0.6.4. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| string |
| 304 | The supplied If-None-Match validator matches the immutable bytes; no body is returned. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
OPTIONS
/v1/sdk/browser/0.6.4/replay.js CORS preflight for the immutable browser SDK replay bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin GET preflight accepted for an immutable SDK artifact. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
GET
/v1/sdk/browser/0.6.4/tracker.js Fetch the immutable browser SDK core bundle
Credential-free, content-addressed release asset for script and self-hosted installations. The versioned bytes never change. The wildcard CORS response intentionally omits credentials so browsers can verify Subresource Integrity from arbitrary customer origins.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
If-None-Match необязателен | Заголовок | string | ETag from a previous immutable browser SDK asset or manifest response. A matching strong or weak validator returns 304 with no response body. |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Exact immutable JavaScript bytes for @actionpulse/browser@0.6.4. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| string |
| 304 | The supplied If-None-Match validator matches the immutable bytes; no body is returned. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Cache-Control, X-Content-Type-Options, Cross-Origin-Resource-Policy, ETag, Digest, Content-Digest, Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
OPTIONS
/v1/sdk/browser/0.6.4/tracker.js CORS preflight for the immutable browser SDK core bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin GET preflight accepted for an immutable SDK artifact. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Max-Age.
| пусто |
POST
/v1/site-stat Increment one anonymous landing-site aggregate
Dedicated ActionPulse landing counter. The browser credential is accepted only in the body and must allow the exact requested event and request Origin. The request contains no visitor/session/event ID, timestamp, URL, referrer, UTM, creative code, user agent, device or country. On success PostgreSQL immediately increments one daily cell; no individual event is published to NATS or stored in ClickHouse.
Тело запроса application/json , обязательно
Схема тела: oneOf<AnonymousSitePageViewStat | AnonymousSiteGoalStat>.
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | The aggregate cell was incremented; response has no body. | пусто |
| 401 | Missing or invalid credentials (code=unauthorized) | Error |
| 403 | The authenticated credential cannot exercise this ingest boundary. `credential_scope_forbidden` means its kind or explicit scope is not allowed; `credential_origin_forbidden` means a browser credential's exact Origin policy did not match; `credential_rotation_required` means an otherwise authenticated pre-migration credential must be rotated before identify/alias writes. Endpoint-specific 403 policies such as `trial_pending_review`, `feature_locked` or an invalid picker capability can also use this response. No credential value or submitted Origin is echoed. | Error |
| 413 | Request body exceeds the endpoint-specific byte limit (code=validation_failed) | Error |
| 422 | Request failed validation (code=validation_failed) | Error |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
| 503 | Anonymous site-stat aggregate storage is unavailable. | Error |
OPTIONS
/v1/site-stat CORS preflight for the anonymous site counter
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin POST preflight accepted without cookies. The wildcard response is not authorization: the POST still requires an allowed credential kind, scope and, for browser credentials, exact Origin. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age, Vary.
| пусто |
GET
/v1/t-diag.js Fetch the lazy browser-diagnostics tracker bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Embedded JavaScript bundle. Заголовки: Cache-Control, X-Content-Type-Options.
| string |
GET
/v1/t-picker.js Fetch the lazy element-picker tracker bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Embedded JavaScript bundle. Заголовки: Cache-Control, X-Content-Type-Options.
| string |
GET
/v1/t-replay.js Fetch the lazy session-replay tracker bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Embedded JavaScript bundle. Заголовки: Cache-Control, X-Content-Type-Options.
| string |
GET
/v1/t.js Fetch the core browser tracker bundle
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 200 | Embedded JavaScript bundle. Заголовки: Cache-Control, X-Content-Type-Options.
| string |
POST
/v1/track Ingest a batch of events (up to 500)
Base URL: PUBLIC_INGEST_URL (ingest-api), NOT /api/v1. Bearer auth accepts legacy, browser and server credentials with `events:write`. The new browser Beacon envelope uses the `credential` body field and never places its public browser token in the URL. Only legacy `pp_wk` clients may use the deprecated `key` query fallback. A present Authorization header is authoritative: malformed or forbidden Bearer auth never falls through to query/body credentials. Events are validated, de-duplicated and published asynchronously; the endpoint returns 202 immediately. Managed pp.js_error/pp.web_vitals items are rejected individually when the exact diagnostics entitlement or persisted project switch is off. Browser custom events outside the credential allowlist are rejected individually with `credential_event_forbidden`.
Параметры
| Имя | Где | Тип | Описание |
|---|---|---|---|
key необязателен | Query | string | Full legacy `pp_wk` accepted only for the documented compatibility endpoints. Browser `pp_bt` and server `pp_sk` credentials are rejected in query strings. URLs containing this value are credentials and must be redacted from proxy, CDN, tracing and browser tooling. |
X-PP-Tracker необязателен | Заголовок | string | Client-reported ActionPulse browser tracker semantic version for diagnostics only. It is not proof of a browser source and never elevates credential kind, scope or managed pp.* authority. |
X-PP-SDK-Name необязателен | Заголовок | string | |
X-PP-SDK-Version необязателен | Заголовок | string | |
X-PP-App-Version необязателен | Заголовок | string | |
X-PP-Release необязателен | Заголовок | string |
Тело запроса application/json , обязательно
| Поле | Тип | Описание |
|---|---|---|
credential необязательно | string | Optional public browser token for the new sendBeacon envelope. Accepted only when no Authorization/query credential is present; browser tokens are never accepted in the URL. |
context необязательно | TrackContext | |
batch обязательно | array<TrackItem> |
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 202 | Batch accepted (some items may be rejected — see `rejected`) Заголовки: Deprecation.
| TrackAccepted |
| 401 | Missing or invalid credentials (code=unauthorized) | Error |
| 402 | Product access is not active. `code=trial_expired` means the organization's trial ended without payment; `code=subscription_required` means there is no current paid subscription or live trial. In both cases ingest, mutations and plan-gated read/write capabilities are paused until a plan is paid; details.billing_url, when present, points to the cabinet billing page. | Error |
| 403 | The authenticated credential cannot exercise this ingest boundary. `credential_scope_forbidden` means its kind or explicit scope is not allowed; `credential_origin_forbidden` means a browser credential's exact Origin policy did not match; `credential_rotation_required` means an otherwise authenticated pre-migration credential must be rotated before identify/alias writes. Endpoint-specific 403 policies such as `trial_pending_review`, `feature_locked` or an invalid picker capability can also use this response. No credential value or submitted Origin is echoed. | Error |
| 413 | Payload exceeds 256KB | Error |
| 422 | Request failed validation (code=validation_failed) | Error |
| 429 | Rate limit (code=rate_limited) or plan quota exceeded (code=quota_exceeded). On ingest operations a live trial that exhausted its total event cap answers code=trial_quota_exceeded instead of quota_exceeded. Заголовки: Retry-After.
| Error |
| 503 | Managed diagnostics collection policy is temporarily unavailable. | Error |
OPTIONS
/v1/track CORS preflight for browser event ingest
Ответы
| Код | Что означает | Тело |
|---|---|---|
| 204 | Cross-origin POST preflight accepted without cookies. The wildcard response is not authorization: the POST still requires an allowed credential kind, scope and, for browser credentials, exact Origin. Access-Control-Allow-Credentials is intentionally absent. Заголовки: Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Max-Age, Vary.
| пусто |
Источник раздела — docs/api/openapi.yaml репозитория продукта,
версия API 1.0.0, OpenAPI 3.0.3,
снимок e2d62cf449b2.
Расхождение снимка со спецификацией роняет сборку документации.