POST https://attribution.ondropp.app/v1/init
Content-Type: application/json
X-Key-Id: ak_3f9c1e2a7b6d4c80
X-Timestamp: 1760700000
X-Signature: <signature>

Send on every app launch, signed with the platform's SDK key.

Request#

Request body

{
  "installId": "6f1c2a9e-3b7d-4c51-9a8e-2d4f6b1c0e73",
  "platform": "android",
  "appVersion": "3.2.1",
  "sdkVersion": "0.1.0",
  "device": {
    "model": "Pixel 8",
    "osVersion": "15",
    "locale": "en-IN",
    "timezone": "Asia/Kolkata",
    "screen": { "w": 1080, "h": 2400, "dpr": 2.625 }
  },
  "installReferrer": {
    "raw": "utm_source=dropp&click_id=c_8b1f0e7d2a4c4f6e",
    "clickId": "c_8b1f0e7d2a4c4f6e",
    "referrerClickTs": 1760700000,
    "installBeginTs": 1760700042
  }
}

Field	Rules
`installId`	UUID generated once per install and kept by the app.
`platform`	`android` or `ios`. Must match the key's platform.
`appVersion`	1–64 characters.
`sdkVersion`	1–32 characters. Your integration's version.
`device.model`, `osVersion`, `locale`, `timezone`	Up to 100, 32, 35 and 64 characters. `timezone` is an IANA name.
`device.screen`	Optional. Whole pixels; `dpr` above 0.
`installReferrer`	Android only. Send it until a response is `attributed`.

Unknown fields are ignored, so newer apps can send fields older servers don't know.

Response#

200 OK

{
  "installId": "6f1c2a9e-3b7d-4c51-9a8e-2d4f6b1c0e73",
  "attribution": {
    "type": "attributed",
    "method": "install_referrer",
    "clickId": "c_8b1f0e7d2a4c4f6e",
    "linkId": "6711a0c2f1e4b8a9c3d2e1f0",
    "campaignId": "6711a0c2f1e4b8a9c3d2e1f1",
    "creatorId": "6711a0c2f1e4b8a9c3d2e1f2",
    "source": "instagram",
    "confidence": 1,
    "attributedAt": "2026-10-17T10:00:42.000Z"
  },
  "deepLink": { "path": "/product/123", "params": { "ref": "creator", "variant": "red" } }
}

Field	Meaning
`attribution.type`	`attributed` or `organic`.
`attribution.method`	`install_referrer`, `fingerprint` or `none`. Every other attribution field is optional.
`deepLink`	Where to route the user. Non-null at most once per install, on the response that attributed it. Route to `path` with `params`, and don't re-deliver it.

Today's response

Until install attribution ships, every valid request gets { "installId": "…", "attribution": { "type": "organic", "method": "none" }, "deepLink": null }. Build your handling for the full response now; nothing changes on your side when attribution goes live.