Web API

POST /_d/e (website events)

What the web script sends: batches of page views, events and time on page, with the web key.

GET  https://go.yourbrand.com/_d/s.js        the script
POST https://go.yourbrand.com/_d/e           a batch of events
POST https://attribution.ondropp.app/v1/web/e  fallback when the link domain isn't reachable
Content-Type: text/plain;charset=UTF-8
Origin: https://yourbrand.com

What the web script sends. You don't need to call this yourself; it's documented so you can see exactly what leaves your visitors' browsers, or send the same events from your own code. Everything here is behaviour, never money: orders come from your server through the Server API.

The script and its batches are served from your link domain, so they're first-party on your site. text/plain makes the request "simple", so the browser sends no CORS preflight; application/json works too.

Send a batch#

Request body

{
  "key": "pk_3f9c1e2a7b6d4c80",
  "visitorId": "0b6e5c1a-3f2d-4c8e-9a71-5d4b2e6f8c10",
  "sdkVersion": "0.2.0-web",
  "items": [
    { "type": "event", "eventId": "3a6f0e2c-8d1b-4f7a-9c5e-1b2d3e4f5a60", "sessionId": "7c2d9e4f-1a3b-4d5e-8f60-2b1c3d4e5f60",
      "name": "page_view", "ts": 1760700000, "path": "/products/red-shoe", "title": "Red Shoe",
      "referrer": "https://l.instagram.com/", "utm": { "source": "instagram", "medium": "link", "campaign": "summer" },
      "clickId": "c_0123456789abcdef" },
    { "type": "event", "eventId": "4b7a1f3d-9e2c-4a8b-8d6f-2c3e4f5a6b70", "sessionId": "7c2d9e4f-1a3b-4d5e-8f60-2b1c3d4e5f60",
      "name": "add_to_cart", "ts": 1760700042, "path": "/products/red-shoe", "props": { "sku": "RS-9", "price": 1499 } },
    { "type": "engage", "eventId": "5c8b2a4e-af3d-4b9c-9e70-3d4f5a6b7c80", "sessionId": "7c2d9e4f-1a3b-4d5e-8f60-2b1c3d4e5f60",
      "ts": 1760700090, "path": "/products/red-shoe", "ms": 64000 },
    { "type": "identify", "ts": 1760700120, "userId": "user_8812" }
  ]
}

Field	Rules
`key`	The app's web key, `pk_` and 16 hex characters.
`visitorId`	A random UUID the script keeps in the browser (and the `dropp_vid` cookie).
`items`	1–50, checked one by one, so one bad item doesn't cost the batch. 64 KB at most.

`type`	Fields
`event`	`eventId` (UUID, the same on every retry), `sessionId` (UUID), `name` (`snake_case`), `ts` (unix seconds), `path` (starts with `/`, at most 512, no query string), `title?`, `props?` (as app events). On a visit's first event: `referrer?`, `utm?` (`source`, `medium`, `campaign`, `content`, `term`), `clickId?` (the `dropp_click_id` it landed with).
`engage`	`eventId`, `sessionId`, `ts`, `path`, `ms`: time the page was on screen, at most 6 hours.
`identify`	`ts`, `userId` (at most 128, never an email or phone number) or `null` to log out. Unverified: never used for credit.

The funnel's standard names: page_view (sent by the script), view_item, add_to_cart, begin_checkout, sign_up, purchase.

200 OK

{ "accepted": 2, "duplicates": 0, "rejected": [{ "index": 4, "code": "invalid_event", "message": "name: must be snake_case, e.g. add_to_cart" }] }

accepted and duplicates count events (page views included); engage and identify items are bookkeeping. A retried batch adds nothing twice. rejected[].code: invalid_event, too_old (more than 2 days ago), too_far_in_future (more than 10 minutes ahead).

Errors#

Status	`code`	Meaning
403	`invalid_key`	Not a web key of any app.
403	`wrong_domain`	The key belongs to another app than this link domain's.
403	`origin_not_allowed`	The page isn't on `https://` or its host isn't in the app's website domains. Add it in Project details.
400	`validation_failed`	The envelope doesn't parse.
429	`rate_limited`	Over 50 requests a second per IP, 2,000 per key, or 300 items a minute per visitor. Wait `Retry-After` seconds.
503	`storage_unavailable`	Nothing was kept: retry.

Every response carries Access-Control-Allow-Origin with your page's origin, errors included, so the script can read the status. Crawlers and headless browsers get 200 with nothing stored.

What's kept#

	Kept
Visitors: first and last seen, first touch, first source, visits, device class, country, user	13 months after the last visit
Visits: landing and exit page, pages, events, time on screen, source	90 days
Page views and events	90 days
Daily totals for reports	12 months

No IP address is stored. Properties that look like an email or phone number are dropped, and emails in a path are masked. DELETE /v1/s2s/users/:userId deletes the visitors linked to that user, with their visits and page views.