Skip to main content

Report a visitor touch from a connected web site (browser key)

POST 
/api/public/attribution/touches

Doc 105 §4.2 — what cw-attribution.js and the chat widget's loader (widget.js, DA-2b) send; any page script may send the same. Authenticated by the site's PUBLIC browser key (pk_…) — or the workspace's chat WIDGET key for a site linked to the widget (403 site_not_linked when none is) — in the body (key), the X-CW-Key header or the key query parameter, and only from the site's own domains: the request's Origin (else Referer) must match (403 origin_not_allowed / origin_required). CORS is granted to that origin only (no credentials). The body may be sent as text/plain JSON so the browser sends it without a preflight. Rate limited per key + client IP.

  • web_visit: stored only when the page carries a campaign signal (utm, a click id) or came from another site; otherwise outcome: ignored.
  • wa_click: a click on a WhatsApp link. Answered with a fresh ref code (5 characters, no look-alikes, unique in the workspace, valid 30 days) and the ready-made message from the site's template in the visitor's locale; put it into the link's text. ref_tag is the code as (ref: CODE), for a link that already has a text.

The same visitor's same kind within 10 minutes returns the touch already recorded (outcome: duplicate, same ref code). A web_visit whose browser the chat widget already recorded a widget touch for in that window (the chat reported this visitor_key at session start) is a duplicate of that touch too. CONSENT: click ids and fbp/fbc are kept only with consent.ads true (or 'granted'); without it they are dropped and stripped from the URLs. fbc is derived from fbclid when missing. The visitor's IP and user agent are taken from the request itself, and kept on the touch only with ads consent too.

Request​

Responses​

A duplicate within the window, or ignored (no signal, or the switch for this kind is off).