Tracking

Category: Public Base URL: /track/partners Authentication: Mixed Routes: 2 routes documented

Overview#

This section documents 2 API routes for tracking.

Quick Reference#

GET Track Partners Click :code#

Endpoint: GET /track/partners/click/:code Authentication: Public (Optional)

Description#

Public endpoint for tracking affiliate/partner clicks. Redirects to the offer landing page and sets a tracking cookie.

URL Parameters#

Response#

Error (400):

{
  message,
}

Example Request#

curl -X GET 'https://your-store.omnicart.cc/track/partners/click/:code' \
  -H 'Content-Type: application/json'

POST Track Partners Conversion#

Endpoint: POST /track/partners/conversion Authentication: Public (Optional)

Description#

Public endpoint for recording affiliate/partner conversions. Server-authoritative AND attribution-authoritative: - Totals, currency, and line items are read from the order record; a client-supplied order_total is never trusted (forgery vector). - The click id is taken from the ORDER's own stamped attribution (metadata.partner.click_id / partner_click_id), NOT from the request body, header, or cookie. Without this binding, any caller holding their own click id could attribute someone else's order to their partner account (IDOR) by supplying its order_id. - The response is an opaque acknowledgement — it never leaks partner ids, commission amounts, or rates to the unauthenticated caller. The order's attribution is stamped by the storefront (cart metadata) or the Konnektive sync; the server-side subscriber is the primary conversion path. This endpoint is a backstop for storefronts that call it explicitly.

Request Body#

This route does not declare a validation schema, so the accepted fields are not derivable from the source. Check the handler before relying on a particular body.

Response#

Success (202):

{
  recorded,
}

Also returns (202):

{
  recorded,
}

Also returns (202):

{
  recorded,
}

Also returns (202):

{
  recorded,
}

Error (400):

{
  message,
}

Example Request#

curl -X POST 'https://your-store.omnicart.cc/track/partners/conversion' \
  -H 'Content-Type: application/json'