Record an affiliate conversion

curl --request POST \
  --url https://api.introw.io/api/v1/affiliate/conversions \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "clickId": "aff_01HVK6Y8Z8Q7J8J8J8J8J8J8J8"
}
'

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({clickId: 'aff_01HVK6Y8Z8Q7J8J8J8J8J8J8J8'})
};

fetch('https://api.introw.io/api/v1/affiliate/conversions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.introw.io/api/v1/affiliate/conversions"

payload = { "clickId": "aff_01HVK6Y8Z8Q7J8J8J8J8J8J8J8" }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "status": "ignored",
  "conversionId": null,
  "formSubmissionId": null
}

{
  "status": "recorded",
  "conversionId": "conv_01HVK6Y8Z8Q7J8J8J8J8J8J8J8",
  "formSubmissionId": "fsub_01HVK6Y8Z8Q7J8J8J8J8J8J8J8"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

Record an affiliate conversion

Records an affiliate conversion and creates the campaign form submission it maps to.

Attribution flow. A partner shares an Introw affiliate link (/r/{code}). Introw logs a server-side click and redirects the visitor to your site with an opaque irw_id param. The affiliate.js snippet stores that id in a first-party, last-click _introw_aff cookie (90-day window). When the visitor converts, you send the cookie value as clickId. Because every conversion is anchored to a real server-side click and deduplicated, attribution can never be forged or inflated.

Two authentication paths:

Server-to-server (recommended for backend conversions): send an x-api-key secret that holds the affiliate:write scope. No publishable key or Origin is required.
Browser (via affiliate.js): send the campaign publishable key in the x-introw-publishable-key header (or the publishableKey body field). The request Origin must match the campaign’s allowed-origins allowlist; an empty allowlist permits any origin.

Responses are deliberately forgiving so the browser snippet never surfaces errors on your page: an invalid, expired, or already-converted click returns 200 with status: ignored/duplicate rather than an error. A newly attributed conversion returns 201 with status: recorded.

POST

api

affiliate

conversions

Record an affiliate conversion

curl --request POST \
  --url https://api.introw.io/api/v1/affiliate/conversions \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "clickId": "aff_01HVK6Y8Z8Q7J8J8J8J8J8J8J8"
}
'

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({clickId: 'aff_01HVK6Y8Z8Q7J8J8J8J8J8J8J8'})
};

fetch('https://api.introw.io/api/v1/affiliate/conversions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.introw.io/api/v1/affiliate/conversions"

payload = { "clickId": "aff_01HVK6Y8Z8Q7J8J8J8J8J8J8J8" }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "status": "ignored",
  "conversionId": null,
  "formSubmissionId": null
}

{
  "status": "recorded",
  "conversionId": "conv_01HVK6Y8Z8Q7J8J8J8J8J8J8J8",
  "formSubmissionId": "fsub_01HVK6Y8Z8Q7J8J8J8J8J8J8J8"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  }
}

Authorizations

x-api-key

string

header

required

Introw API key shown once when the credential is created.

Body

application/json

clickId

string

required

Signed affiliate click token captured at click time. In the browser this is the value of the first-party _introw_aff cookie set by affiliate.js (read it with window.introw.affiliate.getClickId()). A missing, malformed, expired, or forged token causes the conversion to be safely ignored (HTTP 200) rather than rejected.

Required string length: 1 - 256

publishableKey

string

Campaign publishable key, used only on the browser (client-side) path. Safe to expose publicly. Prefer sending it via the x-introw-publishable-key header; this body field is an alternative. Ignored on the server-to-server path, which authenticates with the secret x-api-key header and the affiliate:write scope.

Required string length: 1 - 128

Email of the converting customer, when known. Used to enrich the resulting form submission and CRM record. Send an empty string or omit when unavailable.

Pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$

properties

object

Conversion metadata for the campaign's conversion form. Each key is a form field id (see the campaign's "View form fields" dialog); the value is written to that field on the headless submission. Keys that don't match a form field are ignored. A campaign may optionally define a field mapping to alias a payload key to a different field id.

Show child attributes

Response

Conversion was a duplicate or had no valid/unexpired click token, so nothing new was recorded.

status

enum<string>

required

Outcome of the conversion. recorded (HTTP 201): a new conversion was attributed and a form submission was created. duplicate (HTTP 200): this click was already converted, so nothing new was recorded. ignored (HTTP 200): the click token was missing, invalid, or expired, so no attribution was made.

Available options:

recorded,

duplicate,

ignored

conversionId

string | null

required

Affiliate conversion id, when a new conversion was recorded; otherwise null.

formSubmissionId

string | null

required

Form submission id created from the conversion, when available; otherwise null.

Create a portal session

⌘I