What the tracker sends (request payload)

Every hit is one POST to {origin}/api/event:

• Content-Type: text/plain, so browsers don't send a CORS preflight,
• credentials: 'omit': no cookies are sent or accepted,
• keepalive: true, so hits survive page navigation. navigator.sendBeacon is the fallback when fetch throws.

The server responds with 202 Accepted with an empty body, whether or not the hit is later kept, so the response never tells a script anything about your settings.

Retries#

If the server responds with an error (any 4xx or 5xx status, including 429 when a rate limit is hit), the tracker sends the same hit again:

• up to 5 more times, after 1 second, 10 seconds, then 60 seconds for each of the last three,
• oldest hit first, one at a time,
• from a queue of at most 20 hits that lives in memory only. Nothing is written to the device, so hits still waiting are lost when the page is closed or reloaded.

A request that never gets a response (the visitor is offline, or a content blocker stops it) isn't retried.

A retried hit is recorded with the time it arrives, which can be a few minutes after it happened. In rare cases the server has already recorded a hit before the error reaches the browser, and the retry counts it a second time.

Body#

The three examples show every field that can appear in each kind of hit the core script sends, in the order the script writes them. A real hit carries far fewer: r, h, d, g, hp, ch, a, tz and xp are only there in the cases the table lists.

A pageview:

{
  "s": "pa_7Q2K9XH3AB",
  "t": "pageview",
  "u": "https://example.com/app?utm_source=newsletter#/pricing",
  "l": "en-US",
  "w": 1440,
  "i": 0,
  "r": "https://news.example.org/",
  "h": 1,
  "d": 1,
  "g": 1,
  "hp": 1,
  "a": "webdriver",
  "tz": "America/Denver",
  "xp": "var_4M8T2KQ9ZD",
  "p": { "plan": "pro" }
}

An engagement hit:

{
  "s": "pa_7Q2K9XH3AB",
  "t": "engagement",
  "u": "https://example.com/app?utm_source=newsletter#/pricing",
  "l": "en-US",
  "w": 1440,
  "i": 1,
  "r": "https://news.example.org/",
  "h": 1,
  "d": 1,
  "g": 1,
  "hp": 1,
  "a": "webdriver",
  "tz": "America/Denver",
  "e": 48210,
  "sd": 80
}

A custom event:

{
  "s": "pa_7Q2K9XH3AB",
  "t": "event",
  "u": "https://example.com/app?utm_source=newsletter#/pricing",
  "l": "en-US",
  "w": 1440,
  "i": 1,
  "r": "https://news.example.org/",
  "h": 1,
  "d": 1,
  "g": 1,
  "hp": 1,
  "a": "webdriver",
  "tz": "America/Denver",
  "n": "signup",
  "p": { "plan": "pro" }
}

The server also accepts rv/revenue and cu/currency at the top level, but the tracker puts them in p.

A body larger than 32 KB, a body that isn't a JSON object and a hit with an unknown t are ignored (still given a 202).

What each module sends#

The core script (pa.js) sends pageview, engagement and event hits. The modules add these:

Experiments#

A pageview is normally given a 202 and no body. When the page has a running experiment and this visitor is given another version, the response is 200 with a small JSON body:

{ "x": "/pricing-b", "p": 0 }

x is a path of the same site and p is 1 for a preview. The tracker sends the visitor there and keeps the query string. That pageview is not stored. The redirect adds pa_ref to the address with the page the visitor really came from, so the visit keeps its source. The tracker reads it once and removes it from the address bar. Nothing is stored in the browser.

Interaction flag#

Some bots run a real browser, load a page and leave without touching it. To tell them from people, every hit says whether the tracker has seen a real input on the page:

• i is 0 until the first pointer press or move, key press, touch or wheel turn, and 1 from then on.
• At that first input the tracker sends one engagement hit straight away, so the visit is marked even if the hit sent when the page closes is lost.
• Scrolling alone doesn't count, and neither does input a script generates. Both are things a bot can do without a person.

It is a yes or no. Nothing about the input is sent: not what it was, not where the pointer was, not which key, not when. Visits are then reported as input seen, none or unknown, see Visits with no input seen.

Time zone#

Every hit carries the name of the browser's time zone (tz), as Intl.DateTimeFormat().resolvedOptions().timeZone reports it.

A browser running on a server is rarely set to a time zone of the country its address is in. So the server compares the zone with the country of the request and feeds the result (it fits, it doesn't, it is UTC) into the bot score.

The zone is used in memory, for that comparison only. It is not stored with the visit or the event, not logged, and never used as a location: the country in reports comes only from the country header our network provider (Cloudflare) adds to the request, and a hit without that header has no country. The one place a time zone is kept is a honeypot hit.

What isn't sent#

No cookies, no stored identifiers, no user id, no screen height or color depth, no installed fonts or plugins, no canvas or audio fingerprints, no mouse movement, no form contents.

The server receives the IP address and User-Agent because every HTTP request carries them. They're used in memory and dropped. See How it works.