API Reference

The Affitor Tracking API lets your backend record affiliate events — clicks, signups, sales, and refunds — and retrieve program performance data.

Base URLCopy Anchor Link

https://api.affitor.com

All paths below are relative to this base. Strapi serves v1 routes under /api, so the full path for a tracking endpoint is:

https://api.affitor.com/api/v1/track/sale

AuthenticationCopy Anchor Link

Different endpoints use different auth modes.

Your program API key (api_token) is found in the Affitor dashboard under your program settings.

Server mode vs browser mode (lead endpoint)Copy Anchor Link

POST /api/v1/track/lead supports two modes:

• Browser mode: called by affitor-tracker.js from the customer's browser. No Bearer token. Attribution is proved by the click_id cookie value passed in the body.
• Server mode: called from your backend. Include Authorization: Bearer <program_api_key>. Send the click_id with your customer_key: a first lead with only customer_key answers 400, because Affitor saves your key on the customer only when a lead settles.

Response envelopeCopy Anchor Link

All endpoints return JSON. A successful tracking call includes "success": true; the readiness endpoint returns its verdict object instead, with no success field. On an error, error is an object — never a plain string.

Success shape:

{
  "success": true
}

Sale and refund responses include additional IDs:

{
  "success": true,
  "sale_id": 42,
  "commission_id": 17,
  "message": "Sale tracked successfully"
}

Error shape:

{
  "data": null,
  "error": {
    "status": 400,
    "name": "BadRequestError",
    "message": "transaction_id is required and must be a string",
    "details": {}
  }
}

Read error.message, not error — interpolating the object prints [object Object]. The readiness endpoint uses a different envelope, and so does any endpoint refusing a key past its rotation deadline. Both shapes are laid out in the error reference.

Endpoint familiesCopy Anchor Link

/api/v1/track/* — Tracking API (v1)Copy Anchor Link

The primary integration surface. Writes to the v1 event tables (affiliate_click_events, affiliate_lead_events, affiliate_sale_events).

/api/tracking/* — Dashboard endpointsCopy Anchor Link

There is no /api/tracking/ alias for click, lead, sale, or refund. The four /api/v1/track/* paths above are the only ones that accept tracking calls from your backend.

The /api/tracking/ paths that do exist back the Affitor dashboard, not a server-to-server integration. They authenticate with a signed-in dashboard session and require an active workspace membership on the program — taken from the path, or from program_id in the body on the two POST routes that have no path parameter. A Bearer program API key is not accepted on any of them:

To reach readiness from your own backend, call GET /api/v1/programs/me/readiness with your program API key instead — it derives the program from the key, so there is no program ID in the path.

Test modeCopy Anchor Link

Pass "additional_data": { "test_mode": true } in any tracking request body to create a flagged test record without affecting real attribution, commission, or metric state. Test records are marked is_test: true in the database.

Endpoint pagesCopy Anchor Link