API — AffiLayer Docs

API

Everything on https://go.affilayer.com. The tracking API is read access plus signed conversion intake — offers, users and payouts live in the dashboard, not in this API.

Endpoints

Method & path	What it does
`GET /health`	Returns `{"ok":true}`. Use it to check the tracking service is up.
`GET /c/{affiliate_code}/{offer_id}`	Records a click and redirects (`302`) to the offer landing page with `?click_id=` appended. Unknown offer → `404`.
`GET /s/{smartlink_code}`	Deterministic SmartLink pick and redirect (`302`). No eligible offer → `404`.
`POST /conversion`	Signed conversion intake (see below). New conversion → `201`; duplicate → `200`.
`GET /api/stats`	Server-side aggregates over recorded events only.
`GET /api/clicks/{click_id}`	The click and its conversion, if one exists. Unknown ID → `404`.

POST /conversion

Conversions arrive server-to-server only, signed with HMAC-SHA256. Send a JSON body with the header:

x-affilayer-signature: <HMAC-SHA256 hex of the raw body>

The HMAC key is your postback secret. An optional sha256= prefix on the header is accepted. A bad signature returns 400 {"error":"bad signature"}. If the secret is not configured on the server, it returns 500.

Request body

Field	Required	Meaning
`click_id`	Yes	The click ID the conversion is attributed to.
`offer_id`	Yes	The offer the conversion belongs to.
`payout`	Yes	Number, 0 or more. The conversion payout amount.
`currency`	Yes	Payout currency, for example `USD`.
`idempotency_key`	Yes	Your unique key for this conversion. Sending it again returns the original instead of creating a duplicate.
`status`	No	Optional status hint.
`sub1`	No	Optional sub-parameter.

Missing or invalid required fields return 400. Invalid JSON returns 400.

Responses and dedup

201 — new conversion recorded. It starts as pending, and its commission is computed from the offer's payout model and entered in the ledger as pending.
200 {"ok":true,"duplicate":true,"conversion":{…}} — the same idempotency_key, or the same click_id + offer_id, was already recorded. The original is returned; no duplicate is created.
Configured postbacks are dispatched after the conversion is recorded. A postback failure never fails the conversion itself.

Example

curl -X POST https://go.affilayer.com/conversion \
  -H 'Content-Type: application/json' \
  -H "x-affilayer-signature: $(echo -n '{"click_id":"clk_01J…","offer_id":"offer-a","payout":12.5,"currency":"USD","idempotency_key":"conv-0001"}' | openssl dgst -sha256 -hmac 'YOUR_POSTBACK_SECRET' | cut -d' ' -f2)" \
  -d '{"click_id":"clk_01J…","offer_id":"offer-a","payout":12.5,"currency":"USD","idempotency_key":"conv-0001"}'

Keep your secret secret. The postback secret signs conversions and postbacks. Do not put it in client-side code, public repositories or shared documents.