PandaIDX

Track Event

Records one page view or custom event for the site owner's Analytics dashboard. It answers 204 with no body.

POST/v1/analytics/track

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret. Optional: add the signed-in visitor's access token as `Authorization: Bearer` to store the event with their contact. Browsers can call it only from the site's own origins; others get 403.

Edge cache: no-store

Query Parameters

keystring
required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

typestring
optional

`page_view` or a custom name in snake_case (a-z, 0-9, `_`, 2 to 48 characters, starting with a letter). `form_submission` and `signup` are recorded by the server and rejected here.

Default:page_view
pagestring
required

Path of the page, 1 to 2048 characters. Only the pathname is stored; the query string and hash are dropped.

refererstring
optional

Referrer of the visit, up to 2048 characters. Stored as `Direct` when empty.

visitorIdstring
required

UUID that identifies the browser. Generate it once and keep it in `localStorage`.

sessionIdstring
required

UUID of the visit. Start a new one after 30 minutes without events.

utmobject
optional

Optional `{ source, medium, campaign, term, content }`, each a string of up to 200 characters or `null`.

eventDataobject
optional

Optional details of the event: up to 20 keys (names up to 64 characters), values are strings (up to 500 characters), numbers, booleans or `null`.

Responses

200Success
application/json

Errors

400Invalid event. The message names the field, for example `Invalid analytics event (visitorId): Invalid UUID`.
401Missing or invalid public key.
403The request's `Origin` is not one of the site's allowed origins.
429Too many events. Wait for the `Retry-After` header (seconds). The body is `{ message }`.

Notes

  • Sent by the Panda widgets; you rarely call it by hand. `<PandaAnalytics>` sends page views, and `window.panda.track(name, data)` sends custom events.
  • Success is `204 No Content`. The `X-Panda-Analytics` header says what happened: `tracked`, `visit-only`, `skipped-disabled` (the owner turned Analytics off), `skipped-preview`, `skipped-authenticated` or `skipped-anonymous`.
  • Nothing is stored for AI Builder previews, localhost, sample keys, or for dashboard users browsing the site.
  • Limit: 120 events per minute per visitor IP and site.
Request
curl --request POST \
  --url "https://api.pandaidx.com/v1/analytics/track?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"page":"/search","visitorId":"3f6b1c0e-7d2a-4b8e-9c41-5a2d8e7f1b60","sessionId":"a1d4e8f2-6c3b-4a57-8e90-2b7c5d1f3a64"}'
Response200 OK
{}