A valid request URL is required to generate request examples{
"accepted": 1,
"rejected": []
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Track analytics events
The analytics ingestion door: a batch of up to 100 events (256 KiB), from your own pages, in boot’s shape — the publishable key travels in the body and the key’s allowed-origins list is the gate.
202 means accepted, never durable. Events are buffered in process memory and flushed within seconds; a crash between the two loses what was accepted and unflushed. That is a documented trade made for analytics events only — a fact your product cannot afford to lose belongs on your backend, not here.
Validation is per event: a bad line is reported in rejected with its index and a code, and never fails the batch — an offline buffer replaying a hundred events must not lose ninety-nine to one stale timestamp. The line codes: invalid_id (not a UUID), reserved_name (the $ prefix is the platform’s namespace — $auth.* events are written by UserKit itself), invalid_name (fails ^[a-z0-9_.:-]{1,64}$), properties_too_large (over 8 KiB), invalid_properties (not a JSON object), invalid_occurred_at (missing or not RFC 3339), occurred_at_out_of_range (more than 7 days past or 5 minutes future).
An optional Authorization: Bearer uk_ct_… session attributes the batch to its contact. The token names, never gates: a body contact_id is ignored — an event naming somebody is an assertion only a session can make — and a token that no longer resolves demotes the batch to anonymous rather than refusing it.
Every event is minted with a client-side UUID, which is what makes retrying a batch safe: a replay of events that already landed writes nothing.
Rate limited to 600 requests per minute per IP, and 6000 per minute per environment.
A valid request URL is required to generate request examples{
"accepted": 1,
"rejected": []
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}