Find visitors by an identifier

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const findVisitorAttributions = await site.visitorAttribution().findVisitorAttributions()

{
  "matchedBy": "gclAu",
  "attributions": [
    {
      "visitorId": "0b8e6a4c-8d2f-4b6e-9a1c-3f5d7e9b1a2c",
      "firstTouch": {
        "at": "2026-09-20T09:12:00.000Z",
        "path": "/",
        "landingUrl": "https://example.com/?gclid=Cj0KCQjw&utm_source=google",
        "referrerOrigin": "https://www.google.com",
        "adPlatforms": [
          "google"
        ],
        "campaign": {
          "utm_source": "google",
          "utm_campaign": "spring-sale"
        },
        "clickIds": {
          "gclid": "Cj0KCQjw"
        }
      },
      "browserIds": {
        "_gcl_au": "1.1.1234567890.1790000000"
      },
      "marketing": true,
      "firstSeenAt": "2026-09-20T09:12:00.000Z",
      "lastSeenAt": "2026-09-21T15:04:05.000Z",
      "expiresAt": "2027-03-20T15:04:05.000Z"
    }
  ]
}

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const findVisitorAttributions = await site.visitorAttribution().findVisitorAttributions()

{
  "matchedBy": "gclAu",
  "attributions": [
    {
      "visitorId": "0b8e6a4c-8d2f-4b6e-9a1c-3f5d7e9b1a2c",
      "firstTouch": {
        "at": "2026-09-20T09:12:00.000Z",
        "path": "/",
        "landingUrl": "https://example.com/?gclid=Cj0KCQjw&utm_source=google",
        "referrerOrigin": "https://www.google.com",
        "adPlatforms": [
          "google"
        ],
        "campaign": {
          "utm_source": "google",
          "utm_campaign": "spring-sale"
        },
        "clickIds": {
          "gclid": "Cj0KCQjw"
        }
      },
      "browserIds": {
        "_gcl_au": "1.1.1234567890.1790000000"
      },
      "marketing": true,
      "firstSeenAt": "2026-09-20T09:12:00.000Z",
      "lastSeenAt": "2026-09-21T15:04:05.000Z",
      "expiresAt": "2027-03-20T15:04:05.000Z"
    }
  ]
}

In your app

A controller answers a route on your app: it calls findVisitorAttributions() and returns the answer.

Add the controller

app/controllers/find_visitor_attributions_controller.ts

import { inject } from '@adonisjs/core'
import { SiteClient } from '@fetchski/attract-cms-sdk'

@inject()
export default class FindVisitorAttributionsController {
  constructor(protected site: SiteClient) {}

  async handle() {
    return this.site.visitorAttribution().findVisitorAttributions()
  }
}

Add the route

start/routes.ts

import router from '@adonisjs/core/services/router'

const FindVisitorAttributionsController = () => import('#controllers/find_visitor_attributions_controller')

router.get('/visitor-attribution', [FindVisitorAttributionsController])

Call it

Terminal

curl http://localhost:3333/visitor-attribution

With node ace serve running, it prints its answer as JSON.

Returns every matching record, most recently seen first (at most 20) — a _gcl_au can in rare cases belong to several visitor IDs (for example when one of the two cookies was cleared and the other was not). token opens an fk_at attribution token — the value this site adds to links to its Linked domains (a booking site) — and returns nothing once it has expired (90 days) or if it was forged. Click IDs match the first or last touch. emailSha256 / phoneSha256 find the visitors whose conversion events carried that hash (see UserDataHashes for the normalization).

Optional parameters

One object, e.g. findVisitorAttributions({ token }); leave out the optional fields.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. An fk_at attribution token. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The _gcl_au cookie value (Google’s cross-site browser ID). At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The _fbp cookie value. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The _fbc cookie value. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. The _ttp cookie value. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. A Google click ID. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. A Google iOS app-campaign click ID. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. A Google iOS web-campaign click ID. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. A Meta click ID. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. A TikTok click ID. At most 512 characters.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. SHA-256 of the trimmed, lower-cased email. Matches ^[0-9a-f]{64}$.

string | null | undefined

Optional. Leave it out (or pass null) and it isn’t sent: the site’s default applies. SHA-256 of the E.164 phone number with its ”+”. Matches ^[0-9a-f]{64}$.

Returns

A FindVisitorAttributionsResponse. The matching records (possibly none). Read its properties (findVisitorAttributions.matchedBy): each says whether the site always sends it.

string

Always sent. The lookup parameter used.

readonly VisitorAttribution[]

Always sent. A list of VisitorAttribution. At most 20 items.

Show VisitorAttribution

One visitor’s attribution record. Kept for the site’s retention setting after the visitor’s last page view.

string

Always sent.

AttributionTouch

Always sent. An AttributionTouch. One touch of a visitor’s journey on this site. Identifier values (clickIds, linker) appear only when the visitor allowed Marketing.

Show AttributionTouch

The visitor’s first visit on record; null when unknown.

Date

Sometimes sent: undefined when the site leaves it out. When the page view happened. Format: an ISO 8601 date and time.

string

Sometimes sent: undefined when the site leaves it out. The page’s path.

string

Sometimes sent: undefined when the site leaves it out. The full landing URL. Without Marketing consent its identifier parameters are removed. Format: an absolute URL.

string | null

Sometimes sent: undefined when the site leaves it out, and it can be null. Where the visitor came from; null for a direct visit.

readonly AdPlatforms[]

Sometimes sent: undefined when the site leaves it out. Platforms whose ad click ID the URL carried — kept for every visitor, consent or not. Each one of google, meta, tiktok, other.

Readonly<Record<string, string>>

Sometimes sent: undefined when the site leaves it out. UTM and campaign parameters (utm_*, gad_source, gad_campaignid, srsltid).

Readonly<Record<string, string>>

Sometimes sent: undefined when the site leaves it out. Ad click IDs (gclid, gbraid, wbraid, fbclid, ttclid). Marketing only.

Readonly<Record<string, string>>

Sometimes sent: undefined when the site leaves it out. Google’s cross-domain linker value (_gl). Marketing only.

boolean

Always sent. Whether the visitor allowed Marketing on their latest page view.

Date

Always sent. Format: an ISO 8601 date and time.

Date

Always sent. Format: an ISO 8601 date and time.

Date

Always sent. Format: an ISO 8601 date and time.

AttributionTouch

Sometimes sent: undefined when the site leaves it out. An AttributionTouch. One touch of a visitor’s journey on this site. Identifier values (clickIds, linker) appear only when the visitor allowed Marketing. Its fields are listed under the first AttributionTouch above.

Readonly<Record<string, string>>

Sometimes sent: undefined when the site leaves it out. Ad-platform browser IDs (_gcl_au — the cross-site key — _gcl_aw, _gcl_gb, _gcl_gs, _gcl_dc, _ga, _fbp, _fbc, _ttp). Marketing only.

Errors

Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below. Your exception handler turns them into your app’s own answers, once for every call (see Map SDK errors to responses); catch only what you want to react to here.

400

The request is not valid. data.errors lists each problem with the path of the parameter or body field it concerns.Retried first: No. Read: errors (field → messages), siteMessage.

401

The API key is missing, malformed, unknown, disabled, expired or archived (invalid), or a request that must be signed — by the route, or by the key’s own signing mode — has a missing, stale or wrong signature (an upload signs its SHA-256, declared in X-Fetchski-Content-SHA256, in the body’s place) (unauthorized).Retried first: No. Read: siteMessage, errorName, data.

403

The API key lacks the scope this route needs (the message names it), or the key is used from an address outside its allowlist.Retried first: No. Read: siteMessage, errorName, data.

404

Nothing with this identifier — or the caller may not use the Data API at all (anonymous visitors and non-admin sessions get 404 so the API is not advertised). A write while conversion tracking is switched off also answers 404.Retried first: No. Read: siteMessage, errorName, data.

429

The key used up its reads- or writes-per-minute limit (set per key; defaults 600 / 120). Still, after the client’s own waits and retries.Retried first: Yes: the client waits Retry-After (1 s when absent; over 60 s it gives up at once) and retries, up to retries times (2 by default). Read: retryAfter (seconds, or null), siteMessage.

5xx

The site failed (or something in front of it did). Its logs say why.Retried first: A 502, 503 or 504: yes, after 0.5 s then 1 s. A 500: no. Read: siteMessage, errorName, data.

no answer

No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).Retried first: Yes, after 0.5 s then 1 s. Read: reason, neverConnected.

not sent

The client refused to send it (e.g. a path segment of ..); the site never saw it.Retried first: No. Read: reason (what to change).

any other

Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).Retried first: No. Read: reason, status.

setup

sites.forSite('acme') named a slug config/attract.ts doesn’t list (with the keys in the database: no row in attract_api_keys).Retried first: No: nothing was sent. Read: message, slug.

setup

The site’s entry is wrong: a malformed baseUrl or key, a key filed under another slug, or no default site. node ace attract:check names the fix.Retried first: No: nothing was sent. Read: message (what to fix).

Behavior

Access: an API key with attribution:read — or its group master ads:all, or admin:all — or a signed-in user holding the attribution:view permission. Anonymous callers get 404.
Rate limit: the key’s own reads-per-minute limit, set when the key is created (default 600); over it, 429 with Retry-After. The client waits and retries for you; you see RateLimited only if that runs out.
Retries: a read is safe to repeat: the client retries it on no answer, a 502/503/504 and a 429.
Timeout: 15 s per attempt by default; raise timeout (milliseconds) in config/attract.ts for longer.

Test it

It calls the controller above with the SDK faked: fakeAttract() puts the fake in the container for this one test, and it answers every call with a valid example, so nothing leaves your machine and no key is read. Save it as tests/unit/visitor_attribution_find_visitor_attributions.spec.ts, then run your tests:

tests/unit/visitor_attribution_find_visitor_attributions.spec.ts

import { test } from '@japa/runner'
import app from '@adonisjs/core/services/app'
import { fakeAttract } from '@fetchski/attract-cms-adonis/testing'
import FindVisitorAttributionsController from '#controllers/find_visitor_attributions_controller'

test('visitorAttribution.findVisitorAttributions', async () => {
  const site = fakeAttract()

  const controller = await app.container.make(FindVisitorAttributionsController)
  await controller.handle()

  site.assertCalled('visitorAttribution.findVisitorAttributions')
})

Terminal

node ace test

Answer with your own values: fake visitorAttribution.findVisitorAttributions with factories.FindVisitorAttributionsResponse({...}), the fields you give over a valid example.

tests/unit/visitor_attribution_find_visitor_attributions_answers.spec.ts

import { test } from '@japa/runner'
import { factories, fakeAttract } from '@fetchski/attract-cms-adonis/testing'

test('visitorAttribution.findVisitorAttributions answers your values', async ({ assert }) => {
  const site = fakeAttract({
    'visitorAttribution.findVisitorAttributions': factories.FindVisitorAttributionsResponse({ matchedBy: 'Your value' }),
  })

  const findVisitorAttributions = await site.visitorAttribution().findVisitorAttributions()
  assert.containSubset(findVisitorAttributions, { matchedBy: 'Your value' })
})

Get one visitor’s attribution

site.visitorAttribution().getVisitorAttribution()

GET /visitor-attribution

The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.

import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const findVisitorAttributions = await site.visitorAttribution().findVisitorAttributions()

{
  "matchedBy": "gclAu",
  "attributions": [
    {
      "visitorId": "0b8e6a4c-8d2f-4b6e-9a1c-3f5d7e9b1a2c",
      "firstTouch": {
        "at": "2026-09-20T09:12:00.000Z",
        "path": "/",
        "landingUrl": "https://example.com/?gclid=Cj0KCQjw&utm_source=google",
        "referrerOrigin": "https://www.google.com",
        "adPlatforms": [
          "google"
        ],
        "campaign": {
          "utm_source": "google",
          "utm_campaign": "spring-sale"
        },
        "clickIds": {
          "gclid": "Cj0KCQjw"
        }
      },
      "browserIds": {
        "_gcl_au": "1.1.1234567890.1790000000"
      },
      "marketing": true,
      "firstSeenAt": "2026-09-20T09:12:00.000Z",
      "lastSeenAt": "2026-09-21T15:04:05.000Z",
      "expiresAt": "2027-03-20T15:04:05.000Z"
    }
  ]
}

Get started

Using the SDK

Going further

Pages & Site

Content

Media

Forms

Ads & Conversions

Analytics

In your app

Behavior

Test it

Get one visitor’s attribution

GET /visitor-attribution

In your app

Behavior

Test it

Related

Get one visitor’s attribution

GET /visitor-attribution