> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Find visitors by an identifier

> Send exactly one lookup parameter.

```php Laravel wrap theme={"dark"}
use Fetchski\AttractCmsLaravel\Facades\Attract;

$findVisitorAttributions = Attract::visitorAttribution()->findVisitorAttributions();
```

```json 200 wrap theme={"dark"}
{
  "matchedBy": "gclAu",
  "attributions": [
    {
      "visitorId": "0b8e6a4c-8d2f-4b6e-9a1c-3f5d7e9b1a2c",
      "firstTouch": {
        "at": "2026-09-20T09:12:00.000Z",
        "path": "/",
        "landingUrl": "https://example.com/?gclid=Cj0KCQjw&utm_source=google",
        "referrerOrigin": "https://www.google.com",
        "adPlatforms": [
          "google"
        ],
        "campaign": {
          "utm_source": "google",
          "utm_campaign": "spring-sale"
        },
        "clickIds": {
          "gclid": "Cj0KCQjw"
        }
      },
      "browserIds": {
        "_gcl_au": "1.1.1234567890.1790000000"
      },
      "marketing": true,
      "firstSeenAt": "2026-09-20T09:12:00.000Z",
      "lastSeenAt": "2026-09-21T15:04:05.000Z",
      "expiresAt": "2027-03-20T15:04:05.000Z"
    }
  ]
}
```

## In your app

A controller answers a route on your app: it calls `findVisitorAttributions()` and returns the answer.

**1. Add the controller**

```php app/Http/Controllers/FindVisitorAttributionsController.php theme={"dark"}
<?php

declare(strict_types=1);

namespace App\Http\Controllers;

use Fetchski\AttractCmsLaravel\Data\FindVisitorAttributionsResponse;
use Fetchski\AttractCmsLaravel\Facades\Attract;

final class FindVisitorAttributionsController
{
    public function __invoke(): FindVisitorAttributionsResponse
    {
        return Attract::visitorAttribution()->findVisitorAttributions();
    }
}
```

**2. Add the route**

```php routes/web.php theme={"dark"}
use App\Http\Controllers\FindVisitorAttributionsController;
use Illuminate\Support\Facades\Route;

Route::get('/visitor-attribution', FindVisitorAttributionsController::class);
```

**3. Call it**

```bash Terminal theme={"dark"}
curl http://localhost:8000/visitor-attribution
```

With `php artisan serve` running, it prints its answer as JSON.

> [!TIP]
>
> To keep the call in an Action instead, this writes `app/Actions/Attract/FindVisitorAttributions.php` (an invokable Action that calls `findVisitorAttributions()`) and its test under `tests/Feature/Actions/Attract/` (Pest when your app has it):
>
> ```bash Terminal theme={"dark"}
> php artisan make:attract-action visitorAttribution.findVisitorAttributions
> ```

## Call it from the terminal

```bash Terminal theme={"dark"}
php artisan attract:call visitorAttribution.findVisitorAttributions
```

It calls `findVisitorAttributions()` on your default site and prints its answer as JSON. See [Call any method from the terminal](https://docs.fetchski-attract.com/call-command.md) for every argument type.

Returns every matching record, most recently seen first (at most 20) — a `_gcl_au` can in rare cases belong to several visitor IDs (for example when one of the two cookies was cleared and the other was not).

`token` opens an `fk_at` attribution token — the value this site adds to links to its Linked domains (a booking site) — and returns nothing once it has expired (90 days) or if it was forged. Click IDs match the first or last touch. `emailSha256` / `phoneSha256` find the visitors whose conversion events carried that hash (see `UserDataHashes` for the normalization).

> [accordion] Optional parameters
>
> Named arguments, e.g. `findVisitorAttributions(token: …)`; leave out the optional ones.
>
> **token** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. An `fk_at` attribution token. At most 512 characters.
>
> **gclAu** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_gcl_au` cookie value (Google’s cross-site browser ID). At most 512 characters.
>
> **fbp** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_fbp` cookie value. At most 512 characters.
>
> **fbc** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_fbc` cookie value. At most 512 characters.
>
> **ttp** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_ttp` cookie value. At most 512 characters.
>
> **gclid** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Google click ID. At most 512 characters.
>
> **gbraid** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Google iOS app-campaign click ID. At most 512 characters.
>
> **wbraid** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Google iOS web-campaign click ID. At most 512 characters.
>
> **fbclid** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Meta click ID. At most 512 characters.
>
> **ttclid** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A TikTok click ID. At most 512 characters.
>
> **emailSha256** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. SHA-256 of the trimmed, lower-cased email. Matches `^[0-9a-f]{64}$`.
>
> **phoneSha256** `?string`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. SHA-256 of the E.164 phone number with its "+". Matches `^[0-9a-f]{64}$`.

> [accordion] Returns
>
> A `FindVisitorAttributionsResponse` (`Fetchski\AttractCmsLaravel\Data\FindVisitorAttributionsResponse`). The matching records (possibly none). Read its properties (`$findVisitorAttributions->matchedBy`): each says whether the site always sends it.
>
> **matchedBy** `string`
>
> **Always sent.** The lookup parameter used.
>
> **attributions** `Collection\<int, VisitorAttribution\>`
>
> **Always sent.** A list of `VisitorAttribution`. At most 20 items.
>
> **VisitorAttribution (Fetchski\AttractCmsLaravel\Data\VisitorAttribution)**
>
> One visitor’s attribution record. Kept for the site’s retention setting after the visitor’s last page view.
>
> **visitorId** `string`
>
> **Always sent.**
>
> **firstTouch** `AttributionTouch`
>
> **Always sent.** An `AttributionTouch`. One touch of a visitor’s journey on this site. Identifier values (`clickIds`, `linker`) appear only when the visitor allowed Marketing.
>
> **AttributionTouch (Fetchski\AttractCmsLaravel\Data\AttributionTouch)**
>
> The visitor’s first visit on record; null when unknown.
>
> **at** `?CarbonImmutable`
>
> **Sometimes sent:** `null` when the site leaves it out. When the page view happened. Format: an ISO 8601 date and time.
>
> **path** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The page’s path.
>
> **landingUrl** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. The full landing URL. Without Marketing consent its identifier parameters are removed. Format: an absolute URL.
>
> **referrerOrigin** `?string`
>
> **Sometimes sent:** `null` when the site leaves it out. Where the visitor came from; null for a direct visit.
>
> **adPlatforms** `Collection\<int, Enums\\AdPlatforms|string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. Platforms whose ad click ID the URL carried — kept for every visitor, consent or not. Each one of `google`, `meta`, `tiktok`, `other`.
>
> **campaign** `array\<string, string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. UTM and campaign parameters (`utm_*`, `gad_source`, `gad_campaignid`, `srsltid`).
>
> **clickIds** `array\<string, string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. Ad click IDs (`gclid`, `gbraid`, `wbraid`, `fbclid`, `ttclid`). Marketing only.
>
> **linker** `array\<string, string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. Google’s cross-domain linker value (`_gl`). Marketing only.
>
> **marketing** `bool`
>
> **Always sent.** Whether the visitor allowed Marketing on their latest page view.
>
> **firstSeenAt** `CarbonImmutable`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **lastSeenAt** `CarbonImmutable`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **expiresAt** `CarbonImmutable`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **lastTouch** `?AttributionTouch`
>
> **Sometimes sent:** `null` when the site leaves it out. An `AttributionTouch`. One touch of a visitor’s journey on this site. Identifier values (`clickIds`, `linker`) appear only when the visitor allowed Marketing. Its fields are listed under the first `AttributionTouch` above.
>
> **browserIds** `array\<string, string\>|null`
>
> **Sometimes sent:** `null` when the site leaves it out. Ad-platform browser IDs (`_gcl_au` — the cross-site key — `_gcl_aw`, `_gcl_gb`, `_gcl_gs`, `_gcl_dc`, `_ga`, `_fbp`, `_fbc`, `_ttp`). Marketing only.

> [accordion] Errors
>
> Nothing to catch: the SDK retries what is safe, and Laravel logs and renders the rest (see [Errors and testing](https://docs.fetchski-attract.com/laravel/errors.md)).
>
> **ValidationFailed** `400`
>
> The request is not valid. `data.errors` lists each problem with the `path` of the parameter or body field it concerns.
>
> **Retried first:** No. **Read:** `errors()` (field → messages), `siteMessage()`.
>
> **AuthenticationFailed** `401`
>
> The API key is missing, malformed, unknown, disabled, expired or archived (`invalid`), or a request that must be signed — by the route, or by the key’s own signing mode — has a missing, stale or wrong signature (an upload signs its SHA-256, declared in `X-Fetchski-Content-SHA256`, in the body’s place) (`unauthorized`).
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **Forbidden** `403`
>
> The API key lacks the scope this route needs (the message names it), or the key is used from an address outside its allowlist.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **NotFound** `404`
>
> Nothing with this identifier — or the caller may not use the Data API at all (anonymous visitors and non-admin sessions get 404 so the API is not advertised). A write while conversion tracking is switched off also answers 404.
>
> **Retried first:** No. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **RateLimited** `429`
>
> The key used up its reads- or writes-per-minute limit (set per key; defaults 600 / 120). Still, after the client’s own waits and retries.
>
> **Retried first:** Yes: the client waits `Retry-After` (1 s when absent; over 60 s it gives up at once) and retries, up to `retries` times (2 by default). **Read:** `retryAfter()` (seconds, or null), `siteMessage()`.
>
> **SiteError** `5xx`
>
> The site failed (or something in front of it did). Its logs say why.
>
> **Retried first:** A 502, 503 or 504: yes, after 0.5 s then 1 s. A 500: no. **Read:** `siteMessage()`, `errorName()`, `data()`.
>
> **SiteUnreachable** `no answer`
>
> No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).
>
> **Retried first:** Yes, after 0.5 s then 1 s. **Read:** `reason()`, `neverConnected()`.
>
> **RequestNotSent** `not sent`
>
> The client refused to send it (e.g. a path segment of `..`); the site never saw it.
>
> **Retried first:** No. **Read:** `reason()` (what to change).
>
> **SiteRequestFailed** `any other`
>
> Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).
>
> **Retried first:** No. **Read:** `reason()`, `status()`.
>
> **UnknownSite** `setup`
>
> `Attract::site('acme')` named a slug that isn’t under `sites` in `config/fetchski-attract.php`.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()`, `$e->slug`.
>
> **SiteConfigurationError** `setup`
>
> The site’s config entry is wrong: no `url`, a malformed `api_key`, a key filed under another slug, or no default site.
>
> **Retried first:** No: nothing was sent. **Read:** `getMessage()` (what to fix).

## Behavior

* **Access:** an API key with `attribution:read` — or its group master `ads:all`, or `admin:all` — or a signed-in user holding the `attribution:view` permission. Anonymous callers get 404.
* **Rate limit:** the key’s own reads-per-minute limit, set when the key is created (default 600); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out.
* **Retries:** a read is safe to repeat: the client retries it on no answer, a 502/503/504 and a 429.
* **Timeout:** 15 s per attempt by default; raise `timeout` in `config/fetchski-attract.php` for longer.

## Test it

It calls the route above with the SDK faked: the fake answers every call with a valid example, so nothing leaves your machine and no config or key is needed. Save it as `tests/Feature/FindVisitorAttributionsTest.php`, then run your tests:

```php tests/Feature/FindVisitorAttributionsTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class FindVisitorAttributionsTest extends TestCase
{
    public function test_find_visitor_attributions(): void
    {
        Attract::fake();

        $this->getJson('/visitor-attribution')->assertOk();

        Attract::assertCalled('visitorAttribution.findVisitorAttributions');
    }
}
```

```bash Terminal theme={"dark"}
php artisan test
```

**Answer with your own values:** fake `visitorAttribution.findVisitorAttributions` with `FindVisitorAttributionsResponse::factory()->make([...])`, the fields you give over a valid example.

```php tests/Feature/FindVisitorAttributionsAnswerTest.php theme={"dark"}
<?php

declare(strict_types=1);

namespace Tests\Feature;

use Fetchski\AttractCmsLaravel\Data\FindVisitorAttributionsResponse;
use Fetchski\AttractCmsLaravel\Facades\Attract;
use Tests\TestCase;

final class FindVisitorAttributionsAnswerTest extends TestCase
{
    public function test_find_visitor_attributions_answers_your_values(): void
    {
        Attract::fake([
            'visitorAttribution.findVisitorAttributions' => FindVisitorAttributionsResponse::factory()->make(['matchedBy' => 'Your value']),
        ]);

        $findVisitorAttributions = Attract::visitorAttribution()->findVisitorAttributions();

        $this->assertSame('Your value', $findVisitorAttributions->matchedBy);
    }
}
```

## Related

> [card] [Get one visitor’s attribution](https://docs.fetchski-attract.com/laravel/reference/visitor-attribution/get-visitor-attribution.md)
>
> `Attract::visitorAttribution()->getVisitorAttribution()`

> [card] [GET /visitor-attribution](https://docs.fetchski-attract.com/api-reference/visitor-attribution/find-visitors-by-an-identifier.md)
>
> The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.