> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Find visitors by an identifier

> Send exactly one lookup parameter.

```ts TypeScript wrap theme={"dark"}
import { createSiteClient } from '@fetchski/attract-cms-sdk';

const site = createSiteClient();
const findVisitorAttributions = await site.visitorAttribution().findVisitorAttributions();
```

```json 200 wrap theme={"dark"}
{
  "matchedBy": "gclAu",
  "attributions": [
    {
      "visitorId": "0b8e6a4c-8d2f-4b6e-9a1c-3f5d7e9b1a2c",
      "firstTouch": {
        "at": "2026-09-20T09:12:00.000Z",
        "path": "/",
        "landingUrl": "https://example.com/?gclid=Cj0KCQjw&utm_source=google",
        "referrerOrigin": "https://www.google.com",
        "adPlatforms": [
          "google"
        ],
        "campaign": {
          "utm_source": "google",
          "utm_campaign": "spring-sale"
        },
        "clickIds": {
          "gclid": "Cj0KCQjw"
        }
      },
      "browserIds": {
        "_gcl_au": "1.1.1234567890.1790000000"
      },
      "marketing": true,
      "firstSeenAt": "2026-09-20T09:12:00.000Z",
      "lastSeenAt": "2026-09-21T15:04:05.000Z",
      "expiresAt": "2027-03-20T15:04:05.000Z"
    }
  ]
}
```

## In your app

A function makes the call on the client it is given, so your code passes the real one and a test passes a fake.

**1. Add the function**

```ts src/attract/find-visitor-attributions.ts theme={"dark"}
import type { SiteClient } from '@fetchski/attract-cms-sdk';

export async function findVisitorAttributions(site: SiteClient) {
  return site.visitorAttribution().findVisitorAttributions();
}
```

**2. Call it**

A script makes the client once and calls the function:

```ts scripts/find-visitor-attributions.ts theme={"dark"}
import { createSiteClient } from '@fetchski/attract-cms-sdk';
import { findVisitorAttributions } from '../src/attract/find-visitor-attributions.ts';

const site = createSiteClient();
console.log(await findVisitorAttributions(site));
```

```bash Terminal theme={"dark"}
node --env-file=.env scripts/find-visitor-attributions.ts
```

A route handler, a job or a queue worker calls it the same way.

Returns every matching record, most recently seen first (at most 20) — a `_gcl_au` can in rare cases belong to several visitor IDs (for example when one of the two cookies was cleared and the other was not).

`token` opens an `fk_at` attribution token — the value this site adds to links to its Linked domains (a booking site) — and returns nothing once it has expired (90 days) or if it was forged. Click IDs match the first or last touch. `emailSha256` / `phoneSha256` find the visitors whose conversion events carried that hash (see `UserDataHashes` for the normalization).

> [accordion] Optional parameters
>
> One object, e.g. `findVisitorAttributions({ token })`; leave out the optional fields.
>
> **token** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. An `fk_at` attribution token. At most 512 characters.
>
> **gclAu** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_gcl_au` cookie value (Google’s cross-site browser ID). At most 512 characters.
>
> **fbp** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_fbp` cookie value. At most 512 characters.
>
> **fbc** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_fbc` cookie value. At most 512 characters.
>
> **ttp** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_ttp` cookie value. At most 512 characters.
>
> **gclid** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Google click ID. At most 512 characters.
>
> **gbraid** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Google iOS app-campaign click ID. At most 512 characters.
>
> **wbraid** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Google iOS web-campaign click ID. At most 512 characters.
>
> **fbclid** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A Meta click ID. At most 512 characters.
>
> **ttclid** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. A TikTok click ID. At most 512 characters.
>
> **emailSha256** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. SHA-256 of the trimmed, lower-cased email. Matches `^[0-9a-f]{64}$`.
>
> **phoneSha256** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. SHA-256 of the E.164 phone number with its "+". Matches `^[0-9a-f]{64}$`.

> [accordion] Returns
>
> A `FindVisitorAttributionsResponse`. The matching records (possibly none). Read its properties (`findVisitorAttributions.matchedBy`): each says whether the site always sends it.
>
> **matchedBy** `string`
>
> **Always sent.** The lookup parameter used.
>
> **attributions** `readonly VisitorAttribution[]`
>
> **Always sent.** A list of `VisitorAttribution`. At most 20 items.
>
> **VisitorAttribution**
>
> One visitor’s attribution record. Kept for the site’s retention setting after the visitor’s last page view.
>
> **visitorId** `string`
>
> **Always sent.**
>
> **firstTouch** `AttributionTouch`
>
> **Always sent.** An `AttributionTouch`. One touch of a visitor’s journey on this site. Identifier values (`clickIds`, `linker`) appear only when the visitor allowed Marketing.
>
> **AttributionTouch**
>
> The visitor’s first visit on record; null when unknown.
>
> **at** `Date`
>
> **Sometimes sent:** `undefined` when the site leaves it out. When the page view happened. Format: an ISO 8601 date and time.
>
> **path** `string`
>
> **Sometimes sent:** `undefined` when the site leaves it out. The page’s path.
>
> **landingUrl** `string`
>
> **Sometimes sent:** `undefined` when the site leaves it out. The full landing URL. Without Marketing consent its identifier parameters are removed. Format: an absolute URL.
>
> **referrerOrigin** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Where the visitor came from; null for a direct visit.
>
> **adPlatforms** `readonly AdPlatforms[]`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Platforms whose ad click ID the URL carried — kept for every visitor, consent or not. Each one of `google`, `meta`, `tiktok`, `other`.
>
> **campaign** `Readonly\<Record\<string, string\>\>`
>
> **Sometimes sent:** `undefined` when the site leaves it out. UTM and campaign parameters (`utm_*`, `gad_source`, `gad_campaignid`, `srsltid`).
>
> **clickIds** `Readonly\<Record\<string, string\>\>`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Ad click IDs (`gclid`, `gbraid`, `wbraid`, `fbclid`, `ttclid`). Marketing only.
>
> **linker** `Readonly\<Record\<string, string\>\>`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Google’s cross-domain linker value (`_gl`). Marketing only.
>
> **marketing** `boolean`
>
> **Always sent.** Whether the visitor allowed Marketing on their latest page view.
>
> **firstSeenAt** `Date`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **lastSeenAt** `Date`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **expiresAt** `Date`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **lastTouch** `AttributionTouch`
>
> **Sometimes sent:** `undefined` when the site leaves it out. An `AttributionTouch`. One touch of a visitor’s journey on this site. Identifier values (`clickIds`, `linker`) appear only when the visitor allowed Marketing. Its fields are listed under the first `AttributionTouch` above.
>
> **browserIds** `Readonly\<Record\<string, string\>\>`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Ad-platform browser IDs (`_gcl_au` — the cross-site key — `_gcl_aw`, `_gcl_gb`, `_gcl_gs`, `_gcl_dc`, `_ga`, `_fbp`, `_fbc`, `_ttp`). Marketing only.

> [accordion] Errors
>
> Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below; catch only what you want to react to (see [Errors and testing](https://docs.fetchski-attract.com/typescript/errors.md)).
>
> **ValidationFailed** `400`
>
> The request is not valid. `data.errors` lists each problem with the `path` of the parameter or body field it concerns.
>
> **Retried first:** No. **Read:** `errors` (field → messages), `siteMessage`.
>
> **AuthenticationFailed** `401`
>
> The API key is missing, malformed, unknown, disabled, expired or archived (`invalid`), or a request that must be signed — by the route, or by the key’s own signing mode — has a missing, stale or wrong signature (an upload signs its SHA-256, declared in `X-Fetchski-Content-SHA256`, in the body’s place) (`unauthorized`).
>
> **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`.
>
> **Forbidden** `403`
>
> The API key lacks the scope this route needs (the message names it), or the key is used from an address outside its allowlist.
>
> **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`.
>
> **NotFound** `404`
>
> Nothing with this identifier — or the caller may not use the Data API at all (anonymous visitors and non-admin sessions get 404 so the API is not advertised). A write while conversion tracking is switched off also answers 404.
>
> **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`.
>
> **RateLimited** `429`
>
> The key used up its reads- or writes-per-minute limit (set per key; defaults 600 / 120). Still, after the client’s own waits and retries.
>
> **Retried first:** Yes: the client waits `Retry-After` (1 s when absent; over 60 s it gives up at once) and retries, up to `retries` times (2 by default). **Read:** `retryAfter` (seconds, or null), `siteMessage`.
>
> **SiteError** `5xx`
>
> The site failed (or something in front of it did). Its logs say why.
>
> **Retried first:** A 502, 503 or 504: yes, after 0.5 s then 1 s. A 500: no. **Read:** `siteMessage`, `errorName`, `data`.
>
> **SiteUnreachable** `no answer`
>
> No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).
>
> **Retried first:** Yes, after 0.5 s then 1 s. **Read:** `reason`, `neverConnected`.
>
> **RequestNotSent** `not sent`
>
> The client refused to send it (e.g. a path segment of `..`); the site never saw it.
>
> **Retried first:** No. **Read:** `reason` (what to change).
>
> **SiteRequestFailed** `any other`
>
> Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).
>
> **Retried first:** No. **Read:** `reason`, `status`.
>
> **UnknownSite** `setup`
>
> `sites.forSite('acme')` named a slug your sites (`createSiteClients()`) don’t have.
>
> **Retried first:** No: nothing was sent. **Read:** `message`, `slug`.
>
> **SiteConfigurationError** `setup`
>
> The client’s settings are wrong: no `FETCHSKI_ATTRACT_URL` (or `baseUrl`), or a malformed API key.
>
> **Retried first:** No: nothing was sent. **Read:** `message` (what to fix).

## Behavior

* **Access:** an API key with `attribution:read` — or its group master `ads:all`, or `admin:all` — or a signed-in user holding the `attribution:view` permission. Anonymous callers get 404.
* **Rate limit:** the key’s own reads-per-minute limit, set when the key is created (default 600); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out.
* **Retries:** a read is safe to repeat: the client retries it on no answer, a 502/503/504 and a 429.
* **Timeout:** 15 s per attempt by default; raise `timeout` (milliseconds) on the client for longer.

## Test it

It calls the function above with a fake client: the fake answers every call with a valid example, so nothing leaves your machine and no settings or key are needed. Run it with `node --test`.

```ts tests/visitorAttribution-findVisitorAttributions.test.ts theme={"dark"}
import { test } from 'node:test';
import { fakeSite } from '@fetchski/attract-cms-sdk/testing';
import { findVisitorAttributions } from '../src/attract/find-visitor-attributions.ts';

test('visitorAttribution.findVisitorAttributions', async () => {
  const site = fakeSite();
  await findVisitorAttributions(site);
  site.assertCalled('visitorAttribution.findVisitorAttributions');
});
```

**Answer with your own values:** fake `visitorAttribution.findVisitorAttributions` with `factories.FindVisitorAttributionsResponse({...})`, the fields you give over a valid example.

```ts tests/visitorAttribution-findVisitorAttributions-answer.test.ts theme={"dark"}
import assert from 'node:assert/strict';
import { test } from 'node:test';
import { factories, fakeSite } from '@fetchski/attract-cms-sdk/testing';

test('visitorAttribution.findVisitorAttributions answers your values', async () => {
  const site = fakeSite({
    'visitorAttribution.findVisitorAttributions': factories.FindVisitorAttributionsResponse({ matchedBy: 'Your value' })
  });
  const findVisitorAttributions = await site.visitorAttribution().findVisitorAttributions();
  assert.equal(findVisitorAttributions.matchedBy, 'Your value');
});
```

## Related

> [card] [Get one visitor’s attribution](https://docs.fetchski-attract.com/typescript/reference/visitor-attribution/get-visitor-attribution.md)
>
> `site.visitorAttribution().getVisitorAttribution()`

> [card] [GET /visitor-attribution](https://docs.fetchski-attract.com/api-reference/visitor-attribution/find-visitors-by-an-identifier.md)
>
> The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.