API reference
The routes an integrator needs: the tag and the server-to-server postback. Parameters, limits and responses.
This reference covers what the client integrates. The tag also uses internal routes to fetch the campaign configuration and record events — those are called automatically and nobody has to implement them. Their specification is provided under contract when there is a formal technical review.
Base#
https://bridge.moclick.com.br
| Method | Route | Auth | Used for |
|---|---|---|---|
GET | /moclick-{slug}.js | Public | The global tag |
GET | /wp-json/moclick/v1/postback | Token | Server-to-server conversion |
GET /moclick-{slug}.js#
The global tag, with the campaign already identified.
| Response header | Value |
|---|---|
Content-Type | application/javascript; charset=utf-8 |
Cache-Control | public, max-age=300, must-revalidate |
ETag | Varies by content and by campaign |
Access-Control-Allow-Origin | * |
Returns 304 Not Modified when If-None-Match matches. There is
also /moclick.js, with no campaign baked in, for anyone declaring the
configuration by hand — see
subdomain and cross-domain.
GET /wp-json/moclick/v1/postback#
Server-to-server conversion recording, authenticated by the campaign token. The full implementation guide, with examples in four languages and a retry policy, is in Postback S2S.
Parameters#
| Parameter | Required | Limit | Description |
|---|---|---|---|
slug | Yes | — | Campaign identifier. |
token | Yes | — | Campaign token. |
click_id | Yes | 100 | Click identifier. Without it nothing is recorded. |
txid | Recommended | 100 | Transaction identifier. Deduplication key. |
value | Recommended | 2 decimal places | Value. A non-numeric value is stored as null. |
Responses#
| Code | Body | Meaning |
|---|---|---|
200 |
OK as text/plain |
Received. Includes duplicates, which are a success by design. |
403 |
{"error":"invalid_token"} |
Invalid token, missing token or non-existent campaign. |
The token is compared in constant time, and all three failure cases produce an identical response — the response never reveals which campaigns exist.
Sanitization and limits#
Applied on input to any event record. Relevant both for integrators and for security review:
| Field | Handling | Limit |
|---|---|---|
| Click and transaction identifiers | Sanitized text, truncated | 100 characters |
| Source and session identifiers | Sanitized text, truncated | 190 characters |
| Referrer | Validated as a URL, truncated | 500 characters |
| Campaign parameters | Filtered through an allowlist and re-encoded | 190 characters per value |
| Conversion value | Converted to decimal, or null | 2 decimal places |
| User agent | Sanitized text, truncated | 255 characters |
A value over the limit is truncated, not rejected — the request goes through and is recorded. This matters for the click identifier: if your platform generates identifiers longer than 100 characters, the value is cut and may no longer match the original on a retry. Check the length before integrating.
Response policy#
The recording routes are silent by design: they respond normally without writing when the campaign does not exist, when the click identifier is missing, when the campaign does not use Moclick’s own measurement, when the source is identified as a bot, or when the event is a duplicate.
The practical consequence for integrators: do not use the response code as confirmation of a write. Confirm in the results dashboard.
CORS#
The public routes are called from the visitor’s browser and respond with
Access-Control-Allow-Origin: * and Cache-Control: no-store.
No credentials are accepted or sent on these calls, and no sensitive data is exposed
through them — in particular, the postback token never appears in any API response.