Server postback
POST/v1/conversions
When to use it
Use a postback for an order your server confirms later: a payment webhook, a phone order, a CRM stage. Your page keeps the dw_sid from the landing address, in your own session or in the _dw_sid cookie the pixel sets, and hands it over when it creates the order. It needs a plan with conversion tracking.
Authenticate with the site’s postback secret (Authorization: Bearer dwps_…, shown once when you create or rotate it) or with an API key that has the conversions:write scope.
Request body
clickIdstringrequiredThe dw_sid value from the landing address, exactly as it came.eventstringrequiredThe event name: one of purchase, lead, signup, or a goal you made. Lower case letters, digits and underscores.valuenumberoptionalThe amount, as a number. A refund is a negative amount.currencystringoptionalAn ISO 4217 code such as USD. Required when there is a value. Amounts are never converted between currencies.orderIdstringoptionalYour order number, up to 64 characters. Sending the same one again is ignored.occurredAtstringoptionalWhen it happened, as an ISO 8601 time. Now when absent. It must fall inside the attribution window.metadataobjectoptionalUp to 10 short text values. A key or value that looks like personal data is refused.Send it
examplePOST /v1/conversions
curl -X POST https://api.dotwick.com/v1/conversions \ -H "Authorization: Bearer dwps_YOUR_POSTBACK_SECRET" \ -H "Content-Type: application/json" \ -d '{ "clickId": "v1.k3m9x2q7c4v1b6n8.a1b2c3d4e5f6.ffk.Hk2LmN0pQ4r", "event": "purchase", "value": 49.5, "currency": "USD", "orderId": "ORD-1001" }'Response
The call answers before the conversion is attributed. The rest happens in the background: a click id that belongs to another workspace is refused, one outside the window is kept as unattributed, and a repeat of the same orderId is ignored.
202 Accepted
{ "status": "queued"}Errors
400validation_failedA malformed click id, a value without a currency, an unknown field, or metadata with personal data.401unauthorizedThe postback secret or the API key is unknown.403feature_not_in_planThe workspace’s plan does not include conversion tracking.429rate_limitedToo many requests; wait for Retry-After.No personal data
- The body is strict: a field that is not listed above, an email address or a phone number among them, makes the whole request fail.
- Metadata keys such as email, phone, name and address are refused, and so is a value that looks like an email address or a phone number.