Authentication
Authorization: Bearer kp_live_..., with a key generated in API keys. An
invalid or revoked key returns 401 without saying which — telling the
difference would confirm a key existed to whoever has the wrong one.
Body
Accepts an object or an array of up to 500 events.string
The customer’s id in your billing —
cus_... on Stripe and Asaas, cust_...
on AbacatePay. Preferred: it is what makes the match exact.string
deprecated
The old name for the same field, from when only Stripe existed. It still works
and will keep working: breaking whoever already integrated would cost more
than the wrong name. When both arrive,
customerId wins.string
The user’s email. Used as the key when there is no
customerId, and as a
human label in the alert when there is.string
ISO 8601. Assumes now when absent. Rejected if it is more than five minutes in
the future, or more than 90 days in the past.
string
Optional, for you to deduplicate on your side. Not required.
At least one of
customerId and email is required. Without an identifier
there is nothing to match, and the event is discarded.Response
accepted counts events used, skipped the ones discarded for a missing
identifier or a date outside the window, and days how many counter rows were
touched. One invalid item does not bring down the batch.
What happens to what you send
We do not store the event. What arrives is summed into a counter per account and per day, and it is that number we compare week over week. We do not receive content, screens visited, IP address, or any browser identifier — the call comes from your server, not from your users’ browsers.A resend counts twice, and that is fine: the drop threshold compares two weeks
against each other, so uniform excess cancels out in the ratio.