POST /api/v1/behavior

The last thing sent, as the visitor leaves.

POST /api/v1/behavior

The problem it solves#

The behaviour collector holds its event window in memory and attaches it to the collect that was going out anyway. But when the visitor leaves, that window dies with the document, and before this endpoint, every stored visit ended with the visitor still on the page.

It is not a gate#

Transport detail#

Sent with keepalive and content-type: text/plain. Not a JSON content type, deliberately: a JSON content type preflights, and a preflight racing an unload is the one thing this avoids.

Authentication#

The presenceToken from the collect reply, plus the visit id. The site and visitor are read out of the token's MAC, never out of the body.

The reply is signed#

It is signed as its own kind of message, under the label hideguard-behavior-ack-ed25519-v2.

The separate label matters because the two message kinds share a key, a kid format, a timestamp and the whole signature syntax. Without it, a captured accepted: true could be offered where a verdict was expected.

When verifying, documentId and batchId must be passed in by you and compared. A reply that names its own batch acknowledges nothing.

What has no departure#

Anything page JavaScript cannot see before the fact: location.href = …, form.submit(), the back button, a typed URL, an HTTP redirect. That gap is stated rather than papered over.

The destination is host plus pathname only#

No query string, no fragment. That is where a page keeps its tokens and its order ids.