HideGuardDocumentation

Reference · Server API

POST /api/v1/collect

What the SDK posts. You rarely call this yourself.

Where the SDK posts its measurements. You rarely call this yourself.

POST /api/v1/collect

Who calls it#

The browser SDK, automatically. It sends the site's public key in the body rather than a header, so the CORS preflight only has to allow content-type.

The reply#

{
  "requestId": "...",
  "visitorId": "...",
  "verdict": "allow",
  "score": 0,
  "reasons": [],
  "siteId": "...",
  "environment": "production",
  "presenceToken": "...",
  "signature": { "kid": "hg_...", "timestamp": 1770000000, "value": "..." }
}

presenceToken is what the heartbeat and the departure flush authenticate with. The site and visitor are read out of the token's MAC, never out of a request body.

The signature#

The reply is signed so your backend can tell it from one the visitor wrote. See Verifying replies.

With no signing key configured, the reply carries no signature field at all. It never carries one that looks signed but is empty.

Limits#

The origin must be on the site's allowlist, or the request is refused and counted as origin-refused on Health.