---
title: "Lock the caller's fresh signup to a referral code (spec 4.3)."
method: POST
path: "/api/v1/affiliate/attribute"
tags: ["Affiliate"]
---

# Lock the caller's fresh signup to a referral code (spec 4.3).

`POST /api/v1/affiliate/attribute`

## Request

- Base URL: `https://api.avatarfactory.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.avatarfactory.io/api/v1/affiliate/attribute`
- Auth: one of:
  - API key in cookie `session`
  - HTTP bearer

<br/>The SPA calls this once, right after signup, with the code it read from<br/>the `af_ref` cookie or from `?ref=` on /register. Always 200: the service<br/>silently refuses an unknown code, a second code, a self-referral or an<br/>older account, so the client can fire and forget. `reason` stays coarse<br/>so the endpoint never confirms whether a code exists.

## Request body

- AttributeRequest: The code the SPA read from the `af_ref` cookie or from `?ref=`.
  - `code` string, required
  - `source` string, required

## Response `200`

OK

- AttributeResponse: Always 200. `reason` names why a refusal happened, or is null on success. The reasons stay coarse on purpose: `not_eligible` covers an unknown code, an unapproved affiliate, a self-referral and an account past the attribution window, so the endpoint never tells an anonymous caller whether a given code exists.
  - `attributed` boolean, required
  - `reason` string, nullable

## Other responses

- `422`: Unprocessable Entity

---

[API](https://skmtc.dev/avatarfactory/apis/avatarfactory-api.md) · [All operations](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/revisions/66fc7aa3f296?raw)