---
title: "Record a conversion via postback (POST)"
method: POST
path: "/api/postback"
tags: ["Conversion Tracking"]
---

# Record a conversion via postback (POST)

`POST /api/postback`

## Request

- Base URL: `https://www.flyn.to`
- URL: `https://www.flyn.to/api/postback`
- Auth: none required

Alias of POST /api/conversion with identical body, responses and rate-limit bucket.

**Auth:** none. The click id is the credential; no cookie or API key is read. CORS is open to every origin.

**Plan:** no caller plan check. The click's link must have conversion tracking on (a Pro link setting), and the click must be at most 30 days old.

**Rate limit:** 60 requests per 60 s per client IP, shared by GET and POST on /api/conversion and /api/postback (fixed window, in memory per server instance). The 429 has no Retry-After.

## Query parameters

- `click_id` string
- `event` string
- `value` string
- `currency` string
- `txid` string

## Request body

- ConversionRequest: Body fields win over query parameters of the same name.
  - `click_id` string, required: The per-click id Flyn appended to the destination as `flyn_id`. Also accepted as clickId, flyn_id, clickid or cid (first present wins).
  - `event` string: Goal name, lower-cased first. Also accepted as type.
  - `value` union: Value in major units. Also accepted as payout, sum or amt. A European decimal comma is understood; |value| above 1,000,000 or unparseable becomes 0. Negative records a refund.
    - number
    - string
  - `currency` string: ISO 4217 code, upper-cased; anything but three letters becomes USD.
  - `txid` string: Transaction id (first 64 characters kept). Also accepted as transaction_id. Part of the (click, event, txid) de-duplication key.

## Response `200`

Recorded, or already recorded for this (click, event, txid) (`duplicate: true`).

- ConversionResult: Envelope of the conversion ingest endpoints. `ok` is false on every error.
  - `ok` boolean, required
  - `duplicate` boolean: Present and true when the same (click, event, txid) was already recorded.
  - `error` string: Present when ok is false.

## Other responses

- `400`: Malformed click id ("click_id missing or malformed") or event ("event must be 1-40 chars: a-z 0-9 _ -").
- `404`: Unknown click id ("unknown click_id"), or the link was deleted or does not have conversion tracking on ("conversion tracking is not enabled for this link").
- `410`: The click is older than the 30-day attribution window.
- `429`: IP rate limit ("Too many requests", no Retry-After), or this click already has 25 conversion rows ("conversion limit reached for this click"). The per-click cap is permanent and is checked before de-duplication.
- `503`: Temporary database failure.

---

[API](https://skmtc.dev/flyn/apis/flyn-api.md) · [All operations](https://skmtc.dev/flyn/apis/flyn-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flyn/apis/flyn-api/revisions/977962a98ccb?raw)