---
title: "Arrive"
method: POST
path: "/api/social/arrive"
tags: ["social"]
---

# Arrive

`POST /api/social/arrive`

## Request

- Base URL: `https://api.getcheapgames.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getcheapgames.com/api/social/arrive`
- Auth: none declared

A person arrived on the site from a link in one of our posts.

The click a caption link used to count at the redirect, counted where only
a person can make it: the site calls this once the page it opened is
visible in a browser (not prerendered, not a background tab), once per
post per browser session. Meta's link fetchers follow the redirect but do
not run the page, so they never get here. Written as `kind='click'`,
`via='arrival'`, which the dashboard counts (`stats.SOCIAL_CLICK`).

The body is parsed by hand rather than as a typed parameter, so it is read
whatever content type it arrives with: `navigator.sendBeacon` with a plain
string sends `text/plain`, and a beacon that is dropped is a lost click.

Refused with 403 when the browser says the call came from another site
(`Sec-Fetch-Site`), so another page cannot post clicks on our behalf
through its visitors. Older browsers send no such header and are let
through: the count is anonymous and the post must exist, so the most a
forger gets is a number on our own dashboard.

## Response `204`

Successful Response

---

[API](https://skmtc.dev/getcheapgames/apis/getcheapgames-api.md) · [All operations](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getcheapgames/apis/getcheapgames-api/revisions/57333a690301?raw)