---
title: "Record where an alias was used (browser-extension flow)."
method: POST
path: "/v1/addresses/{id}/attribution"
tags: ["Addresses"]
---

# Record where an alias was used (browser-extension flow).

`POST /v1/addresses/{id}/attribution`

## Request

- Base URL: `https://api.inboxy.net`
- URL: `https://api.inboxy.net/v1/addresses/{id}/attribution`
- Auth: HTTP bearer

Accepts either `manage` or the narrow `extension` scope. Idempotent on `(address_id, site_origin)` — re-recording bumps `last_used_at` and returns `200`; the first record returns `201`. Address-scoped keys can only attribute the alias they're bound to. Writes an `audit_log` row with action `api_address_attribution`.

## Path parameters

- `id` string, uuid, required

## Request body

- AddressAttributionRequest
  - `site_origin` string, required: Scheme + host where the alias was used. Origin-validated server-side.
  - `site_label` string: Optional human label (e.g. site title); sanitised + truncated.

## Response `200`

Attribution updated (existing row).

- AddressAttribution
  - `id` string, uuid, required
  - `address_id` string, uuid, required
  - `site_origin` string, required: Scheme + host, e.g. `https://example.com`.
  - `site_label` string, nullable
  - `source` 'extension', required
  - `first_used_at` integer, required: Unix seconds.
  - `last_used_at` integer, required: Unix seconds.

## Other responses

- `201`: Attribution recorded (new row).
- `400`: `invalid_origin` — body missing or origin malformed.
- `403`: Token lacks the required scope.
- `404`: No matching resource owned by the caller.

---

[API](https://skmtc.dev/inboxy/apis/inboxy-api.md) · [All operations](https://skmtc.dev/inboxy/apis/inboxy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inboxy/apis/inboxy-api/revisions/25155a8dec0f?raw)