---
title: "Click Redirect"
method: GET
path: "/api/track/r"
tags: ["track"]
---

# Click Redirect

`GET /api/track/r`

## Request

- Base URL: `https://api.tintin-x.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.tintin-x.com/api/track/r`
- Auth: none declared

Click-tracking redirect for EDM body links.

The HMAC over (cid, u) means only URLs we ourselves wrapped at send
time pass — this can never be used as an open redirect. An invalid
signature is a hard 400, never a redirect: losing a click beats
laundering an attacker's URL through our domain.

## Query parameters

- `cid` string
- `u` string
- `s` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tintin-x/apis/tintin-api.md) · [All operations](https://skmtc.dev/tintin-x/apis/tintin-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tintin-x/apis/tintin-api/revisions/8839a8d0a66c?raw)