# Measura API reference

Base URL: https://measura.dev
Full documentation with examples: https://measura.dev/docs/api

## Endpoints

### `POST /functions/v1/ingest`

Accepts one event or a batch of up to 50. Bodies may be gzipped. Every event is HMAC-SHA256 signed over a canonical payload.

**Auth:** HMAC-SHA256 signature in the body, keyed with the SDK secret. No JWT.

**Parameters**

- `event_type` **(required)**: click, install, open, session_start, session_end, purchase, custom, re_engagement or uninstall.
- `customer_id` **(required)**: Your account id.
- `app_id` **(required)**: The application the event belongs to.
- `event_id` **(required)**: Client generated id, used for deduplication.
- `timestamp` **(required)**: Unix milliseconds, from the device clock.
- `age_ms` (optional): How long ago the event happened, from the device monotonic clock. Lets the server derive the true time independently of the device clock.
- `signature` **(required)**: Hex HMAC-SHA256 over the canonical payload, excluding this field.

[Full detail](https://measura.dev/docs/api#ingest)

### `GET /functions/v1/ingest/health`

Liveness probe for the ingestion service.

**Auth:** None.


[Full detail](https://measura.dev/docs/api#health)

### `POST /functions/v1/resolve-key`

Exchanges an SDK key for the account and application it belongs to, plus remote configuration.

**Auth:** The SDK key itself.


[Full detail](https://measura.dev/docs/api#resolve-key)

### `GET /functions/v1/deep-link`

Resolves a short link, records the click, and redirects.

**Auth:** None. The link itself is the credential.


[Full detail](https://measura.dev/docs/api#deep-links)

### `GET /functions/v1/analytics`

Reporting. Resources: summary, installs, cohorts, fraud, attribution_log, revenue, payments.

**Auth:** Bearer, a signed-in user session.

**Parameters**

- `resource` **(required)**: Which report to return.
- `app_id` (optional): Restrict to one application.
- `date_from` (optional): ISO date. Defaults to the last 30 days.
- `date_to` (optional): ISO date. Defaults to today.

[Full detail](https://measura.dev/docs/api#analytics)

### `POST /functions/v1/payment-webhook`

Receives a completed payment from Paystack, Flutterwave or a generic provider and attributes it to the campaign that produced the install.

**Auth:** The provider signature over the raw body. Paystack uses HMAC-SHA512, Flutterwave a verbatim shared secret, generic HMAC-SHA256.

**Parameters**

- `app_id` **(required)**: Query parameter. The application receiving the payment.
- `provider` **(required)**: Query parameter. paystack, flutterwave or generic.

[Full detail](https://measura.dev/docs/api#payment-webhooks)

### `POST /functions/v1/generate-key`

Issues an SDK key for one of your applications.

**Auth:** Bearer, a signed-in user session.

**Parameters**

- `app_id` **(required)**: Must belong to your account.
- `label` (optional): Defaults to "SDK Key".

[Full detail](https://measura.dev/docs/api#api-keys)

### `POST /functions/v1/migration-importer`

Imports historical attributions from AppsFlyer, Adjust, Branch or a custom export.

**Auth:** Bearer, a signed-in user session.


[Full detail](https://measura.dev/docs/api#migration)

### `POST /rest/v1/rpc/export_my_account_data`

Exports the calling account as one JSON document. Takes no account id: the account comes from the session, so it cannot be pointed at another tenant.

**Auth:** Bearer, a signed-in user session, plus the apikey header.

**Parameters**

- `p_max_rows` (optional): Rows per table. Defaults to 50000, clamped to 200000.

[Full detail](https://measura.dev/docs/api#export)

### `POST /rest/v1/rpc/upsert_sdk_config`

Overrides SDK behaviour for your account without an app release: tracking_enabled, sampling_rate, wifi_only_mode and more. Null arguments inherit platform defaults.

**Auth:** Bearer, a signed-in user session, plus the apikey header.


[Full detail](https://measura.dev/docs/api#account-rpcs)

### `POST /rest/v1/rpc/create_payment_webhook`

Creates a payment webhook for an app you own and returns its URL and signing secret. The secret is shown once.

**Auth:** Bearer, a signed-in user session, plus the apikey header.


[Full detail](https://measura.dev/docs/api#account-rpcs)

## Error codes

- `VALIDATION_ERROR`: The request was malformed, or a field failed validation. The response names the fields.
- `AUTH_ERROR`: Signature did not verify, or the credential is unknown.
- `RATE_LIMIT`: Too many requests. Two tiers apply: a coarse per-IP flood guard and a precise per-application limit.
- `QUOTA_EXCEEDED`: The account has used its monthly event allowance.
- `INTERNAL_ERROR`: A fault on our side. Safe to retry with backoff.

## Exporting your account

`POST /rest/v1/rpc/export_my_account_data` returns everything held for your
account as one JSON document. No notice period and no fee. See
https://measura.dev/docs/migrate