Endpoint reference

Base: https://mk.brand.com — your connected domain. Every connected domain serves the same endpoints. The /_ag/ and /_preview/ prefixes are reserved by allGood. Everything else at the root is your landing pages.

Capture and tracking

Path	Method	Auth	Response
`/_ag/v1.js`	GET	none	The script, as JavaScript
`/_ag/rc?f={ids}`	GET	none	Runtime configuration, as JSON. Answers any origin
`/_ag/f/{formShortId}`	OPTIONS	origin allowlist	`204` with CORS headers, or `403`
`/_ag/f/{formShortId}`	POST	origin allowlist	Form capture
`/_ag/e`	OPTIONS	origin allowlist	`204` with CORS headers, or `403`
`/_ag/e`	POST	origin allowlist + `X-AG-Site-Key`	Event capture
`/_ag/c/{token}`	GET	signed token	`302` to the destination

Hosted assets

Path	Method	Response
`/{slug}`	GET	A live landing page
`/_ag/img/{path}`	GET	A live hosted image
`/_ag/file/{path}`	GET	A live hosted file, as a download

Preview surfaces

All signed, all expiring, never indexable. They’re served from the platform preview host rather than your branded domain — which is what makes the test page a genuinely third-party origin.

Path	Purpose
`/_preview/{pageShortId}`	Landing page preview
`/_preview/img/{shortId}`	Image preview
`/_preview/file/{shortId}`	File preview
`/_preview/test`	The hosted form and tracking test page

GET /_ag/rc

The per-page runtime configuration the script reads. Public, cacheable for a minute, and it answers every origin on purpose — so a page whose origin isn’t authorised still gets a usable answer instead of an opaque failure. Query: ?f=id1,id2,… — up to 10 form ids.

{
  "v": 1,
  "originAuthorised": true,
  "consent": { "signalSource": "window.__consent", "blockBeforeOptIn": true },
  "tracking": { "enabled": true, "autoPageview": true },
  "botCheck": { "provider": "turnstile", "sitekey": "0x4AAA…" },
  "forms": {
    "f7k2m9qp": {
      "registered": true,
      "honeypotFieldName": "_hp",
      "botCheckRequired": false,
      "schema": { "type": "object", "required": ["email"], "properties": {} }
    }
  }
}

Field	Answers
`originAuthorised`	Is my origin allowed? `true` when there’s no `Origin` header at all
`consent.signalSource`	Which global does the script read consent from?
`consent.blockBeforeOptIn`	Does the hold-until-granted posture apply?
`tracking.enabled`	Is the account master switch on?
`tracking.autoPageview`	Does the script record page views unasked?
`botCheck.sitekey`	Which sitekey should the widget use? Sitekey only
`forms[id].registered`	Is this form live? `false` rather than failing the whole response
`forms[id].honeypotFieldName`	What is the hidden field called? Absent when the honeypot is off
`forms[id].botCheckRequired`	Both sides of the decision, resolved
`forms[id].schema`	The form’s declared fields

Never returned: the tracking key or its fingerprint, the bot-check secret, or the origin allowlist itself.

GET /_ag/c/

The click redirect for tracked links in email. Not something you call directly — allGood rewrites links in sent email to point here. It verifies the token, records the click, seeds the identity cookie only if absent so an existing device isn’t re-identified, and redirects. The recipient’s identity never reaches the browser. A guard limits where it can send: an http or https address on the domain that served the link, or the account’s preview host. Anything else is refused rather than redirected, so a tampered token can’t turn a branded link into a redirect somewhere else.

GET /

A live landing page. Serving one applies your robots posture as a header. It records no page view and doesn’t set the identity cookie. The page’s own tag records the view, under the consent gate. Nothing is injected into the page body — the bytes you published are the bytes served. The response carries a signed record of what was served, in a Server-Timing header, so the tag can label the view with the page and, for a routed URL, the variant. A routed URL also sets a session-only _ag_v_… variant cookie, which holds no identity.

CORS summary

Situation	Response
No `Origin` header	Allowed, nothing added — a non-browser client or a GET
`Origin` equals the request’s own origin	Allowed. A page allGood serves posting to its own host
`Origin` on the allowlist	Allowed, echoed back exactly, with credentials allowed
Anything else	`403`, no CORS headers

Never * on a capture path: those are credentialed, and * is invalid with credentials. /_ag/rc is the one exception — public, uncredentialed, and * on purpose.

HTTP status summary

Status	Meaning
`200`	Form submission accepted
`202`	Event batch accepted for processing
`204`	Preflight OK
`302`	Click redirect
`400`	`validation`
`403`	`unknown_source`, `bot`, `consent_missing`, or a refused preflight
`404`	Form not registered, or unknown page
`429`	`rate_limited`

Marketing Kernel

Platform

Developer

Enterprise

Settings