> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Endpoint reference

> Every path served on your connected allGood domain.

Base: `https://mk.brand.com` — your connected domain. Every connected domain serves the same endpoints.

The `/_ag/` and `/_preview/` prefixes are reserved by allGood. Everything else at the root is your landing pages.

## Capture and tracking

| Path                   | Method  | Auth                               | Response                                                    |
| ---------------------- | ------- | ---------------------------------- | ----------------------------------------------------------- |
| `/_ag/v1.js`           | GET     | none                               | The script, as JavaScript                                   |
| `/_ag/rc?f={ids}`      | GET     | none                               | Runtime configuration, as JSON. Answers **any** origin      |
| `/_ag/f/{formShortId}` | OPTIONS | origin allowlist                   | `204` with CORS headers, or `403`                           |
| `/_ag/f/{formShortId}` | POST    | origin allowlist                   | [Form capture](/mk/developer/web-edge/reference/form-api)   |
| `/_ag/e`               | OPTIONS | origin allowlist                   | `204` with CORS headers, or `403`                           |
| `/_ag/e`               | POST    | origin allowlist + `X-AG-Site-Key` | [Event capture](/mk/developer/web-edge/reference/event-api) |
| `/_ag/c/{token}`       | GET     | signed token                       | `302` to the destination                                    |

## Hosted assets

| Path               | Method | Response                          |
| ------------------ | ------ | --------------------------------- |
| `/{slug}`          | GET    | A live landing page               |
| `/_ag/img/{path}`  | GET    | A live hosted image               |
| `/_ag/file/{path}` | GET    | A live hosted file, as a download |

## Preview surfaces

All signed, all expiring, never indexable. They're served from the platform preview host rather than your branded domain — which is what makes the [test page](/mk/developer/web-edge/test-your-setup) a genuinely third-party origin.

| Path                       | Purpose                                |
| -------------------------- | -------------------------------------- |
| `/_preview/{pageShortId}`  | Landing page preview                   |
| `/_preview/img/{shortId}`  | Image preview                          |
| `/_preview/file/{shortId}` | File preview                           |
| `/_preview/test`           | The hosted form and tracking test page |

***

## GET /\_ag/rc

The per-page runtime configuration the script reads. Public, cacheable for a minute, and it answers every origin on purpose — so a page whose origin **isn't** authorised still gets a usable answer instead of an opaque failure.

**Query:** `?f=id1,id2,…` — up to **10** form ids.

```json theme={null}
{
  "v": 1,
  "originAuthorised": true,
  "consent": { "signalSource": "window.__consent", "blockBeforeOptIn": true },
  "tracking": { "enabled": true, "autoPageview": true },
  "botCheck": { "provider": "turnstile", "sitekey": "0x4AAA…" },
  "forms": {
    "f7k2m9qp": {
      "registered": true,
      "honeypotFieldName": "_hp",
      "botCheckRequired": false,
      "schema": { "type": "object", "required": ["email"], "properties": {} }
    }
  }
}
```

| Field                         | Answers                                                             |
| ----------------------------- | ------------------------------------------------------------------- |
| `originAuthorised`            | Is my origin allowed? `true` when there's no `Origin` header at all |
| `consent.signalSource`        | Which global does the script read consent from?                     |
| `consent.blockBeforeOptIn`    | Does the hold-until-granted posture apply?                          |
| `tracking.enabled`            | Is the account master switch on?                                    |
| `tracking.autoPageview`       | Does the script record page views unasked?                          |
| `botCheck.sitekey`            | Which sitekey should the widget use? Sitekey only                   |
| `forms[id].registered`        | Is this form live? `false` rather than failing the whole response   |
| `forms[id].honeypotFieldName` | What is the hidden field called? Absent when the honeypot is off    |
| `forms[id].botCheckRequired`  | Both sides of the decision, resolved                                |
| `forms[id].schema`            | The form's declared fields                                          |

Never returned: the tracking key or its fingerprint, the bot-check secret, or the origin allowlist itself.

## GET /\_ag/c/{token}

The click redirect for tracked links in email. Not something you call directly — allGood rewrites links in sent email to point here.

It verifies the token, records the click, seeds the identity cookie **only if absent** so an existing device isn't re-identified, and redirects. The recipient's identity never reaches the browser.

A guard limits where it can send: an `http` or `https` address on the domain that served the link, or the account's preview host. Anything else is refused rather than redirected, so a tampered token can't turn a branded link into a redirect somewhere else.

## GET /{slug}

A live landing page. Serving one records a page view **at the edge with no client script**, applies your [robots posture](/mk/developer/web-edge/landing-page-settings) as a header, and reads or mints the identity cookie. Nothing is injected into the page body — the bytes you published are the bytes served.

<Warning>
  Page-serve capture and the cookie are **not** gated on consent. See [What consent gates](/mk/developer/web-edge/consent-behavior).
</Warning>

## CORS summary

| Situation                                | Response                                               |
| ---------------------------------------- | ------------------------------------------------------ |
| No `Origin` header                       | Allowed, nothing added — a non-browser client or a GET |
| `Origin` equals the request's own origin | Allowed. A page allGood serves posting to its own host |
| `Origin` on the allowlist                | Allowed, echoed back exactly, with credentials allowed |
| Anything else                            | `403`, **no CORS headers**                             |

Never `*` on a capture path: those are credentialed, and `*` is invalid with credentials. `/_ag/rc` is the one exception — public, uncredentialed, and `*` on purpose.

## HTTP status summary

| Status | Meaning                                                            |
| ------ | ------------------------------------------------------------------ |
| `200`  | Form submission accepted                                           |
| `202`  | Event batch accepted for processing                                |
| `204`  | Preflight OK                                                       |
| `302`  | Click redirect                                                     |
| `400`  | `validation`                                                       |
| `403`  | `unknown_source`, `bot`, `consent_missing`, or a refused preflight |
| `404`  | Form not registered, or unknown page                               |
| `429`  | `rate_limited`                                                     |