Skip to content
Voyage CDP API

Ingest

POST /cdp/ingest is a public, unauthenticated endpoint that the Shopify storefront Web Pixel posts to from the shopper’s browser. It is the one CDP route that takes no credential by design.

Why it is credential-free

Section titled “Why it is credential-free”

A browser pixel bundle is fully extractable (View Source). It must therefore ship with no credential. The ingest proxy is the server-side half that makes this possible:

  • The browser POSTs its pixel event with only a Content-Type header.
  • The server injects the upstream Unomi credential server-side and forwards the validated payload upstream.
  • A client-supplied Authorization header is ignored — the outgoing request is built from scratch and only ever carries the server’s own credential. The client can never influence the injected credential, and the credential never appears in a response body, response header, or log line.

Request

Section titled “Request”
Terminal window
curl -s -X POST https://cdp.vyg.app/cdp/ingest \
  -H "Content-Type: application/json" \
  -H "Origin: https://your-shop.myshopify.com" \
  -d '{
    "source": { "scope": "your-shop.myshopify.com" },
    "events": [
      {
        "scope": "your-shop.myshopify.com",
        "eventType": "view",
        "properties": {}
      }
    ]
  }'

The body is the Unomi context.json event envelope. Send no credential — any Authorization you send is dropped.

Edge protections

Section titled “Edge protections”
  • Origin lock. CORS is locked to storefront origins — any https://*.myshopify.com host plus explicitly configured custom storefront domains. A disallowed Origin is rejected (403) and never reflected; there is no * on this credentialed path.
  • Scope binding. Every tenancy-bearing scope in the payload (source.scope, events[].scope, events[].target.scope) must equal the shop bound to the requesting Origin. A storefront cannot post events tagged with another shop’s scope (403).
  • 64 KB body cap. A request body over 64 KB is rejected with 413 before it is parsed or forwarded.
  • JSON guard. A non-JSON or non-object body is rejected with 400; only a validated JSON object is forwarded.
  • Rate limit. The API Gateway stage applies a steady-state + burst throttle to this public path.

Response

Section titled “Response”

On the edge-rejection paths the response is the standard error envelope (400, 403, 413, 502).