API reference

What Luria exposes publicly today (the snippet and window.luria), what is in limited availability, and what is still draft.

This page assumes you are comfortable with HTML, JavaScript, and HTTP.

Status

Luria's public HTTP API is in limited availability. The stable, supported public surface today is:

The browser snippet (one <script> tag).
The window.luria object it creates. Full reference: JavaScript events.

Everything else on this page is either informational (endpoints you may notice in your network tab) or marked as draft. Draft sections describe intent, not a contract. Do not build against them without talking to support first.

The snippet

<script async src="https://luriart.com/snippet.js" data-luria-site="YOUR_SITE_ID"></script>

Attribute	Required	Meaning
`src`	yes	Always `https://luriart.com/snippet.js`. Do not self-host or bundle it; you would stop receiving fixes.
`async`	yes	The snippet never blocks rendering.
`data-luria-site`	yes	Your Site ID from the dashboard (Settings > Install). The snippet does nothing without it.

Place it in <head>, before </head>. One tag per page. If the tag is present twice (for example a theme tag plus a tag manager), the second load is ignored.

On Shopify you do not add this tag. The Luria app embed loads the same snippet with your shop's identity. See Install on Shopify.

`window.luria`

Created once the snippet has initialised. It is not present on the page if the visitor has Global Privacy Control or Do Not Track enabled, if consent is required and has not been granted, or if anything failed to load.

`window.luria.convert(goal, value)`

Records a conversion for the current visitor.

window.luria.convert("purchase", 129.0);
window.luria.convert("lead");

Parameter	Type	Notes
`goal`	string	Free-form label. Defaults to `"conversion"` when omitted.
`value`	number or null	Monetary value in your store's currency. Omit for non-monetary goals.

Returns nothing. Never throws. Full semantics, idempotency, auto-detection rules, and a safe call guard are on JavaScript events.

`window.luria.exposure(test, arm)`

Advanced, internal use. The snippet calls this itself when it shows a visitor a variant. Merchants should not call it. Calling it with made-up values will corrupt your results and may make Luria pause tests on your site. It is documented here only so you know what it is when you see it in the source.

Guarantees

Fails open. Any error inside the snippet, any blocked request, any malformed response, and the page behaves exactly as if Luria were not installed. The snippet never edits theme code on Shopify and never touches html, head, body, or :root.

Consent. Global Privacy Control and Do Not Track mean the snippet collects nothing, stores nothing, and serves nothing. On Shopify, Luria follows your store's Customer Privacy settings. Outside Shopify, visitors in consent-required regions see a consent prompt before any collection runs, unless you gate the snippet behind your own CMP. Details: Consent.

No sensitive data. No keystrokes, typed form values, passwords, or payment details are ever collected. See Data and privacy.

Endpoints you may see (informational only)

The snippet talks to a small set of endpoints on luriart.com. You may notice them in your browser's network tab. They are listed here so you can recognise them, not so you can call them. Shapes are not stable and may change without notice. Do not call them directly.

Endpoint	What it does
`GET /api/consent`	Tells the snippet whether the visitor's region requires consent before collection.
`GET /api/patches`	Returns the variant (if any) to show this visitor on this page.
`POST /api/events`	Receives batched, anonymous events (pageviews, clicks, exposures, conversions).
`POST /api/collect`	Collection endpoint used by the Shopify app embed.

Requests to these endpoints carry your Site ID and a random first-party visitor id. They never carry typed form contents.

Server-side conversions (draft)

Draft, not yet a contract

Server-side conversions are available on request and the shape below may change. Contact support@luriart.com before building against it.

Intended for sites where the conversion does not happen in the browser (phone sales closed in a CRM, payments confirmed by webhook, subscriptions activated later). On Shopify you do not need this: purchases are already counted by the app.

Intended shape:

POST https://luriart.com/api/conversions
Authorization: Bearer <site api key>
Content-Type: application/json

{
  "site": "YOUR_SITE_ID",
  "event_id": "order_10492",
  "goal": "purchase",
  "value": 129.00,
  "currency": "USD",
  "session": "<luria visitor session id>"
}

Field	Notes
`site`	Your Site ID.
`event_id`	Your own unique id for this conversion (order number, deal id). Luria deduplicates on it, so retries are safe.
`goal`	Same labels as `window.luria.convert`.
`value`, `currency`	Optional. ISO 4217 currency code.
`session`	The visitor's Luria session id, so the conversion can be attributed to the variant they saw. Read it from `localStorage.getItem("luria_sid")` on the client and pass it through your form or checkout.

Without session, the conversion is counted but cannot be attributed to a variant, so it will not move your results.

Data export

You can export your results from the dashboard as CSV. There is no export endpoint in the public API today. If you need a programmatic feed (for a warehouse or BI tool), ask support; it is on the roadmap.

Rate limits (draft)

Snippet endpoints are rate limited per site and per visitor to protect against abuse. Normal storefront traffic never approaches the limits. If a request is throttled the snippet simply drops that batch and the page is unaffected. Server-side conversion limits will be published with the endpoint.

Versioning (draft)

The snippet is unversioned on purpose: https://luriart.com/snippet.js always serves the current build, and backwards compatibility of window.luria.convert is a hard commitment. HTTP endpoints will be versioned by path (for example /api/v1/...) when they reach general availability. Breaking changes will be announced by email to account owners before they ship.