# API reference Source: https://docs.luriart.com/reference/api Plain text: https://docs.luriart.com/reference/api.txt What Luria exposes publicly today (the snippet and window.luria), what is in limited availability, and what is still draft. This page assumes you are comfortable with HTML, JavaScript, and HTTP. ## Status Luria's public HTTP API is in limited availability. The stable, supported public surface today is: 1. The browser snippet (one ` ``` | Attribute | Required | Meaning | | ----------------- | -------- | ------------------------------------------------------------------------------------------------------------------- | | `src` | yes | Always `https://luriart.com/snippet.js`. Do not self-host or bundle it; you would stop receiving fixes. | | `async` | yes | The snippet never blocks rendering. | | `data-luria-site` | yes | Your Site ID from the dashboard (Settings > Install). The snippet does nothing without it. | Place it in ``, before ``. One tag per page. If the tag is present twice (for example a theme tag plus a tag manager), the second load is ignored. On Shopify you do not add this tag. The Luria app embed loads the same snippet with your shop's identity. See [Install on Shopify](/install/shopify). ## `window.luria` Created once the snippet has initialised. It is not present on the page if the visitor has Global Privacy Control or Do Not Track enabled, if consent is required and has not been granted, or if anything failed to load. ### `window.luria.convert(goal, value)` Records a conversion for the current visitor. ```js window.luria.convert("purchase", 129.0); window.luria.convert("lead"); ``` | Parameter | Type | Notes | | --------- | -------------- | --------------------------------------------------------------------- | | `goal` | string | Free-form label. Defaults to `"conversion"` when omitted. | | `value` | number or null | Monetary value in your store's currency. Omit for non-monetary goals. | Returns nothing. Never throws. Full semantics, idempotency, auto-detection rules, and a safe call guard are on [JavaScript events](/reference/javascript-events). ### `window.luria.exposure(test, arm)` Advanced, internal use. The snippet calls this itself when it shows a visitor a variant. Merchants should not call it. Calling it with made-up values will corrupt your results and may make Luria pause tests on your site. It is documented here only so you know what it is when you see it in the source. ## Guarantees **Fails open.** Any error inside the snippet, any blocked request, any malformed response, and the page behaves exactly as if Luria were not installed. The snippet never edits theme code on Shopify and never touches `html`, `head`, `body`, or `:root`. **Consent.** Global Privacy Control and Do Not Track mean the snippet collects nothing, stores nothing, and serves nothing. On Shopify, Luria follows your store's Customer Privacy settings. Outside Shopify, visitors in consent-required regions see a consent prompt before any collection runs, unless you gate the snippet behind your own CMP. Details: [Consent](/reference/consent). **No sensitive data.** No keystrokes, typed form values, passwords, or payment details are ever collected. See [Data and privacy](/reference/data-and-privacy). ## Endpoints you may see (informational only) The snippet talks to a small set of endpoints on `luriart.com`. You may notice them in your browser's network tab. They are listed here so you can recognise them, not so you can call them. Shapes are not stable and may change without notice. Do not call them directly. | Endpoint | What it does | | ------------------- | ---------------------------------------------------------------------------------- | | `GET /api/consent` | Tells the snippet whether the visitor's region requires consent before collection. | | `GET /api/patches` | Returns the variant (if any) to show this visitor on this page. | | `POST /api/events` | Receives batched, anonymous events (pageviews, clicks, exposures, conversions). | | `POST /api/collect` | Collection endpoint used by the Shopify app embed. | Requests to these endpoints carry your Site ID and a random first-party visitor id. They never carry typed form contents. ## Server-side conversions (draft) **Warning:** Server-side conversions are available on request and the shape below may change. Contact [support@luriart.com](mailto:support@luriart.com) before building against it. Intended for sites where the conversion does not happen in the browser (phone sales closed in a CRM, payments confirmed by webhook, subscriptions activated later). On Shopify you do not need this: purchases are already counted by the app. Intended shape: ```http POST https://luriart.com/api/conversions Authorization: Bearer Content-Type: application/json { "site": "YOUR_SITE_ID", "event_id": "order_10492", "goal": "purchase", "value": 129.00, "currency": "USD", "session": "" } ``` | Field | Notes | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `site` | Your Site ID. | | `event_id` | Your own unique id for this conversion (order number, deal id). Luria deduplicates on it, so retries are safe. | | `goal` | Same labels as `window.luria.convert`. | | `value`, `currency` | Optional. ISO 4217 currency code. | | `session` | The visitor's Luria session id, so the conversion can be attributed to the variant they saw. Read it from `localStorage.getItem("luria_sid")` on the client and pass it through your form or checkout. | Without `session`, the conversion is counted but cannot be attributed to a variant, so it will not move your results. ## Data export You can export your results from the dashboard as CSV. There is no export endpoint in the public API today. If you need a programmatic feed (for a warehouse or BI tool), ask support; it is on the roadmap. ## Rate limits (draft) Snippet endpoints are rate limited per site and per visitor to protect against abuse. Normal storefront traffic never approaches the limits. If a request is throttled the snippet simply drops that batch and the page is unaffected. Server-side conversion limits will be published with the endpoint. ## Versioning (draft) The snippet is unversioned on purpose: `https://luriart.com/snippet.js` always serves the current build, and backwards compatibility of `window.luria.convert` is a hard commitment. HTTP endpoints will be versioned by path (for example `/api/v1/...`) when they reach general availability. Breaking changes will be announced by email to account owners before they ship. ## Frequently asked **Can I load the snippet from my own domain or CDN?** No. The snippet receives fixes and safety improvements continuously. Self-hosting freezes you on an old copy and breaks the 60-second kill switch. See [Security](/reference/security). **Is there a webhook when a test wins?** Not publicly yet. You will see winners in the dashboard and in your weekly email. **Can I read which variant a visitor saw?** Not through a public API today. An exposure callback for your own analytics is planned; see [JavaScript events](/reference/javascript-events). ## Next steps * [JavaScript events](/reference/javascript-events) * [Consent](/reference/consent) * [Data and privacy](/reference/data-and-privacy) * [Install on a custom site](/install/custom-site)