Conversions API
Conversions API
Use this endpoint when the conversion happens on your server. The browser pixel is the other path: Conversion tracking records PageView and Conversion in the page, stores the click for 30 days, and can send the same event_id.
Both paths call the same ingestion. Send the same event_id from the pixel and from the server to store one row for one order.
Endpoint
POST https://tyfrhxfejrawgdlhryfu.supabase.co/functions/v1/conversions-api
The key needs the conversions scope. read and write do not authorize this call. This endpoint does not use the Advertiser API's 120 requests per minute.
curl -X POST 'https://tyfrhxfejrawgdlhryfu.supabase.co/functions/v1/conversions-api' \
-H 'Authorization: Bearer idl_adv_xxx' \
-H 'Content-Type: application/json' \
-d '{
"event_name": "Purchase",
"value": 49.00,
"currency": "EUR",
"click_id": "CAMPAIGN_OR_CLICK_UUID",
"clicked_at": "2026-11-01T12:00:00Z",
"ad_id": "AD_UUID",
"email_sha256": "SHA256_OF_NORMALIZED_EMAIL",
"event_id": "order-1001",
"timestamp": "2026-11-04T08:00:00Z"
}'
Authorization: Bearer and x-api-key both work. The organization is taken from the key.
Snake case and camel case are both accepted: event_name or eventName, click_id or clickId, ad_id or adId, event_id or eventId, email_sha256 or emailSha256, clicked_at or clickedAt. timestamp or event_time sets the event time.
Body
| Field | Required | Rule |
|---|---|---|
event_name | Yes | Non-empty. The server call is strict |
value | No | Number. A non-number is 400 |
currency | No | Three letters, stored uppercased |
click_id | No | UUID. Either clicks.id or the pixel's idlen_cid (the campaign id) |
clicked_at | No | When the click happened. Used when click_id is a campaign id |
ad_id | No | UUID of an ad in this organization |
email_sha256 | No | Lowercase hex SHA-256 of the normalized email, 64 characters |
event_id | No | 1–128 characters, [A-Za-z0-9_.:-]. Dedupes with the pixel |
timestamp | No | Event time. A time more than 5 minutes in the future is stored as now |
event_name is required. email_sha256 must be a lowercase hex SHA-256. event_id must match the pattern above. Invalid currency is 400. Those checks are strict on this endpoint.
Attribution
click_id is matched to a click in this organization, or to a campaign id in this organization. A known click older than 30 days is dropped, the same window as the pixel cookie. A server event with no click time is stored and not attributed.
The response:
{
"success": true,
"id": "EVENT_UUID",
"deduplicated": false,
"attributed": true
}
deduplicated is true when this event_id was already stored for the organization. id is the stored row, or null.
Errors
This endpoint does not use the Advertiser API error object. Failures are { "error": "message" }.
| Status | error |
|---|---|
400 | Invalid JSON body, value must be a number, event_name is required, Invalid event_id, email_sha256 must be a lowercase hex SHA-256, Invalid currency |
401 | Missing API key, Invalid API key, or Auth failed |
405 | Method not allowed (only POST) |
500 | Server configuration error, or the ingest error when it is not a client error |
503 | Conversions API is not deployed yet |
Only POST is accepted. OPTIONS returns 200 for browser preflight.
Create the key in Ads Manager under Settings → API keys, with the conversions scope. The same key can also have read and write if you call the Advertiser API and the MCP server.