---
title: "Track Capi Event"
method: POST
path: "/v2/tracking/events"
tags: ["Tracking"]
---

# Track Capi Event

`POST /v2/tracking/events`

Accept a browser tracking event and forward it to Meta CAPI.

Intentionally public: mounted on `public_router` with no auth dependency.
Every caller (`app/power-ui/src/utils/metaPixel.ts`, reached from Cookiebot
consent, the marketing pages, and signup) fires before the user has a
token, so requiring a Bearer would silently break conversion tracking.

Abuse controls, in place of auth:
- `event_name` is checked against `ALLOWED_EVENT_NAMES`
- `@limiter.limit("30/minute")` per client IP
- `TrackingEventRequest` caps every field's length and `custom_data` size
- `email` / `phone` are SHA-256 hashed before leaving this process
- nothing is persisted in power-api; the response echoes no input
- the only outbound sink is `https://graph.facebook.com/v19.0/{pixel_id}/events`,
  built from settings — `event_source_url` reaches the JSON body only

Ref: PLA-5052 (Shannon audit hash 05faedc8aeb9), reviewed 2026-07. The
public posture is by design; do not "fix" it by adding an auth dependency.

## Request body

- TrackingEventRequest
  - `event_name` string, required
  - `event_source_url` string, required
  - `fbc` string, nullable
  - `fbp` string, nullable
  - `email` string, nullable
  - `phone` string, nullable
  - `custom_data` object, nullable

## Response `202`

Successful Response

- object

## Other responses

- `404` — Not Found
- `422` — Validation Error

---

[API](https://skmtc.net/carbonarc/apis/carbon-arc-api-documentation.md) · [All operations](https://skmtc.net/carbonarc/apis/carbon-arc-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/carbonarc/carbon-arc-api-documentation/revisions/bd33ea42994c/schema)