DataJoker API Reference

Endpoints

• Click Tracking — Token-based and legacy click tracking
• Postback — Conversion notifications from advertisers
• Lead Submission — Submit leads to the brokering system
• Qualification — Check if an email/phone qualifies for an offer
• Reactive Buyer — Buyer pre-ping endpoint
• JokerToken — Pull enrichment tokens by ID
• JokerShield — Look up a visit's bot-detection verdict from your server

Click Tracking

Redirects the user to the advertiser's landing page while recording a click. The tracking URL is typically placed in publisher creatives and affiliate links.

GET https://app.datajoker.com/c/abc123def456?sub1=campaign_a&sub2=landing_v2

GET https://app.datajoker.com/c/offer-short-id/pub-slug?sub1=test

Postback

Receives conversion notifications from advertisers. Both GET (query-string) and POST (JSON body) are accepted. Advertisers configure their postback URL to point here after a conversion event (sale, lead, signup, etc.).

GET https://app.datajoker.com/postback?click_id=abc-123&revenue=4.50&status=approved&transaction_id=TXN-001

curl -X POST https://app.datajoker.com/postback \
  -H "Content-Type: application/json" \
  -d '{
    "click_id": "abc-123",
    "revenue": "4.50",
    "status": "approved",
    "transaction_id": "TXN-001"
  }'

HTTP 200 OK
{
  "status": "ok",
  "click_id": "abc-123",
  "conversion_id": "conv-456"
}

Lead Submission

Submit leads into the brokering system. Requires an affiliate API key. The campaign slug in the URL determines which campaign the lead is routed to.

curl -X POST https://app.datajoker.com/leads/auto-insurance \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-affiliate-api-key" \
  -d '{
    "email": "jane@example.com",
    "phone": "5551234567",
    "first_name": "Jane",
    "last_name": "Doe",
    "zip": "90210",
    "state": "CA",
    "ip_address": "203.0.113.42"
  }'

{
  "status": "accepted",
  "lead_id": "lead-789",
  "payout": "3.50"
}

{
  "status": "rejected",
  "reason": "missing required field: email"
}

{
  "status": "duplicate",
  "reason": "lead already submitted within dedup window"
}

# Step 1: Ping (check buyer availability)
curl -X POST https://app.datajoker.com/leads/auto-insurance \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-affiliate-api-key" \
  -d '{
    "action": "ping",
    "email": "jane@example.com",
    "phone": "5551234567",
    "zip": "90210",
    "state": "CA",
    "ip_address": "203.0.113.42"
  }'

# Response: {"status":"accepted","ping_id":"ping-abc-123","quoted_payout":"3.50"}

# Step 2: Post (submit full lead with ping_id)
curl -X POST https://app.datajoker.com/leads/auto-insurance \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your-affiliate-api-key" \
  -d '{
    "action": "post",
    "ping_id": "ping-abc-123",
    "email": "jane@example.com",
    "phone": "5551234567",
    "first_name": "Jane",
    "last_name": "Doe",
    "zip": "90210",
    "state": "CA",
    "ip_address": "203.0.113.42"
  }'

Qualification

Check whether an email or phone qualifies for a specific offer before sending traffic. Uses hashed identifiers for privacy.

GET https://app.datajoker.com/api/qualify?e=5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8&o=auto-ins

{
  "qualified": true,
  "offer_id": "auto-ins"
}

{
  "qualified": false,
  "reason": "duplicate"
}

Reactive Buyer

Buyer pre-ping endpoint. External partners query this to validate users and check buying eligibility before routing traffic.

curl -X POST https://app.datajoker.com/in \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: partner-api-key" \
  -d '{
    "email": "user@example.com",
    "phone": "5559876543",
    "zip": "10001"
  }'

{
  "match": true,
  "redirect_url": "https://advertiser.example.com/lp?click_id=xyz"
}

{
  "match": false
}

JokerToken

Pull enrichment token data by token ID. Used by advertisers to retrieve token payloads after a click event.

GET https://app.datajoker.com/api/jt/550e8400-e29b-41d4-a716-446655440000

{
  "token_id": "550e8400-e29b-41d4-a716-446655440000",
  "data": {
    "field1": "value1",
    "field2": "value2"
  },
  "expires_at": "2026-04-01T00:00:00Z"
}

Common HTTP Status Codes

JokerShield

Device fingerprinting and bot detection. The JokerShield snippet runs on your page and puts a signed visit ID into a hidden field in your forms. Your server sends that ID to /api/v1/verify and gets back the score and verdict for that visit. There is nothing to store on your side beforehand.

How it works

1. On the Install page, check your Visit ID form field and paste the snippet into your pages. New accounts start on the standard name, jtid. You can keep it, generate a random name instead (harder for bots to spot, because it differs on every site), or choose your own. Whichever you pick, your server reads the field by that name.
2. The snippet adds <input type="hidden" name="jtid" value="…"> (with your field name) to every form on the page, including forms added after the page loads, and fills it again on submit. The value is an opaque, encrypted token of varying length: pass it through unchanged and do not parse it. The snippet only ever writes a hidden field: if a form already has a visible field with your field name, that form is left alone and gets nothing, so pick a name none of your forms uses. If a submission arrives without the field, the snippet did not run on that page.
3. When the form reaches your server, your server POSTs {"id": "<the field's value>"} to /api/v1/verify with your server key in the X-Server-Key header. The site key is not used here.
4. Your server branches on status and then verdict_known before it reads score. See below.

Authentication

You have two keys, and they do different jobs. The site key is public: it is built into the install snippet and sits in your page source, so it only identifies your site to the collector. The server key (it starts with djsk_) is secret and is the only key /api/v1/verify accepts. Send it in the X-Server-Key header — header only: a server key in a query string is ignored, because query strings end up in access logs. The site key is refused by /api/v1/verify in either header, so a leaked or scraped snippet cannot be used to read verdicts. No server key yet? Press Generate server key on the Install page.

curl -X POST https://app.datajoker.com/api/v1/verify \
  -H "X-Server-Key: YOUR_SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id": "VALUE_OF_YOUR_VISIT_FIELD"}'

{
  "status": "ok",
  "id": "Xq1uY3JhbmRvbS1sb29raW5nLXZpc2l0LWlkLXRva2VuX2Zvci10aGUtZG9jcy1wYWdl",
  "fingerprint_hash": "a1b2c3d4e5f6...",
  "score": 12,
  "classification": "human",
  "verdict_known": true,
  "reasons": ["consistent device signals", "no automation markers"],
  "collected_at": "2026-09-23T14:02:11Z",
  "collection_complete": true,
  "final": true,
  "device_profile": {
    "score": 15,
    "classification": "human",
    "verdict_known": true,
    "reasons": ["stable across 4 sessions"]
  },
  "device_history": {
    "total_sessions": 4,
    "bot_session_count": 0,
    "suspicious_session_count": 0,
    "human_session_count": 4,
    "unjudged_session_count": 0,
    "max_score": 18,
    "first_seen_at": "2026-09-01T09:15:00Z",
    "last_seen_at": "2026-09-23T14:02:11Z",
    "device_signal_mismatches": []
  }
}

{
  "status": "pending",
  "id": "Xq1uY3JhbmRvbS1sb29raW5nLXZpc2l0LWlkLXRva2VuX2Zvci10aGUtZG9jcy1wYWdl",
  "verdict_known": false,
  "retry_after_ms": 1000
}

{
  "status": "not_collected",
  "id": "Xq1uY3JhbmRvbS1sb29raW5nLXZpc2l0LWlkLXRva2VuX2Zvci10aGUtZG9jcy1wYWdl",
  "verdict_known": false
}

// Node 18+. `form` is the submitted form body; `jtid` is your field name
// (the standard one — use yours if you changed it on the Install page).
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

async function lookUpVisit(id) {
  let latest = null;
  for (const wait of [0, 1000, 2000, 4000]) { // about 7 s of waiting, 4 attempts
    if (wait) await sleep(wait);

    const res = await fetch("https://app.datajoker.com/api/v1/verify", {
      method: "POST",
      headers: {
        "X-Server-Key": process.env.JOKERSHIELD_SERVER_KEY, // secret — never in a page
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ id }),
    });

    if (res.status === 202) continue;  // pending: not stored yet
    if (!res.ok) return null;          // 4xx/5xx: no verdict
    latest = await res.json();         // "ok" or "not_collected"
    if (latest.status !== "ok" || latest.final) return latest;
    // stored but not final: provisional, ask again
  }
  return latest; // null if still pending; otherwise the last provisional answer
}

const v = form.jtid ? await lookUpVisit(form.jtid) : null;

// Check status and verdict_known before score, every time.
if (!v || v.status !== "ok" || !v.verdict_known) {
  // No field, still pending, never collected, or never judged: NOT clean.
  flagForReview(form);
} else if (v.score >= 40) {
  reject(form);
} else if (!v.final) {
  // Looked clean, but on partial evidence: hold it rather than accept it.
  flagForReview(form);
} else {
  accept(form);
}

curl -X POST https://app.datajoker.com/api/v1/verify \
  -H "X-Server-Key: YOUR_SERVER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"token": "the-token-from-collect"}'

Rate Limits

All API endpoints enforce rate limiting. When the limit is exceeded you will receive a 429 Too Many Requests response.