Ingest Event

POST /cdp/ingest — the public, credential-free ingest proxy the storefront Web Pixel posts to. The server injects the upstream Unomi credential; the browser sends none. See Ingest for the full security model.

Request

POST /cdp/ingest
Content-Type: application/json
Origin: https://your-shop.myshopify.com

• No credential. Send only Content-Type (and the browser's Origin). Any Authorization header you send is ignored — the server builds the outgoing credential from scratch.
• Body cap: 64 KB. A larger body is rejected 413 before it is parsed or forwarded.
• Body shape: a JSON object (the Unomi context.json event envelope). A non-JSON or non-object body is rejected 400.
• Scope binding: every tenancy-bearing scope in the payload (source.scope, events[].scope, events[].target.scope) must equal the shop bound to the requesting Origin, or the request is rejected 403.

Body (example envelope)

{
	"source": { "scope": "your-shop.myshopify.com" },
	"events": [
		{
			"scope": "your-shop.myshopify.com",
			"eventType": "view",
			"properties": {}
		}
	]
}

Response

Example

curl -s -X POST "https://cdp.vyg.app/cdp/ingest" \
  -H "Content-Type: application/json" \
  -H "Origin: https://your-shop.myshopify.com" \
  -d '{
    "source": { "scope": "your-shop.myshopify.com" },
    "events": [
      { "scope": "your-shop.myshopify.com", "eventType": "view", "properties": {} }
    ]
  }'

CORS

CORS is locked to storefront origins — any https://*.myshopify.com host plus configured custom storefront domains. A disallowed Origin is rejected 403 and never reflected (no * on this credentialed path). The proxy answers the OPTIONS preflight itself with the locked, origin-reflecting headers.

Errors

See Errors for the full envelope.