Skip to content
kymoDocs
Reference

/api/beat

POST /api/beat is the ingest endpoint. beat.js calls it; you normally do not call it directly. This documents its contract.

Request

  • Method — POST. OPTIONS returns 204 for CORS preflight.
  • Content-Type — text/plain. This is deliberate: application/json would trigger a CORS preflight that sendBeacon cannot satisfy cross-origin. The body is still JSON, just sent as text.
  • Body — JSON:
FieldTypeRequiredDescription

CORS is open (Access-Control-Allow-Origin: *) so any origin can post.

What the server drops

Before storing, the endpoint drops the request — returning 204 with nothing written — when:

  • The user-agent matches bot, crawl, spider, slurp, headless, or lighthouse.
  • The request IP is in the site's excluded-IP list.

The raw IP and user-agent are used only to derive the visitor hash, the device, and the browser, then discarded — never stored. See What we store.

Responses

FieldTypeRequiredDescription

AI crawlers are ingested through a separate endpoint, /api/crawl, which your server (not the browser) posts { site, path, ua, status } to. That path classifies the user-agent and stores a bot event. It is out of scope here; see The bot taxonomy.

Last updated 2026-07-21