Data sources

1. Put the bandit.js tag on your site. When it finds a Segment, RudderStack or PostHog anonymous ID in the browser, it links that ID to the Bandit visitor. Without that link, forwarded events cannot be matched to a visitor.
2. Create a secret key in Settings. Publishable keys are refused here, because anyone can read one from your page.
3. Send the key as Authorization: Bearer <secret key>. Do not rely on Segment'sX-Signature header, which signs only the first event of a batch.

Use the Webhooks (Actions) destination. It sends the Segment spec as is.

1. In Segment, add the Webhooks (Actions) destination to your source.
2. Add a mapping for the track and identify events. Set the URL to https://runbandit.com/api/sources/segment and the method to POST.
3. Add a header named Authorization with the value Bearer <secret key>.
4. Send the default payload, with messageId, event, anonymousId,userId, properties and traits. Batching is fine, up to 1000 events per request.

Use the Webhook destination and add ?source=rudderstack to the URL so RudderStack anonymous IDs are read from the right place.

1. In RudderStack, add a Webhook destination and connect your source.
2. Set the webhook URL to https://runbandit.com/api/sources/segment?source=rudderstack and the method to POST.
3. Add a header named Authorization with the value Bearer <secret key>.
4. Leave the payload as it is. RudderStack events already follow the Segment spec.

Use the HTTP webhook destination and add ?source=posthog to the URL. PostHog does not send the Segment spec by default, so paste this body template. Its distinct_id becomes the anonymous ID.

1. In PostHog, add a Webhook destination under Data pipelines.
2. Set the webhook URL to https://runbandit.com/api/sources/segment?source=posthog and the method to POST.
3. Add the headers Authorization: Bearer <secret key> and Content-Type: application/json.
4. Set the JSON body to the template below, and filter the destination to the events you want to send.

{
  "type": "track",
  "messageId": "{event.uuid}",
  "event": "{event.event}",
  "anonymousId": "{event.distinct_id}",
  "timestamp": "{event.timestamp}",
  "properties": "{event.properties}"
}

Shopify stores that install with the script add a custom pixel instead of a CDP. Copy it from the Setup page, which fills in your publishable key. It sends four customer events to https://runbandit.com/api/sources/shopify: checkout_completed, checkout_started, payment_info_submitted and product_added_to_cart, each with the order or line total in total.

1. In your Shopify admin open Settings, then Customer events, and add a custom pixel named Bandit.
2. Paste the pixel code from the Setup page and set Customer privacy to Not required.
3. Save and connect. On any funnel, set the goal to Shopify: Checkout completed with value property total, or to an add-to-cart or checkout start.

This endpoint takes the publishable key, since the pixel runs in Shopify's sandbox and cannot hold a secret. It skips the key's allowed origins, because the sandbox does not send your store's origin, and refuses any event name outside the four above. Events are tied to the visitor by the bandit_v cookie, and Shopify's event ID makes a redelivered event a no-op.

• track is stored once per messageId, so a redelivered message never counts twice. It is tied to a visitor by anonymousId first, then by userId when that user is already identified. A funnel whose goal is that event name is credited for the visitor.
• identify links userId to the visitor behind anonymousId, and records string, number and boolean traits as visitor labels, up to 20 per event.
• page and any other type are accepted and ignored.

curl -X POST "https://runbandit.com/api/sources/segment" \
  -H "Authorization: Bearer $BANDIT_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "track",
    "messageId": "ajs-next-1d2c9a",
    "event": "Order Completed",
    "anonymousId": "7d3c9e55-1b0a-4f2c-8a46-5e7d0f3b9c21",
    "properties": { "revenue": 59.9, "currency": "USD" }
  }'

{ "success": true, "data": { "accepted": 1, "duplicates": 0, "unmatched": 0, "ignored": 0 } }

accepted counts events Bandit stored or applied. duplicates counts tracks whosemessageId was already stored. ignored counts pages, unknown types, events missing a required field, and an identify that tried to link a visitor already identified as someone else.unmatched counts accepted events that could not be tied to a visitor; they are kept, so a high number means the bandit.js tag is not linking IDs yet.

See the API reference for the full request shape.