> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Ingest a track event > Segment-compatible `track` call — records that a user performed an `event` with optional `properties`. Authenticate by signing the raw request body with your tenant ingest secret (the `x-orbit-cdp-*` headers); Clerk sessions and API keys are not accepted on the ingest surface. Supply either `userId` or `anonymousId`. Orbit resolves the event to a contact where possible, applies tracking-plan and event- schema enforcement, and fans the event out to subscribed CDP destinations and event-triggered journeys. ## OpenAPI ````yaml /openapi.yaml post /cdp/v1/{ingest_id}/track openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /cdp/v1/{ingest_id}/track: post: tags: - CDP summary: Ingest a track event description: >- Segment-compatible `track` call — records that a user performed an `event` with optional `properties`. Authenticate by signing the raw request body with your tenant ingest secret (the `x-orbit-cdp-*` headers); Clerk sessions and API keys are not accepted on the ingest surface. Supply either `userId` or `anonymousId`. Orbit resolves the event to a contact where possible, applies tracking-plan and event- schema enforcement, and fans the event out to subscribed CDP destinations and event-triggered journeys. parameters: - schema: type: string in: path name: ingest_id required: true description: Public, tenant-bound ingest identifier from your CDP source config. - schema: type: string in: header name: x-orbit-cdp-signature required: true description: >- HMAC-SHA256 of the raw request body, keyed by the tenant ingest secret. - schema: type: string in: header name: x-orbit-cdp-timestamp required: true description: >- Unix-epoch seconds the payload was signed; rejected outside the replay window. - schema: type: string in: header name: x-orbit-cdp-nonce required: true description: Unique per-request nonce used to reject replays. requestBody: required: true content: application/json: schema: type: object required: - event properties: userId: type: string anonymousId: type: string event: type: string properties: type: object additionalProperties: true timestamp: type: string format: date-time messageId: type: string example: userId: user_9f2a event: Order Completed properties: order_id: ord_1024 revenue: 49.99 currency: USD responses: '200': description: >- Event accepted. `deduped` is `true` when a same-minute replay collapsed onto an already-persisted event; `contact_id` is present when the event resolved to a known contact. content: application/json: schema: type: object properties: data: type: object properties: received: type: boolean event_id: type: string deduped: type: boolean contact_id: type: string nullable: true meta: $ref: '#/components/schemas/ResponseMeta' '401': description: >- CDP ingest authentication failed — HMAC signature, timestamp, or replay-nonce verification did not pass. `error.code` is `CDP_UNAUTHORIZED`. The envelope is identical regardless of which verification step failed (timing-oracle resistance). content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '413': description: >- Inbound payload exceeded the inline ingest byte cap (1 MB). Chunk via `/batch` or use the spillover upload flow. `error.code` is `CDP_PAYLOAD_TOO_LARGE`. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '422': description: >- Event rejected before ingestion. `error.code` is `SCHEMA_VALIDATION_FAILED` when the event fails strict-mode schema validation (`error.validation_errors` carries the per-field issues), or `TRACKING_PLAN_VIOLATION` when a strict tracking plan rejects the event (`error.details.violations` carries the mismatch list). content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' components: schemas: ResponseMeta: type: object required: - request_id - timestamp additionalProperties: false properties: request_id: type: string description: Unique request identifier (also returned as X-Request-Id header) timestamp: type: string format: date-time docs_url: type: string format: uri nullable: true ErrorEnvelope: type: object required: - error - meta additionalProperties: false properties: error: type: object required: - code - message - status additionalProperties: false properties: code: type: string message: type: string status: type: integer details: type: object nullable: true additionalProperties: true meta: type: object required: - request_id - timestamp additionalProperties: false properties: request_id: type: string description: Unique request identifier (also returned as X-Request-Id header) timestamp: type: string format: date-time docs_url: type: string format: uri nullable: true securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````