Embedded Web SDK API

The endpoints that the @devotel/orbit-web-sdk (browser-side) hits at runtime. Mounted at /sdk/* (no /api/v1 prefix) so customer-side embeds don’t have to think about API versions. Base path: https://api.orbit.devotel.io/sdk (no /api prefix) Authentication: Tenant public key (dv_live_pk_*) sent in the X-API-Key header. These endpoints accept the live-mode public key only. CORS is wide open — these endpoints are designed to be hit directly from the customer’s website JavaScript. Why a separate base path: server-to-server keys (dv_live_sk_*) are secret. Browser-embedded public keys (dv_live_pk_*) are safe to ship in client-side code. The split base prevents accidentally exposing a server key in a browser bundle.

Identify

Resolve an anonymous browser visitor to a known contact (by email or phone) so subsequent events attach to the right contact record.

fetch('https://api.orbit.devotel.io/sdk/identify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-API-Key': 'dv_live_pk_your_key' },
  body: JSON.stringify({
    anonymous_id: 'anon_8f3c2b1d',
    email: 'jane@example.com',
    display_name: 'Jane Doe'
  })
});

anonymous_id is required (it ties the call back to the browser session). Include at least one of email or phone to resolve the contact; display_name and traits are optional.

Method	Path	Purpose
`POST`	`/sdk/identify`	Resolve / merge anonymous → known contact

Track

Capture a custom event (page view, button click, video watched, item added to cart). Events flow into the same sdk_events store that powers segmentation, scoring, and contact timelines.

fetch('https://api.orbit.devotel.io/sdk/track', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-API-Key': 'dv_live_pk_your_key' },
  body: JSON.stringify({
    anonymous_id: 'anon_8f3c2b1d',
    events: [
      { name: 'item_added_to_cart', properties: { sku: 'shoe-42', value: 89.99 } }
    ]
  })
});

Send up to 50 events per call. Each event needs a name; properties and an ISO-8601 timestamp are optional. The required anonymous_id identifies the browser session, so events captured before a visitor identifies still attach to the right contact.

Method	Path	Purpose
`POST`	`/sdk/track`	Capture one or more custom events

Personalize

Fetch the right personalization slot variant for the current visitor at runtime.

const res = await fetch(
  'https://api.orbit.devotel.io/sdk/personalize?slot=hero_banner',
  { headers: { 'X-API-Key': 'dv_live_pk_your_key' } }
);
const { data: { content } } = await res.json();

Method	Path	Purpose
`GET`	`/sdk/personalize`	Resolve a personalization slot for the calling visitor

API Reference

All Endpoints

Embedded Web SDK API

Embedded Web SDK API

Identify

Track

Personalize

See also

​Embedded Web SDK API

​Identify

​Track

​Personalize

​See also

Embedded Web SDK API

Identify

Track

Personalize

See also