> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Public Web Surface: tracking pixels, short links, landing pages, SAML, and SCIM edge routes

> The unauthenticated edge endpoints that a browser, customer inbox, or identity provider must reach without an Orbit API key — engagement pixels, short-link + landing-page redirects, SAML SSO, and SCIM provisioning.

# Public Web Surface

Most of the Devotel Orbit API answers only to a bearer deal-credential — an API key or JWT. A small set of routes is deliberately **public**: a customer's email client fetching an engagement pixel, a shopper's browser following a short link, or your identity provider completing a SAML handshake cannot carry an Orbit credential. This section collects those public endpoints and explains what each does, who calls it, and what gets logged when it fires.

Authenticated parts of the platform call these same routes with your API key or session token; the prefixes below are simply reachable without one.

## Engagement tracking

Messages sent from Orbit include two pixel endpoints for engagement attribution. Each logs an event against the message or goal it was embedded in, then returns a 1×1 transparent GIF.

| Endpoint                          | What it records                                                                                            |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| `GET /p/{sig}.gif`                | Email open pixel. The `sig` segment is the signed message reference embedded in outbound email HTML.       |
| `GET /g/{goalId}/{contactId}.gif` | Conversion-goal pixel. Records a goal view for a specific contact, used to attribute landing-page funnels. |

Deploy the pixel that matches your send path (email opens for lifecycle email, goal pixels for funnel attribution). Because email clients and link scanners prefetch aggressively, treat opens as a directional signal, not a hard fact — the same image is fetched by bots, proxies, and inbox previews.

## Short links and landing pages

These endpoints power link-based campaigns. Both redirect with a `302` to the configured destination and log a click event when the reference resolves.

| Endpoint                  | What it does                                                                                                 |
| ------------------------- | ------------------------------------------------------------------------------------------------------------ |
| `GET /l/{code}`           | Short-link redirect. `code` is the slug the [short links](/concepts/short-links) page generates.             |
| `GET /r/{sig}/{target}`   | Signed redirect. Validates an HMAC signature before resolving `target`, so open-redirect abuse fails closed. |
| `GET /lp/{code}`          | Public landing page render for an Orbit-hosted page.                                                         |
| `POST /lp/{code}/convert` | Records a landing-page conversion (form submit, purchase intent) against `code`.                             |

Signature-bearing variants (`/r/{sig}/{target}`) are the routes you hand to partners or embed in third-party pages — unsigned guessing simply returns `404`.

## SAML single sign-on

The `/auth/saml/{orgSlug}` namespace is the service-provider endpoint for dashboard SSO, configured per organization. Your identity provider (Okta, Entra ID, OneLogin, JumpCloud) posts directly to these, so they must not require an Orbit credential.

| Endpoint                             | Purpose                                     |
| ------------------------------------ | ------------------------------------------- |
| `GET /auth/saml/{orgSlug}/metadata`  | SP metadata XML for IdP import.             |
| `GET /auth/saml/{orgSlug}/login`     | Starts the AuthnRequest → IdP redirect.     |
| `POST /auth/saml/{orgSlug}/callback` | IdP assertion consumer → signs the user in. |
| `GET /auth/saml/{orgSlug}/logout`    | IdP-initiated logout redirect.              |

Set the full flow up in the [SAML SSO enrollment guide](/guides/saml-sso-enrollment). The identity-federation concept page ([SAML + SCIM](/concepts/identity-federation-saml-scim)) covers the trusts and session mapping behind it.

## SCIM provisioning

The `/scim/v2/{orgSlug}` namespace exposes the user/group/role provisioning surface your IdP drives with its bearer token — the SCIM base URL you paste into Okta or Entra.

| Endpoint                                       | Purpose                                               |
| ---------------------------------------------- | ----------------------------------------------------- |
| `GET /scim/v2/{orgSlug}/ResourceTypes`         | SCIM resource metadata (`Users`, `Groups`, `Agents`). |
| `GET /scim/v2/{orgSlug}/Schemas`               | Attribute schema discovery.                           |
| `GET /scim/v2/{orgSlug}/ServiceProviderConfig` | Provider capabilities.                                |
| `GET/POST /scim/v2/{orgSlug}/Users`            | Provision + read users.                               |
| `GET/PUT/PATCH /scim/v2/{orgSlug}/Users/{id}`  | Read/update one user.                                 |
| `GET/POST /scim/v2/{orgSlug}/Groups`           | Provision + read groups.                              |
| `GET/PUT/PATCH /scim/v2/{orgSlug}/Groups/{id}` | Read/update one group.                                |
| `GET /scim/v2/{orgSlug}/Agents` and `/{id}`    | Agent role mapping users hold.                        |

Provision in the [SCIM provisioning guide](/guides/scim-provisioning); the same concept page linked above covers the mapping of IdP groups onto dashboard roles.

## Related sections

* [Public pixels & redirects concept](/concepts/public-pixels-redirects) — how the tracking surface treats prefetch and scanner traffic.
* [Identity federation: SAML + SCIM](/concepts/identity-federation-saml-scim) — the federation trust model.
* [SAML SSO enrollment](/guides/saml-sso-enrollment) and [SCIM provisioning](/guides/scim-provisioning) — operator runbooks.
* [Short links concept](/concepts/short-links) — slug generation, click tracking, and signature design.