API: connect and read your data
Prepare an AffiliateCore integration: access tokens, scopes, requests, pagination, conversion records and error handling.
API v1 launched on 10 October 2026. Use it to read data for your own role and project. An authorized account holder creates a token in the dashboard; a guide link does not grant permissions.
Available data
This is a read API for your own integration. Publishers can read the available offer catalogue and their own campaigns and conversions. Advertisers can read their own project, offers, campaigns and conversions. Analytics counts conversion records by day and status, not visitors, raw clicks, revenue or balances. This version cannot create offers, activate campaigns, fund balances or request withdrawals.
How to connect
- Sign in with the intended role, verify your email and complete account requirements.
- Open Account and settings → API access. Advertisers must own the selected project; manager or finance membership alone is insufficient.
- Name the integration, select minimum scopes and confirm your current password. A publisher summary needs only
publisher:analytics:read. - Save the token immediately in secure storage: it cannot be displayed again. Tokens last 30 days, with at most five active per user/context. Use separate tokens for another role or project.
- Send it only over HTTPS in
Authorization: Bearer. Never put it in URLs, public JavaScript, messages or logs. Issuance is unavailable with MFA enabled in this version; contact support instead of disabling protection.
Request and response
The educational request below is for a publisher. YOUR_TOKEN is a placeholder, not a working key. Advertiser paths require your numeric project ID, not its slug. Scopes are independent: analytics access does not grant individual conversion exports.
GET /api/v1/publisher/analytics?from=2026-10-01&to=2026-10-07
Host: affiliate-core.com
Authorization: Bearer YOUR_TOKEN
Accept: application/json
| GET | Scope |
|---|---|
/api/v1/publisher/offers |
publisher:offers:read |
/api/v1/publisher/campaigns |
publisher:campaigns:read |
/api/v1/publisher/conversions |
publisher:conversions:read |
/api/v1/publisher/analytics |
publisher:analytics:read |
/api/v1/advertiser/{id}/company |
advertiser:company:read |
/api/v1/advertiser/{id}/offers |
advertiser:offers:read |
/api/v1/advertiser/{id}/campaigns |
advertiser:campaigns:read |
/api/v1/advertiser/{id}/conversions |
advertiser:conversions:read |
/api/v1/advertiser/{id}/analytics |
advertiser:analytics:read |
Pagination and dates
Lists contain data and meta.next_cursor. per_page defaults to 25 and accepts 1–100. Pass the returned cursor with unchanged filters and page size until next_cursor is null. Do not decode or construct cursors. Detail and analytics responses use a data object.
Conversion and analytics dates use from/to in YYYY-MM-DD, UTC, both inclusive. The maximum and default window is 30 calendar days. Future dates are rejected. Records use event_at. October 1–7 covers seven days; September 10–October 9 covers 30. Split longer histories into separate windows.
Offer lists accept status and payout_model; campaigns accept status and offer_id; conversions accept status, event_type, offer_id, campaign_id, from, to. Analytics accepts the latter five without status. Details and company accept no query parameters. Unknown fields return 422. A successful zero means no records in that window; a 503 is not zero conversions.
Errors and maintenance
401: check token and expiry. 403: check scopes and account status. 404: missing/inaccessible object or disabled API. 405: unsupported method. 422: invalid parameters. 429: wait for Retry-After. 503: retry later with backoff. Do not endlessly retry 401/403.
Limits are 60 requests/minute per user across tokens, plus 10 analytics requests/minute per user/context. Rotate by creating a replacement, updating your integration and revoking the old key. Changing your password invalidates existing tokens. Revoke a leaked token immediately.
Start with a short period and reconcile record counts and statuses with the dashboard for the same UTC window. Track the last successful sync and failures separately from data. Contact support with the path without credentials, time, response code and a redacted description.