Ingest endpoints
The browser-facing endpoints that accept errors, sessions, spans and source maps.
Ingest endpoints accept telemetry from browsers. They are deliberately separate from the rest of the API: key-authenticated rather than session-authenticated, CORS-enabled, rate limited per address, and mounted outside the JWT group.
| Endpoint | Accepts |
|---|---|
POST /ingest/web-errors | Browser errors and warnings |
POST /ingest/web-sessions | Session metadata |
POST /ingest/spans | Front-end spans for APM |
POST /ingest/sourcemaps | Source maps, so stack traces resolve to your source |
GET /ingest/ab-config | Flag and experiment configuration for the client SDK |
POST /ingest/ab-uniques | Experiment exposure counts |
All accept OPTIONS for CORS preflight.
Authentication
A key, sent by the SDK. Configure with WEB_INGEST_KEY (one) or
WEB_INGEST_KEYS (comma-separated, for rotation). WEB_INGEST_ORG_ID binds
ingested data to an organisation.
Limits
| Limit | Default | Variable |
|---|---|---|
| Events per request | 100 | WEB_INGEST_MAX_EVENTS |
| Body size | 256 KB | WEB_INGEST_MAX_BODY_BYTES |
| Requests per minute per IP | 240 | WEB_INGEST_RATE_PER_MIN |
Over-limit requests are rejected with 429 or 413. The SDK backs off.
Privacy
| Setting | Effect |
|---|---|
WEB_INGEST_SCRUB_PII | Strip likely personal data from payloads before storage |
WEB_INGEST_SCRUB_IP | Do not store client IP addresses |
Both are on in production. Scrubbing happens before the first write, not on read, so a scrubbed field was never stored.
Alerting on ingested errors
| Variable | Purpose |
|---|---|
WEB_ERROR_ALERTS_ENABLED | Master switch |
WEB_ERROR_ALERT_CHANNELS | Which channels receive them |
WEB_ERROR_SPIKE_THRESHOLD | Events in the window that count as a spike |
WEB_ERROR_SPIKE_WINDOW_SECONDS | The window |
WEB_ERROR_ALERT_COOLDOWN_SECONDS | Pause between successive spike alerts |
The SDK
@accelerup-llc/web-monitor on npm. See
Browser SDK for installation and configuration, and
for the two production mistakes worth knowing about before you deploy it.
Where this behaviour lives: backend/internal/handler/web_ingest_handler.go, backend/internal/config/config.go. If the code and this page disagree, the code is right — please fix the page.
Part of Reference — The exact numbers, names and limits, generated from the code.