Attribution methods
The attribution waterfall for installs and re-engagements, lookback windows, view-through and household matching, re-attribution and fraud flags.
Updated 2026-09-02
Waterfall#
When POST /api/sdk/v1/install arrives, the engine tries each method in order and stops at the first match inside its window.
| Order | Method | Match key | Window |
|---|---|---|---|
| 1 | CLICK_ID | click_id sent by the SDK (deep link / universal link / clipboard) | clickLookbackDays (default 7) |
| 2 | INSTALL_REFERRER | wc_click_id or gclid parsed from the raw Android Install Referrer | clickLookbackDays |
| 3 | GCLID | gclid / gbraid / wbraid sent by the SDK | clickLookbackDays |
| 4 | APPLE_SEARCH_ADS | AdServices attribution token (iOS 14.3+) | 30 days |
| 5 | PARTNER_CLICK_ID | ttclid (TikTok), sc_click_id (Snap), Meta Install Referrer (decrypted) | clickLookbackDays |
| 6 | DEFERRED_DEEPLINK / PROBABILISTIC | Same hashed IP (per day) + OS + platform, most recent click | probabilisticHours (default 24) when probabilisticEnabled |
| 7 | VIEW_THROUGH | Impression with the same IP hash | viewLookbackHours (default 24) |
| 8 | HOUSEHOLD | Impression from the same /24 (IPv4) or /48 (IPv6) household hash — CTV | householdWindowHours (default 72) |
| 9 | SKAN | Apple SKAdNetwork postback (aggregate, no device) | Apple's timers |
| 10 | ORGANIC | Nothing matched | — |
The chosen method, click, campaign and click-to-install time (ctitSeconds) are stored on the install and returned to the SDK.
Windows per app#
All windows are per app (Apps & SDK → settings): clickLookbackDays, probabilisticHours, reattributionDays, viewLookbackHours, householdWindowHours, and the probabilisticEnabled switch for privacy-restricted markets.
Re-attribution and reinstalls#
- An install call for a known device after
reattributionDays(default 90) with a fresh click is treated as a re-attribution (is_reattribution: true). - A device that was marked uninstalled (silent-push failure) and installs again is a reinstall; both are reported separately from new installs.
- Re-engagement of an existing user via deep link is a different flow: Re-engagement.
Fraud flags on installs#
| Flag | Meaning |
|---|---|
CTIT_TOO_SHORT | Click-to-install under 10 s (click injection) |
CTIT_TOO_LONG | Over 24 h on a click-id match (click flooding) |
CLICK_FLOOD | Many clicks from the IP before the install |
DEVICE_FARM | Same IP hash produced many installs |
SDK_SPOOF | Install call fields inconsistent with the platform / SDK version |
DUPLICATE_DEVICE | Device id seen with another install inside the window |
Flags never block the SDK response; they drive the Install fraud report and postback suppression rules.
Google Ads app conversions#
When an app has Google's third-party app analytics enabled (googleLinkId, googleDevToken), each attributed install and configured in-app event is forwarded to Google's app conversion tracking API with the click's gclid and the advertising id supplied by the SDK (only under ATT / consent). Nothing else is stored.
SAN postbacks#
Meta Conversions API, TikTok Events API and Snap CAPI receive installs and events through the partner integrations under Integrations. Templates for 60+ networks live in the postback registry; see Postbacks.