Privacy Sandbox
Attribution Reporting API endpoints for Android Privacy Sandbox and Chrome — source and trigger registration, event-level and aggregatable reports.
Updated 2026-09-02
Endpoints#
| Method | Path | Purpose |
|---|---|---|
GET | /.well-known/attribution-reporting/register-source?link=<slug>&campaign=<id> | Responds with Attribution-Reporting-Register-Source |
GET | /.well-known/attribution-reporting/register-trigger?event=<name>&value=<n> | Responds with Attribution-Reporting-Register-Trigger |
POST | /.well-known/attribution-reporting/report-event-attribution | Event-level reports |
POST | /.well-known/attribution-reporting/report-aggregate-attribution | Aggregatable reports |
POST | /.well-known/attribution-reporting/debug/* | Debug reports |
All live on your tracking domain (the reporting origin must match the registration origin).
Android#
MeasurementManager.registerSource(Uri.parse("https://go.yourbrand.com/.well-known/attribution-reporting/register-source?link=summer&campaign=…"), inputEvent, executor, callback)
// later, in the app on conversion:
MeasurementManager.registerTrigger(Uri.parse("https://go.yourbrand.com/.well-known/attribution-reporting/register-trigger?event=purchase&value=49"), executor, callback)The Android SDK wraps both calls (registerSandboxSource, registerSandboxTrigger) and no-ops on devices without the Privacy Sandbox.
Chrome#
Add attributionsrc="https://go.yourbrand.com/.well-known/attribution-reporting/register-source?link=…" to ad <a> / <img> tags; call the trigger URL from the conversion page.
Reports#
Received reports are stored (PrivacySandboxReport) with source / trigger data, and surfaced on Integrations → Privacy Sandbox next to deterministic attribution for the same campaigns. Aggregatable reports are decrypted only if you run an aggregation service; WhichClick stores the encrypted payloads and metadata.