Requests issued directly from the user's browser contain a number of useful data points, namely User-Agent and X-Forwarded-For. These are necessary for Constructor to understand the origin of requests to adequately ensure DDOS prevention, however are usually not sent by default in a backend integration.

In order to power personalization, an anonymous user identifier and session identifier are stored in the user's browser and automatically transmitted with requests in a frontend integration. In a backend integration, these values will need to be read from cookies and transmitted with requests.

The following data points should be sent with requests originating server side (backend integrations):

HTTP headers

X-Forwarded-For - mandatory

Containing the IP of the origin request from the user's browser

x-cnstrc-token - mandatory

A unique string supplied by Constructor to be transmitted with requests originating from the backend. This value should be treated as sensitive information and never exposed client side

User-Agent

Containing the User-Agent of the origin request from the user's browser

Query parameters

i, s - mandatory

Client and session parameters from ConstructorioID_client_id and ConstructorioID_session_id cookies, respectively

ui - mandatory for logged-in users

A unique internal identifier for a logged-in user. Used for cross device personalization

c

Note: specification of this parameter is only necessary when a client library is not being utilized.

This parameter identifies the client the request is coming from and it should have the following format:

cio-[fe/be]-[platform]-[company name]

where

[fe/be] indicates a frontend or backend integration

[platform] indicates web or mobile platform

[company name] indicates the name of the company (should correspond with company name in dashboard)

Examples:

• The request is coming from a website - cio-fe-web-farmstand
• The request is coming from a mobile app - cio-fe-mobile-farmstand
• The request is coming from a backend server - cio-be-web-farmstand

origin_referrer

The page URL of the originating client side request

_dt

Current UNIX timestamp of request (ex: 1634170420420)

Domain

Requests must also be pinned to a single data center. In order to do this, we’ll provide a specific subdomain which you’ll use to interact with Constructor’s API. That is, all calls will be sent to https://[subdomain].cnstrc.com, where [subdomain] is a string that will be provided to you by your integrations engineer.

Note: this does not apply to calls to update catalogs.

For more information about data center pinning, please see Data center pinning.

Client libraries

The suite of Constructor client helper libraries simplify the process of sending the parameters listed in the context of a backend integration. For more detailed instructions on how to send the required backend parameters within each client library, please refer to the relevant GitHub Wiki entry: Node, Java, .NET, Python