Opens and clicks

When an email reaches a company protected by Microsoft Defender Safe Links, Mimecast, Proofpoint or Barracuda, the scanner opens the links to check them before anyone reads the message. Those clicks reach our tracker like any other. We keep every one, label the ones made by a scanner, and count only clicks by a person.

Use this endpoint when your own system shows engagement, for example an offer tracker that lists who clicked a deal page.

GET /api/v1/emails/cmthjep3l03oqig01kw64on8i/events?humanOnly=true HTTP/1.1
Authorization: Bearer alk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Query	Meaning
`humanOnly`	`true` returns only events counted as a person
`type`	`OPEN` or `CLICK`

{
  "emailId": "cmthjep3l03oqig01kw64on8i",
  "humanOpens": 1,
  "automaticOpens": 0,
  "humanClicks": 2,
  "scannerClicks": 9,
  "count": 2,
  "events": [
    {
      "id": "cmz01",
      "type": "CLICK",
      "at": "2026-10-10T03:51:12.000Z",
      "url": "https://www.example.com/offers/puma-golf-mens/",
      "client": "BROWSER",
      "source": "PERSON",
      "human": true,
      "isBot": false,
      "botReasons": [],
      "botReasonLabels": [],
      "confirmed": true
    }
  ]
}

The totals always cover the whole email, even when you filter, so you can show "2 clicks" and, if you like, "9 scanner clicks left out".

Event fields

Field	Meaning
`type`	`OPEN` or `CLICK`
`url`	The page a click went to
`client`	The mail app for an open (`GMAIL`, `OUTLOOK`, `APPLE_MAIL` and so on)
`human`	Counted as a person. This is the one to filter on
`isBot`	A security scanner's click, or an automatic open such as Apple Mail Privacy Protection
`botReasons`	Every warning sign that fired, kept even when the verdict is human
`botReasonLabels`	The same reasons in plain words
`confirmed`	The browser ran our confirmation step before going on to the page. Scanners don't
`source`	`PERSON`, `MACHINE`, `DUPLICATE` (a repeat within 30 seconds) or `THREAD_REVIEW` (the email reloaded inside a reply thread). The last two count as neither a person nor a bot

Bot reasons

Reason	What it means
`before_first_open`	Clicked before the email was opened. On its own this isn't enough, because people whose mail app blocks images click without an open
`burst`	Three or more different links clicked within two minutes
`repeat_burst`	The same link hit again within seconds
`fast_after_send`	Clicked within a minute of delivery
`scanner_ip`	Came from a known security scanner or cloud network
`scanner_ua`	Came from a scanner or automated client, not a browser
`head_request`	Checked the link without opening it
`not_confirmed`	The browser never ran the confirmation step
`mail_privacy_prefetch`	Opens only: the mail app loaded images automatically

Where else the split appears

GET /api/v1/emails adds humanOpens, automaticOpens, humanClicks and scannerClicks to every row.
GET /api/v1/emails/:id adds a tracking object with the same totals and the full event list.
GET /api/v1/campaigns/:id adds the four totals to analytics, summed over every email in the campaign.

IP addresses and browser language are recorded to spot scanners, but no API response returns them.

Unknown or foreign ids return 404 { "error": "Email not found." }.

Opens and clicks

Event fields

Bot reasons

Where else the split appears

On this page