Transparency contract

The exact behaviour of the certified redirect endpoint GET /c/{slug} — next-hop resolution, encoding, appended parameters, status codes.

Updated 2026-09-02

WhichClick implements Google's Transparent Click Tracker guidelines literally. This page is the contract; the compliance checklist shows how to prove it.

Endpoint#

HTTP

GET https://<tracking-domain>/c/{slug}?url=<escaped landing page>&force_transparent=true&<ValueTrack…>

Rule	Behaviour
Next hop	Taken only from the visible `url` query parameter. Aliases accepted: `u`, `redirect`, `dest`, `r`.
`force_transparent=true`	The server must follow `url` and may not substitute a stored destination. If present without `url`, the response is `400`.
Encoding	`url` may be single-, double- or triple-URL-encoded (`{escapedlpurl}`, `{lpurl+2}`, `{lpurl+3}`); it is unwrapped up to three levels.
Scheme	Only `http:` and `https:` destinations are followed. Anything else (javascript:, data:, custom schemes) → `400`.
Appended parameters	Exactly one first-party parameter, `wc_click_id` (name configurable per link, `appendClickId` can turn it off). Nothing else — no `utm_*`, no affiliate ids, no fbclid.
Existing parameters	The landing page's own query string (including `gclid` from the final URL suffix) is preserved byte-for-byte.
Response	Single `302 Found`, `Location` = next hop, `Cache-Control: no-store`. No HTML body, no JavaScript, no cookies, no redirect chains.
Fallback	Only when neither `url` nor `force_transparent` is present does the link's `defaultFinalUrl` apply (direct visits, tests).
Hostname binding	A link resolves only on the tracking domain it belongs to; other hostnames → `404`.
Bots	Verified search-engine crawlers are redirected the same way and flagged `isBot` for reporting.

Worked example#

Request

GET /c/brand-search?url=https%3A%2F%2Fyourbrand.com%2Fshoes%3Fgclid%3DCj0K%26utm_campaign%3Dbrand&force_transparent=true&gclid=Cj0K&campaignid=2098765432&keyword=running%20shoes&matchtype=e&network=g&device=m
Host: go.yourbrand.com

Response

HTTP/2 302
location: https://yourbrand.com/shoes?gclid=Cj0K&utm_campaign=brand&wc_click_id=k3Zp9Qw1mR7tXc2b
cache-control: no-store
x-whichclick-edge: cf

The stored click contains nextHopUrl, transparentParamPresent=true, forceTransparent=true, all ValueTrack values, geo, device and IP classification, and latencyMs.

Status codes#

Code	When
`302`	Normal redirect.
`400`	`force_transparent=true` without `url`; non-http destination; malformed encoding that cannot be unwrapped.
`404`	Unknown slug, paused / archived link, hostname not bound to the link, domain not verified.
`429`	Edge burst protection (only when deployed on Cloudflare).

What the redirect never does#

Read or set cookies.
Serve HTML, JavaScript, meta-refresh or interstitials.
Chain through a second tracker.
Rewrite, drop or reorder existing landing-page parameters.
Wait for the database: the click is queued and written asynchronously (see Scale & edge).

Parallel tracking#

Because Google fetches the tracking template in the background while the visitor goes straight to the final URL, the template must carry the escaped landing page in url= and must not depend on cookies. WhichClick's behaviour is identical in parallel and sequential mode, and wc_click_id is added to the parallel request so the click can still be matched to a conversion through the whichclick.js snippet or gclid.

Foreign-parameter detection#

Every click is checked after the redirect for parameters that appeared in the Location that were not in url and are not the configured click id. Any hit is logged as a compliance incident (detectForeignParamInjection) and surfaces on the Compliance dashboard — this is the check Google's reviewers perform.