URL parameters

Query strings often carry personal data: emails, customer IDs, password-reset tokens. So Punchline drops every URL parameter except utm_*, unless you allow it. Allowed parameters become report dimensions, and rules can use them to set a visit's channel and partner.

Allowing a parameter

In Site settings → URL parameters:

• Ad click IDs. Tick the platforms you advertise on (gclid, msclkid, fbclid, ttclid and others). Punchline records only that the ID was there, never the ID itself, and counts the visit as paid traffic from that platform.
• Other parameters. One per line. A name alone records only whether the parameter was present; add , value to keep its value (up to 200 characters):

ref, value
promo

Only keep values that can't identify a person: a referral or promo code, never an email, customer ID or token. Names that usually carry those (email, user_id, customer_id, token, session and similar) can only be kept as presence, and values that look like email addresses are removed anyway.

Every install applies the list: the browser snippet sends only allowed parameters, edge installs (Next.js, Cloudflare) fetch the list every 5 minutes and drop everything else until they have it, and the collector checks again before storing anything. Parameters are kept on the first page view of a visit, like utm_*.

Rules: channel and partner

One rule per line: parameter, match, channel, partner. The match is * (present), =value (equals) or value* (starts with). Either channel or partner may be left empty, but not both:

ref, acme*, affiliate, Acme
ref, =newsletter, email
promo, *, campaign

The first matching rule decides. Rules re-label people's visits only: an agent that follows a link with gclid is still in the AI agents channel, so ad spend that reaches bots shows up as such. Channels you can set: paid, email, social, affiliate, campaign, referral, organic_search, direct.

Rules apply when you query, so changing them changes past reports too.

In reports and the API

• param:<name>, for example param:ref: the parameter's value, "1" for presence-only parameters, or null when the visit didn't have it.
• partner: from your rules.
• channel: your rules first, then the default grouping.

They work with page metrics and conversion metrics (conversions are credited to how the visit arrived), not event metrics:

{
  "date_range": { "from": "2026-09-01", "to": "2026-09-30" },
  "metrics": ["conversions", "conversion_rate"],
  "dimensions": ["partner"],
  "filters": [["visitor_type", "eq", "human"]]
}

list_sites (API and MCP) lists the site's allowed parameters. As with every other dimension, groups with fewer than 5 people's page views or conversions are withheld outside your dashboard.