# URL parameters

Query strings often carry personal data: emails, customer IDs, password-reset tokens. So Punchline drops every URL parameter except `utm_*`, unless you allow it. Allowed parameters become report dimensions, and rules can use them to set a visit's channel and partner.

## Allowing a parameter

In **Site settings → URL parameters**:

- **Ad click IDs.** Tick the platforms you advertise on (`gclid`, `msclkid`, `fbclid`, `ttclid` and others). Punchline records only that the ID was there, never the ID itself, and counts the visit as paid traffic from that platform.
- **Other parameters.** One per line. A name alone records only whether the parameter was present; add `, value` to keep its value (up to 200 characters):

```text
ref, value
promo
```

Only keep values that can't identify a person: a referral or promo code, never an email, customer ID or token. Names that usually carry those (`email`, `user_id`, `customer_id`, `token`, `session` and similar) can only be kept as presence, and values that look like email addresses are removed anyway.

Every install applies the list: the browser snippet sends only allowed parameters, edge installs (Next.js, Cloudflare) fetch the list every 5 minutes and drop everything else until they have it, and the collector checks again before storing anything. Parameters are kept on the first page view of a visit, like `utm_*`.

## Rules: channel and partner

One rule per line: `parameter, match, channel, partner`. The match is `*` (present), `=value` (equals) or `value*` (starts with). Either channel or partner may be left empty, but not both:

```text
ref, acme*, affiliate, Acme
ref, =newsletter, email
promo, *, campaign
```

The first matching rule decides. Rules re-label people's visits only: an agent that follows a link with `gclid` is still in the AI agents channel, so ad spend that reaches bots shows up as such. Channels you can set: `paid`, `email`, `social`, `affiliate`, `campaign`, `referral`, `organic_search`, `direct`.

Rules apply when you query, so changing them changes past reports too.

## In reports and the API

- `param:<name>`, for example `param:ref`: the parameter's value, `"1"` for presence-only parameters, or `null` when the visit didn't have it.
- `partner`: from your rules.
- `channel`: your rules first, then the default grouping.

They work with page metrics and conversion metrics (conversions are credited to how the visit arrived), not event metrics:

```json
{
  "date_range": { "from": "2026-09-01", "to": "2026-09-30" },
  "metrics": ["conversions", "conversion_rate"],
  "dimensions": ["partner"],
  "filters": [["visitor_type", "eq", "human"]]
}
```

`list_sites` (API and MCP) lists the site's allowed parameters. As with every other dimension, groups with fewer than 5 people's page views or conversions are withheld outside your dashboard.