Register a new dashboard user. Sends a 6-digit verification code by email and returns a JWT plus the
created (still unconfirmed) user. email, name and turnstileToken are required in practice; a
name containing a URL is rejected as spam. Rate limited to 30 requests per hour per IP.
A free-form string map. Declared as an index signature, not Record<string, string>: tsoa renders a Record as an object without properties, and with
noImplicitAdditionalProperties: silently-remove-extras every key was
stripped at the route before the service saw it (the ad click ids and the
GA session ids arrived empty).
First-touch ad click ids of the visit (gclid, gbraid, wbraid, msclkid, fbclid, li_fat_id). Stored once, never overwritten.
One immutable, sanitized marketing visit; ad IDs identify spend rows.
The visitor's Cookiebot marketing decision on the marketing site (granted | denied),
forwarded as ad_consent. Last decision wins; see signupAttribution.ts adConsentChanges.
ref of the "Powered by Gleap" badge the visit came from (first touch).
First dashboard page of the visit (first touch).
Page that referred the first visit (first touch).
Ok