Collection manifest

A public JSON document every site serves. Auditable by humans and agents.

Shape

GET /api/sites/example.com/manifest

{
  "name": "Vector 5 Analytics",
  "site": "example.com",
  "cookies": false,
  "local_storage": false,
  "fingerprinting": false,
  "ip_stored": false,
  "visitor_hash": "sha256(daily_salt || site_id || ip || user_agent); salt rotates 00:00 UTC",
  "retention_days": 730,
  "fields": ["path", "referrer_host", "utm", "country", "device",
             "browser", "os", "actor", "ai_source", "event_name"],
  "cannot_know": [
    "Who a visitor is",
    "Whether they returned after midnight UTC",
    "Cross-site or cross-device identity",
    "Exact address or city",
    "Anything about visitors who block the request"
  ]
}

Fetch it

No auth. CORS is open. Anyone can curl it. retention_days comes from the site row (default 730).

terminal

curl https://analytics.example.com/api/sites/example.com/manifest

Verify with an agent

The Collection manifest check skill asks an agent to fetch the manifest and confirm the deployed tracker still matches the claims.