# Cash Nutra Partner Offer API

Use this API from a backend service only. Never place a Cash Nutra API token in browser code, mobile apps, public repositories, analytics tags, landing pages, or shared screenshots.

Base URL:

```txt
https://www.cash-nutra.com/api/partner-offer-api/v1
```

Authentication:

```txt
Authorization: Bearer cn_live_your_private_token
```

## Offer Access Request

When an offer has `access_status = requires_approval`, submit an access request before sending traffic.

`traffic_sources` is required. Cash Nutra uses it to validate campaign fit, compliance risk, expected volume, tracker setup, and postback readiness. A request never creates traffic access by itself. A Cash Nutra manager must approve the request first.

```bash
curl -sS -X POST \
  -H "Authorization: Bearer cn_live_your_private_token" \
  -H "Content-Type: application/json" \
  -d '{
    "campaign_id": "campaign-id",
    "traffic_sources": ["native", "social"],
    "requested_geos": ["GB", "US"],
    "monthly_volume": "10k-50k clicks",
    "tracker_name": "Keitaro",
    "postback_url": "https://tracker.example/postback?click_id={click_id}",
    "promotion_plan": "Native prelander test with controlled daily cap",
    "compliance_notes": "No forbidden claims; creatives can be reviewed before launch"
  }' \
  "https://www.cash-nutra.com/api/partner-offer-api/v1/offer-requests"
```

Request fields:

| Field | Required | Type | Notes |
| --- | --- | --- | --- |
| `campaign_id` | Yes | string | Cash Nutra offer id from `GET /offers`. |
| `traffic_sources` | Yes | string[] | Examples: `native`, `social`, `email`, `push`, `display`, `search`, `seo`, `influencer`. |
| `requested_geos` | No | string[] | ISO-like country codes or campaign GEOs the affiliate wants to run. |
| `monthly_volume` | No | string | Estimated click volume bucket. |
| `tracker_name` | No | string | Keitaro, RedTrack, Voluum, Binom, ClickFlare, AnyTrack, custom platform, etc. |
| `postback_url` | No | string | HTTPS postback template for review. It is not called when a request is created. |
| `promotion_plan` | No | string | Angle, prelander, launch timing, cap, and ramp-up context. |
| `compliance_notes` | No | string | Ad review status, traffic restrictions, claim limits, or creative review notes. |
| `message` | No | string | Legacy free-text note. Prefer the structured fields above. |

Successful response:

```json
{
  "data": {
    "id": "request-id",
    "campaign_id": "campaign-id",
    "campaign_name": "Offer name",
    "campaign_source": "cashnutra",
    "cpa": 160,
    "status": "pending",
    "traffic_sources": ["native", "social"],
    "requested_geos": ["GB", "US"],
    "monthly_volume": "10k-50k clicks",
    "tracker_name": "Keitaro",
    "postback_url": "https://tracker.example/postback?click_id={click_id}",
    "promotion_plan": "Native prelander test with controlled daily cap",
    "compliance_notes": "No forbidden claims; creatives can be reviewed before launch",
    "created_at": "2026-09-02T14:21:50Z"
  }
}
```

## Security Rules

- The API returns only Cash Nutra offer ids, public offer metadata, payout, approved GEOs, allowed traffic sources, access status, and opaque Cash Nutra tracking URLs.
- Advertiser destinations, internal source systems, checkout configuration, provider URLs, private approval notes, service-role keys, database table names, and internal CRM details are not part of the public partner contract.
- `tracking_url` must start with `https://www.cash-nutra.com/c/`.
- Do not reconstruct `aff_id`, `campaign_id`, `c_id`, `click_id`, or internal redirect parameters yourself.
- Store tokens server-side, rotate immediately if exposed, and use one token per affiliate/platform connection.
- Use `GET /offer-requests` to sync request status instead of resubmitting duplicates.

## Approval Flow

1. Pull offers with `GET /offers`.
2. Display only offers with `access_status = available` or `approved` and a non-empty `tracking_url`.
3. For `requires_approval`, collect traffic source, GEO, volume, tracker, postback and compliance notes.
4. Submit `POST /offer-requests`.
5. Wait for `pending`, `approved` or `rejected` from `GET /offer-requests` or the next `GET /offers` sync.
6. Start traffic only after the feed returns an approved/available offer with an opaque tracking URL.