# Report a step of the sign in window

> Report a step of the sign in window: CustomDomain™ API reference in the cloud browser group. Covers parameters, request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/cloud-browser/browserSessionEvent

## `POST https://api.customdomain.ai/v1/browser-sessions/{sid}:event`

The popup reports one step of its window, for the sign in funnel: the sheet shown, a code or push prompt, a social sign in card, the typing overlay, the hand back for a password, the manual steps taken, the window closed. The control plane records it with the states it writes itself and counts it per provider. It changes nothing about the session and is not a heartbeat. `detail` is one short word (an `sms`, a `google`), never anything the customer typed, a page, an address or a URL: the closed alphabet refuses a space, a slash, a question mark, an equals sign and an at sign. A session that has ended still takes a step (the window closes after the end) while it answers its last view. At most 30 steps a minute per session. A `navigator.sendBeacon` cannot set headers, so, as for `:cancel`, the token may come in the body as `token` with a content type of `text/plain` or JSON.

### Authentication

`browserSession`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `sid` | path | string | yes | The cloud browser session id, `bs_` and 32 hex characters. |

### Request body (JSON)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `step` | `sheet_shown`, `sheet_accepted`, `sheet_declined`, `code_shown`, `code_sent`, `push_shown`, `social_card_shown`, `social_try_anyway`, `social_declined`, `passkey_shown`, `overlay_shown`, `overlay_sent`, `handback_shown`, `fallback_manual`, `window_closed` | yes |  |
| `detail` | string | no | One short word that goes with the step, never personal data, typed text or a URL. |
| `token` | string | no | The session token, only when it cannot be sent as a header (a beacon). |

### Responses

| Status | Description |
| --- | --- |
| `204` | Recorded. |
| `400` | `invalid_request`: the body is not the object above, the step is not one of the list, or the detail is not a short word. |
| `401` | `browser_expired`: the token is wrong, expired, or for another session. |
| `404` | Error envelope: {code, title, details}. |
| `429` | `browser_rate_limited`: more than 30 steps in a minute for this session. |
| `503` | Error envelope: {code, title, details}. |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.