Events and identity

Track explicit events, identify visitors, and understand automatic interaction signals.

@askdepth/corev0.3.0

On this page

Track an action

import { track } from '@askdepth/core';

track('report_exported', {
  format: 'pdf',
  page_count: 12,
  from_toolbar: true,
});

track(name, properties?) returns void. It trims the name, limits it to 200 characters, and ignores empty names. It only enqueues while consent is granted and collection is active. The return value is not an acknowledgement from the collector.

Identify a visitor

import { identify } from '@askdepth/core';

identify('user_opaque_47', {
  account_tier: 'team',
  onboarding_complete: true,
});

identify(userId, traits?) sends an identify event with user_id; it does not change the active session ID or persist a user profile in the browser. IDs are trimmed and limited to 200 characters. Use an opaque application ID rather than an email address.

There is no public logout/reset method in 0.3.0. Revoking consent stops collection and clears the session. Granting consent again creates a new session for a sampled-in runtime. Do not treat identify as an authentication or authorization API.

Property and trait limits

Core sanitizes properties and traits before enqueueing them:

Value	Limit or treatment
Object keys	Up to 32 per object; keys longer than 64 characters are omitted.
Strings	Truncated to 512 characters.
Arrays	First 50 items, recursively sanitized.
Nested objects/arrays	Containers at recursion depth 3 are omitted; the root has depth 0.
Numbers	Finite numbers only.
Other scalar values	`null` and booleans are retained; functions, symbols, and `undefined` are omitted.
Sensitive key names	Password, secret, token, auth, cookie, session, email, phone, address, SSN, credit, and card matches are omitted.

Sensitive-key matching is case-insensitive and broad: it also drops a benign key containing one of those substrings. An empty sanitized object is omitted entirely. Objects must be acyclic; do not pass DOM nodes, application state trees, or arbitrary class instances.

Automatic frustration signals

Signal	Detection in this release
`RAGE_CLICK`	At least three pointer interactions within 1.5 seconds, with every pair within 30 pixels.
`DEAD_CLICK`	An interactive target followed by 800 ms without observed DOM change, navigation, or network activity. Text selection and focused text editing suppress it.
`ERROR_CLICK`	A JavaScript error/rejection within 500 ms of a click, or a network failure within ten seconds.

These are heuristics, not proof of intent or a complete error monitoring system. The SDK observes network activity by wrapping browser fetch and XMLHttpRequest. Requests made through other transports are outside that mechanism.

Suppress intentional rapid controls with data-askdepth-allow-rapid or allowRapidClickSelectors. Number inputs, spinbuttons, and adjacent number stepper buttons receive built-in exclusions.

html

<div data-askdepth-allow-rapid>
  <button type="button">Increase quantity</button>
</div>

Component metadata and caught errors

registerComponentResolver(resolver) returns an unsubscribe function. The most recently registered resolver is used to attach static component names, stack names, and source/hash attributes to frustration events. Do not return props, DOM text, or user data. Component stacks are bounded to eight entries.

reportCaughtError(error, target?, componentStack?) reports a handled JavaScript anomaly while collection is active. It uses a generic error message and bounded sanitized stack positions. React users should normally use AskdepthCatch and the provider's built-in resolver.

Last reviewed October 12, 2026SDK issue?