API "Create Campaign" ignores the brand's "Anonymously" tracking default (defaults to full)

mrTi

Hi everyone,

First off - thanks for Sendy, self-hosting our newsletter on it has been great. We run a privacy-focused setup and send our campaigns through the API, and I ran into something I wanted to flag (and double-check whether it's intended).

We set the brand's Privacy → "Track opens / clicks = Anonymously", expecting every campaign to be anonymous.

But campaigns created through /api/campaigns/create.php came out FULLY tracked (per-person), not anonymous...

Digging in, here's a clean repro on 7.0.5:

1. Brand → Privacy → set Track opens and Track clicks to "Anonymously". (In the DB, apps.opens_tracking = 2 and apps.links_tracking = 2.)
2. POST to /api/campaigns/create.php with send_campaign=0 (draft), and DON'T pass track_opens / track_clicks.
3. Look at the created campaign row → opens_tracking = 1, links_tracking = 1 (full).

So the campaign ignored the brand's "Anonymously" default and fell back to full tracking. From the code it looks like create.php hard-codes the fallback to 1 when the params aren't passed, rather than inheriting the brand setting (the web campaign composer DOES honour it, which is what made it surprising).

Is this intended?

My expectation was that the API would respect the brand's tracking default when the params are omitted — same as the UI. As-is, anyone who sets their brand to "Anonymously" but sends via the API will silently send fully-tracked campaigns, which is a bit of a privacy gotcha (GDPR-wise too).

Easy workaround for anyone hitting the same thing: just pass track_opens=2 & track_clicks=2 explicitly on every create.php call.

Would love to know if this is by design or something that could be aligned with the brand setting.

Thanks!
Marcin

Ben

Hi Marcin,

You're absolutely right. Thanks for taking the time to investigate and report this so thoroughly.

The API should inherit the brand's tracking settings when track_opens and track_clicks are omitted, just like the web UI does. The behavior you found was a bug.

I've fixed this, and the fix will be included in the next release.

Best regards,
Ben

Ben

Hi Marcin,

This fix has been added to the latest release (version 7.1) → https://sendy.co/get-updated

Thanks again for reporting this.

Best regards,
Ben