Manage affiliate programs, affiliates, customers, conversions, commissions and payments through the Tapfiliate REST API.
Tapfiliate ships in the w6w first-party pack. It declares 46 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.
io.w6w.tapfiliateTapfiliate is an affiliate marketing platform: programs define how affiliates are paid, affiliates promote via referral links or coupons, and customers/conversions they bring in generate commissions that flow into payments.
This app covers that whole lifecycle — creating and managing affiliates, affiliate groups and prospects; tracking customers and conversions and attributing them to an affiliate via referral code, coupon, click id or tracking id; adding, approving and disapproving commissions; enrolling and approving affiliates into programs; and recording or cancelling payments. A small clicks surface (Enterprise-plan-only per the vendor’s own docs) supports a REST-only tracking integration with no JS snippet.
Health checks track Tapfiliate’s own status page (a SorryApp-hosted page, anchored on its “Tapfiliate API” component specifically) alongside the account’s live rate-limit headroom.
Three routes to the same 46 actions. The Workflow tab is generated from Tapfiliate's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
affiliate-balances-get Fetch an affiliate's outstanding balances, one amount per currency.
affiliate-list List affiliates, optionally filtered by click, source, email, referral code, parent, or group.
affiliate-programs-list List the programs an affiliate has applied to or joined, with their referral links.
affiliate-prospect-create Create an affiliate prospect, optionally against a specific program or group.
affiliate-prospect-list List affiliate prospects — people who have signed up but not yet been promoted to full affiliates — optionally filtered by email, referral code, program, or group.
click-create Record a click for an affiliate's referral code, returning a click id to attribute a later conversion to.
click-get Fetch detailed information about a click, including device/browser and geolocation. Enterprise plan only.
click-list List clicks, optionally filtered by program, affiliate, or date range. Enterprise plan only.
commission-list List commissions, optionally filtered by affiliate, approval status, or paid state.
commission-update Update a commission's amount, comment, approval, or its conversion's sub-amount (recalculates it).
conversion-commissions-add Add one or more commissions (per the program's commission structure) to an existing conversion.
conversion-create Track a conversion, attributed to an affiliate via a customer id, coupon, referral code, click id, or asset/source id pair.
conversion-list List conversions, optionally filtered by program, external id, affiliate, or date range.
customer-create Create a customer, attributed to an affiliate via a coupon, referral code, click id, or asset/source id pair. Requires customer_id; every other attribution field is optional but at least one should be set to credit an affiliate.
customer-list List customers, optionally filtered by program, your own customer id, or affiliate.
customer-uncancel Un-cancel a customer — it jumps back to the status it would otherwise be at.
payment-create Record a single payment to an affiliate, deducting it from their balance.
program-affiliate-add Add an existing affiliate to a program, optionally pre-approved and/or with a coupon.
program-affiliate-approve Approve an affiliate's application to a program.
program-affiliate-disapprove Disapprove an affiliate's application to a program.
program-affiliates-list List the affiliates in a program, including their program-specific referral link and coupon.
program-commission-types-list List a program's commission types (and any per-affiliate-group overrides).
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Tapfiliate's real ids.
{
"manifestVersion": "2",
"name": "tapfiliate-example",
"steps": [
{
"id": "affiliate-balances-get",
"uses": {
"app": "io.w6w.tapfiliate",
"action": "affiliate-balances-get",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"affiliateId": "<affiliateId>"
}
}
]
}affiliate-balances-get affiliate-create affiliate-get affiliate-group-create affiliate-group-list +41 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Tapfiliate, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Tapfiliate. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "affiliate-balances-get",
payload: {
affiliateId: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value); npm install -g @w6w/cli w6w run conn_YOUR_CONNECTION_ID --action affiliate-balances-get --payload '{"affiliateId":"<value>"}' Give an AI agent Tapfiliate — without giving it Tapfiliate's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.tapfiliate#affiliate-balances-get",
"input": {
"affiliateId": "<affiliateId>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Tapfiliate connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Tapfiliate's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Tapfiliate itself is MIT, and the runtime that executes it is source-available (FSL).
Tapfiliate declares its own checks, so its health is a property of the app rather than something the host guesses at.
Component status from status.tapfiliate.com (a SorryApp-hosted page). The verdict tracks only the "Tapfiliate API" component — the Webapp, Tracking Servers, Tracking Script and Assets components are reported for context but do not affect this app's own calls.
X-Ratelimit-Limit / X-Ratelimit-Remaining / X-Ratelimit-Reset, read off a GET /programs/ call. This is the only headroom signal Tapfiliate documents — there is no separate quota or usage endpoint.