Redirection Page

Description

Redirection page is required to bridge between two systems (Client-to-Client). It carry necessary information between our platform and partner platform. It divided by two redirection type and partner need to implement it both:

Out-bound Redirection

Where we redirecting user from our platform to partner survey page. This is necessary to provide user identifier so that partner can validate it.

Specification

We will passing query params through partner survey URL

{{partnerSurveyUrl}}/?signed={{signed-payload}}&submissionId={{submission-id}}

For security purposes, We need to encrypt the signed params. These signed params will be encrypted with a secret key. Populix will provide the secret key to be used by partner to decrypt it. Please make sure if the partner store this secret key in the safest place. The signed body payload is JSON with following key/value:

Key	Value	Description
submissionId	string, ObjectID()	User submissionId from our system to be used for many use cases by partner.
email	string	User email in plain text or hashed depending on your partnership agreement.
criteria	Array of Object: - key: the criteria key - value: the criteria value	Additional user criteria from our platform. The value depending on your partnership agreement.

Sample signed payload:

{
   "submissionId": "string",
   "email": "[email protected]",
   "criteria": [
      {
         "key": "dateOfBirth",
         "value": "1993-12-12" // "YYYY-MM-DD"
      },
      {
         "key": "socialEconomicStatus",
         "value": "Upper 1" // Lower 1, Lower 2, Middle 1, Middle 2, Upper 1, Upper 2
      },
      {
         "key": "domicile",
         "value": {
            "province": "Jawa Timur",
            "city": "Surabaya"
         },
      },
      {
         "key": "gender",
         "value": "Male" // Male, Female
      },
      {
         "key": "occupation",
         "value": "Teacher"
      },      
   ]
}

All the payload above will be encrypt with AES-256-CFB and give an output in Base64.

Here is sample pseudo-code how we encrypt it, so you have an idea how to decrypt the value later on

function encrypt(str, secret) {
    const key = Buffer.from(secret, 'hex');
    const cipher = crypto.createCipheriv('aes-256-cfb', key, key);
    let encrypted = cipher.update(str, 'utf8', 'base64');
    encrypted += cipher.final('base64');

    return encrypted;
}

main();

The signed param is is url encoded format. Therefore, please ensure that you decode the URL first before performing decryption.

---

In-bound Redirection

Where partner platform redirecting the user back into our platform via redirection URL. Basically after users complete the survey through the provided partner survey URL, Partner needs to redirect the user back to our Thank You page.

To do this, the partner must include the SUBMISSION_ID as a query parameter when redirecting to our thank you page. The URL format should be as follows:

https://{{serverUrl}}/survey/finish/COMPLETED?submissionId=<SUBMISSION_ID>

While the SUBMISSION_ID is optional, we recommend including it as a query parameter for better accuracy. You need to decrypt the signed payload in Out-bound Redirection to be able to get SUBMISSION_ID value.

Each submission is valid for 30 minutes. If we do not receive an In-bound Redirection within this period, the submission will be automatically disqualified, and the user will not receive any rewards.