Website leads and PostHog

GTM Brain is the system of record for inbound Fabric product leads. PostHog measures the anonymous product journey across *.fabric.pro; GTM Brain receives a lead only after a visitor deliberately supplies contact details and grants marketing consent.

Data boundary

• All Fabric sites use one PostHog project so a consented cross-subdomain journey is measured consistently.
• PostHog uses person_profiles: "identified_only", explicit events, and no session replay.
• Anonymous page views stay in PostHog. They are not reverse-enriched or copied into GTM Brain.
• A contact, demo, or updates submission may enter GTM Brain only with marketingConsent: true and a consent-policy version.
• Email, name, company, and attribution are staged in tenant storage before durable execution. Temporal receives only stagedLeadId.
• Audit events contain compact lead, event, product, and intent identifiers—not email addresses, messages, or browser identifiers.

PostHog destination

Create a PostHog webhook destination filtered to these events:

fabric_contact_submitted
fabric_demo_requested
fabric_updates_submitted

Use the reviewed Hog function in deploy/posthog/website-leads.hog. It repeats the event allowlist in code, exchanges the dedicated Databricks service-principal credential for a short-lived bearer token, and forwards only the strict lead payload. Keep destination response logging disabled.

Send the normalized payload to:

POST https://<gtm-api>/api/webhooks/gtm/<organization-id>/website-lead
X-GTM-Webhook-Secret: <tenant webhook secret>
Content-Type: application/json

Map PostHog properties onto the strict destination shape:

{
	"eventId": "<PostHog event UUID>",
	"event": "fabric_demo_requested",
	"distinctId": "<PostHog distinct ID>",
	"email": "maya@example.com",
	"firstName": "Maya",
	"companyName": "Example",
	"product": "harness",
	"sourceUrl": "https://harness.fabric.pro/docs",
	"occurredAt": "2026-07-22T17:00:00.000Z",
	"marketingConsent": true,
	"consentVersion": "fabric-marketing-v1",
	"consentedAt": "2026-07-22T16:59:58.000Z",
	"utmSource": "launch"
}

The destination authenticates to the Databricks App with a dedicated OAuth M2M service principal that has only CAN USE on the GTM Brain App. It also sends X-GTM-Webhook-Secret using the tenant-derived website-lead secret. The deployment root that derives that secret never leaves Databricks, and rotating it cannot interrupt reply, bounce, unsubscribe, communications, or calendar webhooks.

Because Databricks Apps do not permit anonymous ingress, the PostHog destination must exchange its client ID and client secret at the workspace /oidc/v1/token endpoint, then call GTM Brain with the returned bearer token. Store the OAuth client secret and tenant-derived webhook secret as secret PostHog inputs; do not place either value in destination source code or logs.

Redelivery is safe: GTM Brain derives stable staging, workflow, and lead-event identities from the tenant and PostHog event ID.

Fabric's existing double-opt-in newsletter is handled at the stronger confirmation boundary: after the subscriber confirms their email, the Fabric server posts a fabric_updates_submitted event with source: "fabric_web" to the same endpoint. Names remain optional so email-only opt-ins are recorded without fabricated CRM data. Configure that server with GTM_BRAIN_WEBSITE_LEAD_URL and GTM_BRAIN_WEBSITE_LEAD_SECRET.

Website configuration

Set these public variables on each fabric.pro documentation or marketing deployment:

NEXT_PUBLIC_POSTHOG_KEY=phc_...
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

The static Cloudflare landing workers for GTM Brain and Fabric Agents use the same project key through a POSTHOG_PUBLIC_KEY Wrangler secret. Their /api/analytics/config endpoint exposes only that public project token; no PostHog request is sent until the shared consent choice is granted.

The shared implementation disables autocapture and replay, records explicit fabric_page_viewed and fabric_contact_clicked events, and does not load PostHog before analytics consent. The fabric_analytics_consent cookie is scoped to .fabric.pro so the visitor's decision follows them across the product family.

CRM projection

gtm.ingest_inbound_lead consumes the private staging record through the governed Platform action pipeline. GTM Brain deduplicates leads by normalized email within a tenant, retains first and latest product interest, and records each distinct high-intent event. Tenant projections never cross organization boundaries.