SHIP THE SDK. READ THE GRAVES.

Sign up to create your studio, add a game to mint a per-game SDK token (tmb_…), then initialize the SDK once. Managed exceptions and session heartbeats are captured automatically. Players are never anonymous: the SDK mints a persistent salted device id (dev_…) and, once SetUser runs, the session's pre-auth data merges into the real player id.

# 1. Sign up — creates your studio (you become owner)
# 2. On Games -> New game (name + engine), then open it
# 3. SDK tokens -> Mint token  (shown once - store as a build secret)

using AnkleBreaker.Tombstack;
 
Tombstack.Init("tmb_live_9f4c…a21e", "https://your-tombstack-host");
Tombstack.SetUser("user-123", steamId: "7656119…"); // when auth resolves
Tombstack.SetConsent(true);                          // GDPR / store-policy gate

Four primitives power everything in Tombstack:

Add the UPM package com.anklebreaker.tombstack in Unity 6 (6000.0)+ — download the .tgz from the download page and use Window ▸ Package Manager ▸ + ▸ Add package from tarball…:

Grab the latest .tgz from the download page (it always serves the current release).

Prefer git? Add package from git URL… works for everyone — the package lives in a public repository: https://github.com/AnkleBreaker-Studio/tombstack-unity.git#v0.19.1. Use the tarball instead if you enable Require Consent — the git mirror is still at v0.19.1, which predates the v0.19.2 fix for consent granted before initialization. On v0.19.1, a build with Require Consent ticked that grants consent early can report nothing at all. Zero-code init: create a Tombstack ▸ Config asset under a Resources/ folder named TombstackConfig — it auto-initializes on load.

After Tombstack.Init (or zero-code auto-init), the SDK is fully autonomous — no try/catch wiring, no log-shipping code:

Every crash report carries an optional kind so the dashboard stops calling every report a "crash" — the Graveyard has a Kind filter and labels each grave distinctly:

The field is optional on the wire — older SDKs omit it and the server derives the kind, so it's fully back-compatible.

Retain more or fewer launch logs via TombstackConfig ▸ Retained Launch Logs (or Init(…, retainedLaunchLogs: N), 1–10; default 3).

Logs surface in the dashboard as Player log download links on the signature detail and bug detail pages, and GDPR erasure deletes them with the player's other artifacts. All three systems are config toggles (default ON) and consent-gated: with Require Consent, nothing is captured until Tombstack.SetConsent(true).

Managed C# exceptions and session heartbeats upload automatically; failed uploads persist and retry on next launch. Capture handled exceptions explicitly to keep context.

try {
    inventory.Equip(item);
} catch (Exception e) {
    Tombstack.ReportException(e); // grouped by signature, breadcrumbs + session log attached
}

Session heartbeats fire every 60 s (they drive live CCU + the crash-rate denominator) and carry frame stats — including a per-~20 s fpsSamples series folded into the beat, so the dashboard sees sub-beat FPS without extra rows. The SDK also sends an on-demand beat when the app is backgrounded (minimized) and, best-effort, on quit, so liveness stays tight. Force one at any lifecycle moment with Tombstack.SendHeartbeatNow() — gated exactly like the periodic loop (consent + heartbeats enabled + session started) and de-duped server-side, so it never double-counts CCU.

Let players file bug reports from inside the game — optionally with a screenshot. They land in the dashboard alongside crashes.

Tombstack.ReportBug("Quest log empty after load", "ui");

Track gameplay analytics with one-liners. Events accept flat string attributes (≤32 keys) that power the event browser, per-key rollups, player timelines and funnel conditions; metrics get time-series with p50/p95/p99. Both are batched client-side (flush on count ≥ 50 / age ≥ 10 s / pause / quit) and calls made before init are buffered (64, drop-oldest) and replayed with their original timestamps once the SDK initializes.

Tombstack.TrackEvent("level_complete",
    new Dictionary<string, string> { { "level", "3" }, { "difficulty", "hard" } });
Tombstack.TrackMetric("rtt_ms", 42.5, "ms");

Typed helpers (SDK 0.10.0+) emit standard tmb.* events — plain custom events underneath, so batching, funnels and attribute filters all apply — that the dashboard auto-recognizes: tmb.progression events render an automatic level-progression table (starts / completes / fails / fail:complete / completion %) on the Analytics page, with TrackEconomy, TrackPurchase and TrackAdImpression covering economy, IAP and ads.

Tombstack.TrackProgression(ProgressionStatus.Complete, "world-1",
    level: "1-3", attempt: 2, score: 1250);
Tombstack.TrackPurchase("com.game.gems_500", "steam", "EUR", 499);

Every payload carries an environment label (default production) so one game can hold production / staging / development builds without mixing data. Set it zero-code via the Environment field on the TombstackConfig asset, or in code — an explicit SetEnvironment always wins over the config value, even when called before init. Environments are free-form (≤64 chars) and self-registering — the first heartbeat from a new label makes it appear in the dashboard's environment selector. You can also create, rename, or delete labels from the dashboard before any build reports. Every page, CSV export, the read API (?environment=) and the MCP tools filter by it.

Tombstack.Init(token, endpoint, environment: "staging");
// or, at any point (also safe before init):
Tombstack.SetEnvironment("staging");

All endpoints authenticate with a token sent as Authorization: Bearer … (or x-api-key). Two kinds exist:

The public read and triage APIs require a studio key (tmb_st_…) or a per-game token that was granted the read/write scope. A default ingest-only SDK token is rejected with 403; a missing or unknown token gets 401.

Every response uses the envelope { "success": true, "data": … } / { "success": false, "error": "…" }. Common error codes: 400 validation, 401 bad/revoked token, 404 not found, 429 rate limited (with Retry-After).

Rate limits (fixed 1-minute window). These are the ingestion limits and do not apply to the read API — see the note below, which an earlier version of this page omitted, so an integrator sizing a poller against 20,000/min would have started getting 429s at 600. 120 requests/min per IP — the abuse guard for a crash-looping client — and a deliberately high 20,000 requests/min per game key backstop, so a real crash spike across your whole player base is never throttled.

The read API (/api/v1/read/*) is bounded far lower, because each call is an aggregate query rather than a single row write: 300 requests/min per IP and 600/min per key, same 1-minute window. Size dashboards and CI pollers against those numbers, not the ingestion ones. A per-IP gate is also applied before your key is verified, so a burst of invalid keys is rejected without touching the database.

A separate editor API (/api/editor/*) powers the Unity plugin's in-editor hub — it is plugin-internal, documented in the repo's docs/API.md.

Game clients are treated as hostile input: every field is validated, clamped and rate-limited. os ∈ {windows,macos,linux,android,ios,other}, arch ∈ {x64,arm64,x86,other}, timestamps within the 90-day window.

High-frequency telemetry batches via { sentAtIso, items: [...] } (1–200 items, ≤512 KB). Each item is validated independently — a bad item is dropped and the rest stored — and carries its own occurredAtIso; the envelope's sentAtIso only computes clock skew. A batch is charged its item count against the rate window, so batching can't amplify ingest past the per-IP/per-key limit.

Events accept an optional attributes map (≤32 entries; keys ≤64 chars; values string ≤512 chars, number, or boolean). Attributes surface in the dashboard's event browser, per-key rollups, and funnel conditions, and are returned by GET /api/v1/read/events.

curl -X POST https://your-tombstack-host/api/v1/ingest/metrics:batch \
  -H "Authorization: Bearer tmb_live_9f4c…a21e" \
  -H "Content-Type: application/json" \
  -d '{
    "sentAtIso": "2026-06-11T12:00:05Z",
    "items": [
      { "name": "fps", "value": 59.8, "unit": "fps",
        "occurredAtIso": "2026-06-11T12:00:00Z",
        "buildVersion": "2.4.1", "os": "windows", "arch": "x64",
        "role": "client", "matchId": "m-1", "sessionId": "sess-9" },
      { "name": "rtt_ms", "value": 42, "unit": "ms",
        "occurredAtIso": "2026-06-11T12:00:01Z",
        "buildVersion": "2.4.1", "os": "windows", "arch": "x64",
        "role": "client", "matchId": "m-1" }
    ]
  }'

Binary artifacts upload out-of-band via presigned S3 multipart POSTs (15-min TTL) requested with boolean flags: crashes accept "minidump": true (response carries data.minidumpUpload) and bug reports accept "screenshot": true (data.screenshotUpload). Both accept "log": true to request a player-log slot (data.logUpload, text/plain). Read APIs return a short-lived logUrl wherever a log exists.

curl -X POST https://your-tombstack-host/api/v1/ingest/crashes \
  -H "Authorization: Bearer tmb_live_9f4c…a21e" \
  -H "Content-Type: application/json" \
  -d '{
    "occurredAtIso": "2026-06-08T11:40:00Z",
    "buildVersion": "2.4.1",
    "os": "windows",
    "arch": "x64",
    "signature": "SIGSEGV@InventoryService.Equip",
    "stackHint": "NullReference in InventoryService.Equip",
    "kind": "exception"
  }'

Crashes accept an optional kind ∈ crash | exception | unclean_shutdown so the dashboard labels each report accurately (and the Graveyard can filter by it). Omit it and the server derives the kind — fully back-compatible.

{
  "success": true,
  "data": { "crashId": "01J…", "minidumpUpload": null, "logUpload": null }
}

Pull aggregated and recent data back out — for dashboards, automations or your own tooling.

Live sessions — the dashboard's "Live now" panel pages through currently-live player sessions (last beat inside the ~10-minute live window). It is session-cookie authed (any studio member), not a token route:

{
  "success": true,
  "data": {
    "sessions": [ /* PlayerSession[] — newest-activity first */ ],
    "total": 137,
    "liveCount": 137,
    "hasMore": true
  }
}

Retention cohorts can also be split by ?by=country — the viewer country is server-derived at the edge (CloudFront viewer-country header, with a GeoIP fallback on the client IP), never sent by the SDK, so per-country cohorts work with no game-side field. Unknown IPs fall into an (unknown) bucket.

The five list/summary routes (crashes, crashes/summary, signatures, bug-reports, events) accept an optional ?environment= filter — production also matches legacy rows written before the environment feature, all matches everything, and omitting the param returns all environments.

Six read routes (crashes, crashes/summary, events, metrics, bug-reports, retention) also accept an optional ?platform= filter over the rows' OS signal. Valid values: all | mobile | desktop | windows | macos | linux | android | ios | other (mobile = android+ios, desktop = windows+macos+linux). Any other value is a 400 "invalid platform" — never silently ignored. crashes/summary scopes both its crash numerator and its session denominator. The filter never touches live CCU, adoption denominators or the billed monthly CCU peak — your bill never changes with it.

Fleet & log-pull writes (write scope, except fulfill which is ingest): enrich a server's metadata, raise a player-log pull, and let a targeted client honour it (uploading only its own log). The server registry row is created lazily by role=server telemetry, so POST /servers only enriches an existing server (unknown serverId → 404).

Triage writes back over the same token auth — set { "status": "open" | "resolved" | "ignored" } on a signature or a single bug report:

{
  "success": true,
  "data": {
    "totalCrashes24h": 312,
    "crashSpike": false,
    "topSignatures": [
      { "signature": "SIGSEGV@InventoryService.Equip", "count": 188, "affectedUsers": 142 }
    ]
  }
}

Funnel steps accept attribute conditions in a canonical syntax shared by the funnel URL, saved funnels, and dashboard widgets: name alone, name{key=value} (equals), or name{key!=value} (not-equals). Multiple conditions are ;-separated and ANDed (max 4 per step); values are compared as strings; != also matches events that don't carry the key. The same key=value;key2!=value2 shape drives the page-wide ?attr= filter, and ?player= scopes the whole analytics page to one userId. In the UI a 3-dropdown picker (key / = ≠ / value) is fed by a persistent per-event attribute catalog, so attributes stay selectable even after their rows age out of the studio's retention window (30 days on the free tier, up to 90 configurable).

purchase_completed{tier=gold;region!=eu}

Upload debug symbols (PDB / dSYM / .sym) per build from CI so a symbol set is on file for every build, ready for native frames to resolve as that step ships — the tombstack-symbols CLI wraps these calls. Managed (C#) stack traces are already readable without any upload. Registration is idempotent on (game, build, debugId, module) and returns a presigned S3 POST for the file. POST needs the write scope: use a studio key (tmb_st_…) with ?gameId= — per-game tokens are ingest-only and 403 here.

curl -X POST "https://your-tombstack-host/api/v1/symbols?gameId=<gameId>" \
  -H "Authorization: Bearer tmb_st_9f4c…a21e" \
  -H "Content-Type: application/json" \
  -d '{
    "buildVersion": "2.4.1",
    "moduleName": "Game.dll",
    "debugId": "3C8DA0F8-…-1",
    "os": "windows",
    "size": 18874368
  }'

Tombstack hosts a remote MCP server — nothing to download, build, or run. Enable MCP access (€20/month per studio) on your billing page, mint a key (tmb_mcp_…) scoped to all your games or a single game, and point Claude, Cursor, or any MCP client at the endpoint:

https://tombstack.com/api/mcp

{
  "mcpServers": {
    "tombstack": {
      "type": "http",
      "url": "https://tombstack.com/api/mcp",
      "headers": { "Authorization": "Bearer tmb_mcp_9f4c…a21e" }
    }
  }
}

claude mcp add --transport http tombstack https://tombstack.com/api/mcp \
  --header "Authorization: Bearer tmb_mcp_9f4c…a21e"

Everything you install ships from public repositories or straight from this site:

Unity SDK — AnkleBreaker-Studio/tombstack-unity (public). Install via UPM git URL https://github.com/AnkleBreaker-Studio/tombstack-unity.git#v0.19.1 — or, for the current release, grab the tarball from the download page.

Native C/C++ SDK — AnkleBreaker-Studio/tombstack-native (public, v0.9.1). C99 DLL ABI for any engine, with offline crash sidecars the CLI uploader drains; minidump capture is coming (Phase 2).

CLI — tombstack-doctor, tombstack-upload and tombstack-symbols, zero-dependency Node 18+, published to the public tombstack-cli mirror — run with npx --package github:AnkleBreaker-Studio/tombstack-cli … (no checkout, no install).