Authentication
All API endpoints (except /api/auth/setup and /api/auth/login) require authentication via HTTP-only cookie.
Initial admin account creation (first run only):
POST /api/auth/setup
Login with email/password
POST /api/auth/login
Clear session
POST /api/auth/logout
Get current user info
GET /api/auth/me
Change password
POST /api/auth/password
Domains
List all registered domains
GET /api/domains
Add a new domain
POST /api/domains
Remove a domain
DELETE /api/domains/{id}
Get tracking snippet for a domain
GET /api/domains/{id}/snippet
Analytics
Summary stats
GET /api/stats/overview
Pageviews over time
GET /api/stats/timeseries
Top pages
GET /api/stats/pages
Top referrers
GET /api/stats/referrers
Device breakdown
GET /api/stats/devices
Geographic breakdown
GET /api/stats/geo
Core Web Vitals
GET /api/stats/vitals
JavaScript errors
GET /api/stats/errors
Bot traffic breakdown
GET /api/stats/bots
Fraud analysis
GET /api/stats/fraud
Query parameters
You can append query parameters to any request to refine your data. Use the following format.
?from=2024-01-01&to=2024-01-31&domain=example.com
Event ingestion
Receive tracking events (NDJSON format)
POST /i
Serve tracking script
GET /s.js