/api/track, /api/identify) accept events; read endpoints (/api/sites/{siteId}/…) return your data as JSON. Most calls are a single request with a JSON body.
What can the API do?
The API covers 133 endpoints across 29 groups — far more than reading metrics. Alongside the analytics reads you can manage sites, define goals and funnels, drive feature flags and experiments, run surveys, build dashboards, configure alerts and scheduled reports, and operate uptime monitors. Every endpoint has its own page in the Endpoints section of this reference.How do I authenticate?
There are two credentials, and which you need depends on what you’re doing:
You create an API key in your account settings — see API keys. Reads and management are authorized by the key owner’s access, exactly as if they had signed in.
If an AI agent is doing the work rather than code you write, you can skip the HTTP calls entirely: the MCP server exposes this same surface as tools that Claude Code, Cursor, VS Code, and Codex CLI can call with the same key.
Browser ingestion is intentionally open (any origin, no credentials) so the tracker works from your visitors’ pages. Every other endpoint requires a credential, and cross-origin reads are restricted to trusted origins — a third-party site can’t read your logged-in analytics.
What do responses look like?
- Ingestion (
/api/track,/api/identify) returns204 No Content— the event is queued and written asynchronously, so there’s no response body to parse. - Reads return
200with a JSON body. List endpoints are shaped{ "data": [ … ] }.
Frequently asked questions
Do I need an API key to send events from the browser?
Do I need an API key to send events from the browser?
No. Browser ingestion needs no credential — the
data-site-id in the tracking script identifies the site. You need an API key to send events from a server, to read analytics, or to manage sites.Why do ingestion endpoints return no response body?
Why do ingestion endpoints return no response body?
/api/track and /api/identify return 204 No Content because the event is queued and written asynchronously. There is nothing to parse. Read endpoints return 200 with a JSON body instead, and list endpoints are shaped { "data": [ … ] }.What is the difference between a 401 and a 403?
What is the difference between a 401 and a 403?
A
401 means the credential is missing or invalid on a private site. A 403 means the request authenticated fine, but the key’s owner is not a member of the site’s organization.Start here
Tracking API
Send pageviews and custom events to /api/track.
Identify API
Attach a stable user ID and traits.
Analytics read API
Read overview, timeseries, and breakdowns.
All endpoints
Browse all 133 endpoints by group.
API keys
Create and manage your keys.
API playground
Run any call against your own data.