Stats API overview

Programmatic access to every metric Statable computes. Top-line totals, time-series graphs, top pages, sources, devices, geography, goals, custom events. Anything in the dashboard is reachable through HTTP. Build BI pipelines, embed charts in customer-facing apps, automate reports, pull data into your warehouse.

The same endpoints power the Statable web app, so what works for the dashboard works for you. There's no separate "public" surface with reduced fidelity. You query exactly what we query.

Status

The API itself is stable and used in production by the dashboard every day. What's still in motion is how you authenticate as a non-browser client.

API keys are coming soon

Today, all Stats API endpoints accept session cookie auth only, the same auth_token and auth_token_refresh cookies the dashboard sets after login. This works for server-side jobs and user-facing tools that can hold a cookie jar. There's no UI yet for generating long-lived API keys. Bearer-token auth (Authorization: Bearer sk_live_…) is on the roadmap and will land alongside an API Keys section in Settings . Until then, treat programmatic access as session-based.

Base URL

https://statable.com/api

All examples use that base. A dedicated https://api.statable.com host is under consideration but not the canonical address yet. Stick with statable.com/api for now.

There's no version prefix today. Future breaking changes will live behind /v1, /v2, etc., and the current unversioned surface will continue to work for a deprecation window. Non-breaking additions (new fields, new endpoints) ship in place.

What you can pull

Endpoints are grouped into eight families. Full reference: Endpoints.

Group	Examples	Use cases
Auth & Profile	`/auth/me`, `/auth/send-otp`	Identity, login, account
Sites	`/sites`, `/site`, `/add-site`	Site CRUD, sharing
Top stats & graphs	`/site/top-stats`, `/site/graphs`, `/site/compare_periods`	Headline KPIs, time-series
Pages & paths	`/site/pages`, `/site/entry-pages`, `/site/exit-pages`, `/site/folders`, `/site/status-codes`	Content performance
Sources & channels	`/site/sources`, `/site/channels`, `/site/utm/{source\\|medium\\|campaign\\|content\\|term}`, `/site/referrers`	Acquisition
Tech & Geo	`/site/browsers`, `/site/os`, `/site/devices`, `/site/countries`, `/site/regions`, `/site/cities`	Audience breakdown
Goals & custom	`/site/goals`, `/site/goal`, `/site/goals_stats`, `/site/events`, `/site/props/keys`, `/site/props/values`	Conversion, custom events
Settings & GA4	`/site/settings/blacklisted-ips`, `/site/settings/hostnames`, `/site/settings/public-dashboard`, `/ga4/*`	Configuration, imports

Every analytics endpoint accepts the same period/filter/pagination grammar, so once you query one, you can query them all.

Quick example

Top-line stats for the last 7 days, authenticated via the session cookie from /auth/verify-otp:

curl 'https://statable.com/api/site/top-stats?website_id=42&period=7d' \
  -H 'Cookie: auth_token=eyJhbGc...; auth_token_refresh=...' \
  -H 'Accept: application/json'

Response:

{
  "visitors": 12480,
  "pageviews": 38192,
  "bounce_rate": 41.2,
  "visit_duration": 184,
  "views_per_visit": 3.06
}

The same pattern fits everywhere. Pick an endpoint, pass website_id plus a period, send the auth cookie, parse JSON.

Common query parameters

Most analytics endpoints accept the same grammar. Full table in Endpoints → Common params.

website_id: numeric ID or hash string. Required everywhere except /sites and /auth/*.
period: 1r (realtime, last 30 min), 1h–24h, 1d–365d, 1m–12m, c (custom; pair with start_date/end_date), or a (all time).
interval: graph bucketing (hour, day, week, month). Auto-resolved when omitted.
limit, offset: pagination.
search: text filter where supported (e.g. /site/pages, /site/path_list).
filters: JSON or URL-encoded filter expressions. Same grammar as the dashboard filter bar.

Response shape

Every endpoint returns Content-Type: application/json. List endpoints return either a top-level array or { "data": [...], "meta": { "total": N } } depending on the resource. Single-resource endpoints (/site/top-stats, /site/goal) return a flat object.

Errors share a single envelope:

{ "error": { "code": "site_not_found", "message": "Site does not exist or is not accessible" } }

Full taxonomy: Errors.

Pagination, filtering, periods

Cross-cutting concerns each have their own page so you don't relearn them per endpoint:

Endpoints reference: full list with method, path, params, worked examples for the most common calls.
Errors: HTTP status codes, error envelope, retry guidance.
Rate limits: current state (none enforced) and what to expect.

Next step

Authenticate first. Head to Authentication to get the cookies you need before any analytics endpoint will respond with anything but 401.

Ready to take control of your web analytics? Try Statable free for 30 days — no credit card required, full feature access, GDPR-compliant by default. Start your free trial or view a live demo.