Site settings

curl --request PATCH \
  --url 'https://truestat.io/api/v1/sites/{siteId}/settings' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "<string>",
  "domain": "<string>",
  "excluded_paths": [
    "<string>"
  ],
  "session_strategy": "first_party_cookie",
  "allowed_hostnames": [
    "<string>"
  ],
  "excluded_countries": [
    "<string>"
  ],
  "excluded_hostnames": [
    "<string>"
  ]
}'

{
  "data": {
    "name": "codivupload.com",
    "active": true,
    "domain": "codivupload.com",
    "excluded_paths": [
      "/admin/*",
      "/internal"
    ],
    "session_strategy": "first_party_cookie",
    "allowed_hostnames": [
      "codivupload.com",
      "www.codivupload.com"
    ],
    "excluded_countries": [
      "DE"
    ],
    "excluded_hostnames": [
      "app.codivupload.com"
    ]
  },
  "meta": {
    "site_id": "6fed8980-a119-4a9c-a4d4-53e448ef9f9e"
  }
}

The half of a site's configuration that can be changed.

Site settings (read) is the neighbour: it carries what you need to read a report correctly — timezone, retention, when measurement began. This one carries what alters collection, and it sits behind settings:write for that reason. Renaming a site is cosmetic; excluding a path stops counting traffic from the moment it is saved.

Changes apply from now on, never backwards

This is the rule to internalise before excluding anything.

Exclusions are applied by the collector, as an event arrives. So:

• Adding /admin/* removes nothing already recorded

• Removing it recovers nothing that was dropped while it was there

That is the opposite of a goal rule, which is evaluated when a report is read and therefore rewrites the past. Two features that look similar and behave in opposite directions — worth checking which one you are holding.

Lists are arrays

The dashboard's form takes a textarea and splits on newlines. A JSON caller has a real array and sends one:

{
  "excluded_paths": ["/admin/*", "/internal"],
  "excluded_countries": ["DE", "FR"]
}

The rules are identical either way — the same normalisation, the same patterns, the same limits. Entries are lower-cased and de-duplicated, and a path missing its leading / is given one, because the collector matches against a pathname that always has one.

The domain is always accepted

You never have to include the site's own domain in allowed_hostnames, and you cannot remove it — it is folded into the list on every save.

Changing domain moves no data. Past events keep the hostname they arrived with; what changes is which hostname the collector accepts next. A site pointed at a domain it does not serve simply stops counting.

Session strategy

How a returning visitor is recognised. Changing it affects future visits only: it cannot re-identify anybody already counted, and the switchover looks like a burst of new visitors who are not new.

Cookieless mode covers what each option means for accuracy.

Authorizations

Path parameters

Request bodyapplication/json

Response