Account

Site settings

One site's settings, as the reports read them.

GET/sites/{siteId}

Site settings

curl --request GET \
  --url 'https://truestat.io/api/v1/sites/{siteId}' \
  --header 'Authorization: Bearer <token>'

{
  "data": {
    "id": "6fed8980-a119-4a9c-a4d4-53e448ef9f9e",
    "name": "codivupload.com",
    "domain": "codivupload.com",
    "timezone": "UTC",
    "self_hosts": [
      "codivupload.com",
      "docs.codivupload.com"
    ],
    "first_event_at": "2026-09-03T18:40:02.000Z",
    "retention_days": 1825,
    "imported_history": false,
    "server_side_crawl_tracking": true
  },
  "meta": {}
}

The context the numbers need to be read correctly.

Not a repeat of the list row

List sites gives you names and ids. This gives you the fields that change what a figure means:

	Why it changes the reading
`timezone`	What `period=today` means when you pass no `tz`. Without it you get UTC days, which are not this site's days.
`retention_days`	How far back a window may reach before it comes back `clamped`.
`self_hosts`	Hostnames treated as internal navigation, which is why a link from your own blog is not a referral.
`first_event_at`	When measurement began. A window starting before it is not missing data.
`imported_history`	Whether imported analytics history is blended into the reports at all.

An integration that draws a chart without these gets the arithmetic right and the meaning wrong — and that kind of error never looks like an error.

Read `retention_days` before asking for a long window

This is the figure actually applied to this site's reads, resolved by the same code that does the clamping. Ask for more history than it allows and the response covers what is retained, with meta.range.clamped: true.

/usage also reports a retention figure, from the account's quota. On an internal account the two can differ. For "will my window be cut", this one is the answer.

`server_side_crawl_tracking`

Whether crawler reporting has ever run server-side for this site.

It matters when the AI endpoints look quieter than expected: the browser script cannot see a crawler that never executes JavaScript, so a site relying on the script alone under-reports crawler traffic — sometimes drastically. Server-side tracking covers how to close that gap.

The site key is not here either

Same reason as the list: it is a write credential, and returning it would let a read-only key forge traffic.

Authorizations

Authorizationstringheaderrequired

An API key from Settings → API keys. Scopes available: analytics:read, sites:read, sites:write, settings:read, settings:write, goals:read, goals:write, funnels:read, funnels:write, notes:read, notes:write, alerts:read, alerts:write, team:read, team:write, revenue:read, revenue:write.

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path parameters

siteIdstring (uuid)pathrequired

The site's id, from `GET /sites`. A site that is not yours and a site that does not exist both answer 403, so this cannot be used to discover other people's ids.

Response

application/json

The answer.

dataobject

metaobject

errorobject