HTTP API

The dashboard is a client of the same API you get. There is no private endpoint the dashboard uses that you cannot.

Keys

Your account → API keys (the account dialog, under your picture). Keys are read-only and scoped to your instance. The value is shown once.

curl -H 'Authorization: Bearer tkb_live_…' \
  'https://stats.example.com/api/v1/sites'

For automation on a machine you control, TRCKABLE_API_TOKEN sets a single bearer token at the server, without creating a key in the dashboard.

The report

One endpoint answers the whole dashboard.

curl -H 'Authorization: Bearer tkb_live_…' \
  'https://stats.example.com/api/v1/sites/tkb_a1b2c3d4/report?from=2026-09-01&to=2026-09-23'

Filterable dimensions: channel, referrer, entry_page, exit_page, campaign, source, medium, country, region, city, device, browser, os, language.

The same report, as a file

curl -H 'Authorization: Bearer tkb_live_…' -OJ \
  'https://stats.example.com/api/v1/sites/tkb_a1b2c3d4/export.csv?from=2026-09-01&to=2026-09-23&f=channel:Search'

It takes every parameter the report takes, so the file is the same question with the same answer. One long table: dimension, value, visitors, sessions, pageviews, bounce_rate, plus revenue, currency, customers once payments are connected. The total is the first row, the chart follows one bucket at a time, then every breakdown up to a thousand rows each, then goals.

The other reads

Sending events from a server

Events do not have to come from a browser. POST /api/e takes the same shape the tracker sends:

curl -X POST https://stats.example.com/api/e \
  -H 'content-type: application/json' \
  -H 'X-Trckable-Proxy-Key: …' \
  -H 'X-Real-IP: 203.0.113.9' \
  -d '{"s":"tkb_a1b2c3d4","k":"pv","u":"https://example.com/pricing","r":"https://news.ycombinator.com/"}'

The proxy key is what allows the forwarded address to be trusted. Without it, trckable uses the address it can see.

Robots

POST /api/crawl records a robot's request. Robots do not run JavaScript, so this comes from your own server — one line of middleware — and feeds the AI crawlers module.

Rate limits and errors

Ingest is limited per address and visitor, and the body is capped at 8 KB with a strict schema. Under pressure trckable answers 503 with a Retry-After and the tracker queues the event rather than dropping it.

A 5xx or 429 means "come back"; anything else is final.

Outgoing: alerts

Alerts post JSON to any URL you give them — tracking stopped, a busy day, someone paid, disk filling. The destination is checked against private and internal addresses before it is stored, so trckable cannot be pointed at something inside your network.