API & MCP

Everything the dashboard does,
the API does too.

Scoped Bearer tokens, per-key site allowlists, honest rate limits — and a zero-dependency MCP server that hands the same power to your AI agents. Every response passes the same k-anonymity post-filter the dashboard uses.

Request access See it live

The API, in five rooms

Pick your entry point.

The public surface is small on purpose: one authentication scheme, six scopes, one base path — and every call gated twice, by scope and by site allowlist.

API keys

Per-user obsk_… Bearer tokens with 6 scopes and per-key site allowlists. Secrets are SHA-256-stored and shown once; revocation is instant, with call counters and per-key rate limits.

Scoped keys

Endpoints

10 read + 2 write k-anonymized endpoints: overview, pages, acquisition, realtime, vitals, sessions, heatmaps, frustration and friends — plus programmatic site creation and server-side events.

The /api/v1 map

S2S events

Backend conversions with integrity: POST /s2s with an HMAC token records the paid invoice and the activated account. Goals stay honest because both halves are yours.

Server-to-server events

MCP server

15 tools for Claude, Cursor and Claude Code over stdio JSON-RPC 2.0 — zero dependencies, one config block. The key's scopes and site allowlist gate every tool call.

Plug in your agents

Recipes

Patterns teams actually run: register a preview site per pull request, record a smoke-test conversion after every deploy, and pull nightly aggregates into your warehouse.

CI & BI patterns

create a key

curl -X POST https://sa.yourdomain.com/api/keys \
  -H "Authorization: Bearer <session>" \
  -d '{ "name": "ci",
       "scopes": ["write:sites", "read:reports"],
       "sites":  ["obs_shop01"] }'

# → { "key": "obsk_9f2e…", "note": "shown once" }

First call

A key is the whole setup.

One key, scoped to exactly what it needs: the CI key can create sites, the BI key can only read two of them. Scopes and site allowlists gate every call — every endpoint, every MCP tool, every response. No scope, no data.

Keys are issued during onboarding; scopes and allowlists gate every call. Create, list and revoke from Settings → API keys, the CLI, or the API itself.

Scoped keys.
Zero dependencies.

Automation-grade access control on top of the deepest legal analytics you can run.

Request access Meet the MCP server

Everything the dashboard does,the API does too.