# Servoki

> Privacy-first, cookieless web analytics. The dashboard is just one client of a
> complete HTTP API. Product endpoints accept an API key; account/tenancy
> management uses a browser session.

## Authentication
Send your API key (created on the dashboard API-keys page) as a Bearer token:
  Authorization: Bearer servoki_xxxxxxxxxxxxxxxx
Keys are scoped to one workspace (org). Cross-tenant requests return 403/404.

## Base URL
https://servoki.com

## Conventions
- JSON in/out. Errors: { "error": "code" } (4xx/5xx), no stack traces.
- Dates: YYYY-MM-DD (UTC). Timestamps: ISO-8601 UTC.
- Rate limit: 300 req/min per IP (stricter on auth, export, waitlist).
- Idempotency: server events dedupe on event_id; beacons on pid.
- Tenancy: 403 = cross-tenant, 404 = unknown/not visible (indistinguishable by design).

## Docs
- OpenAPI 3.1 spec: https://servoki.com/api/openapi.json
- Full reference (Markdown): https://servoki.com/docs.md
- Human landing: https://servoki.com/docs/api/

## Quickstart
- List sites:        GET  https://servoki.com/api/admin/sites
- Views/visitors:    GET  https://servoki.com/api/metrics/summary?site=example.com&from=2026-06-01&to=2026-06-26
- Record a server event: POST https://servoki.com/api/events/server  { "site":"example.com","event_type":"purchase","value":49,"currency":"USD","event_id":"order-123" }
- Export raw events: GET  https://servoki.com/api/admin/sites/example.com/export?format=ndjson