MCP tool reference
55 tools, each mapping onto the REST endpoint of the same name. The scope column tells you what the API key must hold for the tool to succeed; tools marked destructive additionally require a confirm argument, which is a required property of their input schema and must equal the id of the resource being deleted. Connection instructions are on the MCP server page.
A tools/list with no cursor returns all 55 of them in one response and no nextCursor. Pagination is only a SHOULD in the MCP spec, and a client that ignores cursors would otherwise be left believing the first page is the whole server — destructive tools included. Supply a cursor and the listing pages deterministically at 20 tools per response: call it again with { "cursor": "<nextCursor>" } until a response arrives without one. Passing a cursor this server did not issue returns JSON-RPC -32602 rather than silently starting over.
Tool results are size-capped, and never silently: successful result text is truncated at 24,000 bytes and the truncated payload ends with --- MCP_RESULT_TRUNCATED ---. When you see that marker, re-run the tool with a smaller limit, an offset or a narrower date window instead of treating the partial result as complete.
Sites
list_sitesread | List every website this API key can access (owned plus accepted team memberships), newest first. START HERE — almost every other tool needs a `siteId`. Returns siteId, trackingId, name, domain, isActive, isPublic and the total accessible count.GET/api/v2/sites |
get_siteread | Full configuration for one site: identity, active/public state, data-retention settings with the owner plan cap, bot-detection and session-recording settings, the caller role (owner/admin/viewer) and the ready-to-paste tracking snippet.GET/api/v2/sites/{siteId} |
create_sitewrite | Create a new website to track. Returns the site including its public trackingId and the snippet to paste into the page HTML. API keys restricted to specific sites cannot create sites.POST/api/v2/sites |
update_sitewrite | Partially update a site — send only the fields to change, at least one. Covers renaming, changing the domain, pausing collection (isActive), publishing or unpublishing the public dashboard (isPublic mints a share URL, or revokes it), data retention, bot detection and session recording. dataRetentionDays is capped by the site OWNER plan (free 90, starter 365, growth 730, business 1095). Viewers cannot modify a site.PATCH/api/v2/sites/{siteId} |
delete_siteadmindestructive | DESTRUCTIVE AND IRREVERSIBLE — deletes a site together with all of its pageviews, events, goals, funnels and team memberships. Requires the `admin` scope, site OWNER access, and `confirm` set to the same identifier passed as `siteId`, only after the human has explicitly asked for this site to be deleted. Prefer update_site with isActive:false to merely stop tracking.DELETE/api/v2/sites/{siteId} |
Core analytics
get_site_statsread | Headline analytics for a window: unique visitors, pageviews, bounce rate, average visit duration, plus the top 10 pages, referrers, browsers and countries. Best first call for "how is my site doing?".GET/api/v2/sites/{siteId}/stats |
get_site_realtimeread | Visitors active in the last 5 minutes and the pages they are on right now. Takes no time window at all — no `range`, no `from`/`to`. For any other period use get_site_stats or get_site_pageviews.GET/api/v2/sites/{siteId}/realtime |
get_site_pageviewsread | Total pageviews, unique sessions and a day-by-day series. Pass `pathname` to narrow to a single page. Use for traffic-trend questions; use get_site_stats for the broader breakdown.GET/api/v2/sites/{siteId}/pageviews |
get_site_eventsread | The 50 most frequent custom events in the window, with counts, ordered by volume. Use to discover which event names exist before creating an event-type goal.GET/api/v2/sites/{siteId}/events |
Acquisition
get_site_channelsread | GA4-style acquisition channels — Direct, Organic Search, Paid Search, Paid Social, Organic Social, Email, Referral, AI Assistant, Other — derived from referrer plus utm_source/utm_medium. Answers "where do my visitors come from". The AI Assistant channel counts people referred by an AI assistant (ChatGPT, Perplexity, Claude, Microsoft Copilot, Google Gemini and others) and carries an `assistants` breakdown naming each one; traffic that is an assistant referral but cannot be attributed to a specific assistant appears there as "AI Assistant (unattributed)". Assistant *crawlers* are bot traffic and never appear. `visitors` is unique visitors per channel and does not sum to the site total, because one person can arrive through two channels. Default window 7 days.GET/api/v2/sites/{siteId}/channels |
Revenue
get_site_revenueread | Revenue summary plus daily trend: gross revenue from purchase/subscription/one_time events, refunds summed separately, netRevenue, order count and conversion rate (orders / unique sessions). Amounts are integers in cents — divide by 100 before presenting. Default window 30 days.GET/api/v2/sites/{siteId}/revenue |
get_revenue_by_sourceread | Revenue attributed to source/medium pairs, highest first; source falls back utm_source then referrer then "(direct)". Answers "which traffic source makes the most money". Amounts in cents, default window 30 days.GET/api/v2/sites/{siteId}/revenue/sources |
get_revenue_by_campaignread | Revenue grouped by utm_campaign (with its source/medium), highest first, with a per-campaign conversion rate. Only events carrying a utm_campaign count, so totals are lower than get_site_revenue. Amounts in cents.GET/api/v2/sites/{siteId}/revenue/campaigns |
get_revenue_by_productread | Revenue grouped by product name and category with quantity sold and average price, highest first. Only events carrying a productName are included; missing categories report as "(uncategorized)". Answers "what are my best sellers". Amounts in cents.GET/api/v2/sites/{siteId}/revenue/products |
Behaviour & performance
get_site_retentionread | Cohort retention matrix: for each cohort of first-time visitors, the percentage returning in each later period, plus the averaged curve (index 0 is the cohort period itself and is always 100). Takes NO `range` preset — control the window with granularity + periods, or startDate/endDate.GET/api/v2/sites/{siteId}/retention |
get_site_journeysread | Navigation-path analysis: the most common journeys (first five pathnames of multi-page sessions), the most frequent entry and exit pages, and average pages per session. Shows how visitors move through the site and where they leave. Default window 7 days.GET/api/v2/sites/{siteId}/journeys |
get_site_vitalsread | Core Web Vitals: p50/p75/p99 for LCP, FID, CLS, FCP, TTFB and INP, the good / needs-improvement / poor split, a daily p75 trend, and p75 per page and per device. For page-speed questions. limit/offset page the per-page breakdown only.GET/api/v2/sites/{siteId}/vitals |
Visitor profiles
list_profilesread | Search individual visitor profiles with lifetime pageview/event/revenue totals. Free-text search plus tag, country, device and identified filters. Omit the date parameters to search the full lifetime list. EXCEPTION to the `from`/`to` rules: here a lone `from` or a lone `to` does NOT restrict anything — last-seen filtering is applied only with `range`, or with `from` and `to` together.GET/api/v2/sites/{siteId}/profiles |
get_profileread | One visitor profile plus a recent-activity timeline interleaving their latest events and pageviews, newest first. Get profileId from list_profiles.GET/api/v2/sites/{siteId}/profiles/{profileId} |
Goals
list_goalsread | Conversion goals defined for a site, newest first, each with its count of unique converting sessions in the window. Set includeConversions:false for definitions only and a faster response. Default window 30 days.GET/api/v2/sites/{siteId}/goals |
get_goalread | One conversion goal with its conversion count for the window. Same window parameters as list_goals.GET/api/v2/sites/{siteId}/goals/{goalId} |
create_goalwrite | Define a conversion goal: type "pageview" with a target pathname (e.g. "/thank-you") counts visits to a page, type "event" with a target event name (e.g. "signup") counts custom events. Call get_site_events first to discover which event names actually fire. Viewers cannot create goals.POST/api/v2/sites/{siteId}/goals |
update_goalwrite | Change a goal name, type and/or target; at least one field required. Viewers cannot modify goals.PATCH/api/v2/sites/{siteId}/goals/{goalId} |
delete_goaladmindestructive | DESTRUCTIVE — permanently deletes a goal definition and its historical conversion reporting. Requires the `admin` scope and `confirm` set to the exact goalId, only after the human has explicitly asked for this deletion. The underlying pageviews and events are not touched.DELETE/api/v2/sites/{siteId}/goals/{goalId} |
Funnels
list_funnelsread | Funnel definitions for a site, newest first. Definitions only — call get_funnel_stats for step conversion and drop-off numbers.GET/api/v2/sites/{siteId}/funnels |
get_funnelread | One funnel definition and its ordered steps. Use get_funnel_stats for results.GET/api/v2/sites/{siteId}/funnels/{funnelId} |
create_funnelwrite | Define a multi-step conversion funnel. Steps are ORDERED and at least two are required; each needs a display name and the pathname visitors must reach. Viewers cannot create funnels.POST/api/v2/sites/{siteId}/funnels |
update_funnelwrite | Change a funnel name and/or its steps; at least one field required. WARNING: `steps` REPLACES the whole array, so send the complete ordered list (still minimum two). Viewers cannot modify funnels.PATCH/api/v2/sites/{siteId}/funnels/{funnelId} |
delete_funneladmindestructive | DESTRUCTIVE — permanently deletes a funnel definition and its saved step configuration. Requires the `admin` scope and `confirm` set to the exact funnelId, only after the human has explicitly asked for this deletion. The underlying pageviews are not touched.DELETE/api/v2/sites/{siteId}/funnels/{funnelId} |
get_funnel_statsread | Computed funnel performance: unique sessions reaching each step, drop-off versus the previous step, conversion versus step one, and the overall first-to-last rate (percentages to one decimal). Answers "where are people dropping out". Default window 30 days.GET/api/v2/sites/{siteId}/funnels/{funnelId}/stats |
Segments
list_segmentsread | Saved audience segments for a site. PERSONAL: only segments belonging to the API key owner are visible, never other team members.GET/api/v2/sites/{siteId}/segments |
get_segmentread | One saved segment belonging to the API key owner on this site.GET/api/v2/sites/{siteId}/segments/{segmentId} |
create_segmentwrite | Save a reusable audience filter (e.g. "Mobile visitors from Germany") owned by the API key holder. Every filter key is optional and they combine with AND.POST/api/v2/sites/{siteId}/segments |
update_segmentwrite | Rename a segment and/or change its filters; at least one field required. WARNING: `filters` REPLACES the whole object, so resend every filter you want to keep. Only the key owner own segments can be updated.PATCH/api/v2/sites/{siteId}/segments/{segmentId} |
delete_segmentadmindestructive | DESTRUCTIVE — permanently deletes a saved segment belonging to the API key owner. Requires the `admin` scope and `confirm` set to the exact segmentId, only after the human has explicitly asked for this deletion. No analytics data is removed.DELETE/api/v2/sites/{siteId}/segments/{segmentId} |
Alerts
list_alertsread | Traffic and conversion alerts the API key owner has configured for a site. Per-user: a team member sees only their own.GET/api/v2/sites/{siteId}/alerts |
get_alertread | One alert owned by the API key holder on this site.GET/api/v2/sites/{siteId}/alerts/{alertId} |
create_alertwrite | Create an email alert. `threshold` is read according to `comparison`: a percentage change for "previous_day"/"previous_week", a raw count for "absolute". Recipient defaults to the key owner account email. Viewers cannot create alerts.POST/api/v2/sites/{siteId}/alerts |
update_alertwrite | Change an alert threshold, comparison, recipient or enabled state; at least one field required. The alert `type` is immutable. enabled:false mutes without deleting. Viewers cannot modify alerts.PATCH/api/v2/sites/{siteId}/alerts/{alertId} |
delete_alertadmindestructive | DESTRUCTIVE — permanently deletes an alert configuration. Requires the `admin` scope and `confirm` set to the exact alertId, only after the human has explicitly asked for this deletion. If they merely want the emails to stop, use update_alert with enabled:false.DELETE/api/v2/sites/{siteId}/alerts/{alertId} |
Webhooks
list_webhooksread | Webhooks the API key owner has registered for a site (per-user). Signing secrets are always masked as ****<last 4>.GET/api/v2/sites/{siteId}/webhooks |
get_webhookread | One webhook owned by the API key holder. The signing secret is masked — only create_webhook ever returns it in full.GET/api/v2/sites/{siteId}/webhooks/{webhookId} |
create_webhookwrite | Register an HTTPS endpoint to receive event notifications. A signing secret is generated server-side and returned IN FULL exactly once, in this response — surface it to the user immediately and say it cannot be retrieved again. Viewers cannot create webhooks.POST/api/v2/sites/{siteId}/webhooks |
update_webhookwrite | Change a webhook URL, subscribed events or enabled state; at least one field required. `events` replaces the whole list. The signing secret is immutable and never returned unmasked. Viewers cannot modify webhooks.PATCH/api/v2/sites/{siteId}/webhooks/{webhookId} |
delete_webhookadmindestructive | DESTRUCTIVE — permanently removes a webhook; deliveries stop immediately and the signing secret is lost. Requires the `admin` scope and `confirm` set to the exact webhookId, only after the human has explicitly asked for this deletion. update_webhook with enabled:false pauses deliveries reversibly.DELETE/api/v2/sites/{siteId}/webhooks/{webhookId} |
Annotations
list_annotationsread | Timeline annotations (deployments, campaigns, incidents, milestones) for a site. SITE-LEVEL: everyone with access sees all of them, each with its author. Use to explain traffic spikes or drops seen in get_site_pageviews.GET/api/v2/sites/{siteId}/annotations |
get_annotationread | One annotation. Readable by anyone with access to the site, whoever authored it.GET/api/v2/sites/{siteId}/annotations/{annotationId} |
create_annotationwrite | Mark a point on the site timeline so later traffic changes have context — a release, a campaign launch, an outage. Authored by the API key owner. Viewers cannot create annotations.POST/api/v2/sites/{siteId}/annotations |
update_annotationwrite | Edit an annotation date, text, colour or category; at least one field required. Only the AUTHOR may edit — another user annotation reports as not found even for the site owner.PATCH/api/v2/sites/{siteId}/annotations/{annotationId} |
delete_annotationadmindestructive | DESTRUCTIVE — permanently deletes an annotation authored by the API key owner. Requires the `admin` scope and `confirm` set to the exact annotationId, only after the human has explicitly asked for this deletion.DELETE/api/v2/sites/{siteId}/annotations/{annotationId} |
Scheduled reports
list_reportsread | Recurring email report subscriptions the API key owner has for a site (per-user), with frequency, recipient and whether each schedule is active.GET/api/v2/sites/{siteId}/reports |
get_reportread | One scheduled report configuration owned by the API key holder.GET/api/v2/sites/{siteId}/reports/{reportId} |
create_reportwrite | Schedule a recurring analytics summary email, owned by the API key holder. Recipient defaults to the key owner account email. Viewers cannot schedule reports.POST/api/v2/sites/{siteId}/reports |
update_reportwrite | Change a scheduled report frequency, recipient or enabled state; at least one field required. enabled:false pauses the schedule, true resumes it. Viewers cannot modify reports.PATCH/api/v2/sites/{siteId}/reports/{reportId} |
delete_reportadmindestructive | DESTRUCTIVE — permanently deletes a scheduled report configuration; no further emails are sent. Requires the `admin` scope and `confirm` set to the exact reportId, only after the human has explicitly asked for this deletion. update_report with enabled:false pauses it reversibly.DELETE/api/v2/sites/{siteId}/reports/{reportId} |