# Sites and team API

> Create, read, update and delete sites and every tracking setting, and list or manage workspace members and invitations.

Section: CLI, MCP and API  
Canonical page: https://statsy.co/docs/developers/api-sites-and-team  
Last updated: 2026-09-15

Sites are where a token most often starts: list them, find the one you want, and use its public key in every other path.

## Sites

| Method and path | Purpose | Role |
| --- | --- | --- |
| `GET /sites` | Lists sites in the workspace. | Any |
| `POST /sites` | Creates a site. Returns 201. | Owner or editor |
| `GET /sites/:site` | Reads one site and its settings. | Any |
| `PATCH /sites/:site` | Changes any setting. Omitted fields are left alone. | Owner or editor |
| `DELETE /sites/:site` | Deletes the site and schedules its data for purging. | Owner |

```bash
curl -X POST -H "Authorization: Bearer sta_your_token" \
  -H "Content-Type: application/json" \
  -d '{"name":"Acme","domain":"acme.com","timezone":"Europe/Berlin","currency":"EUR"}' \
  https://statsy.co/api/v1/sites
```

`name` and `domain` are required; everything else has a default. The useful settings are `mode` (`auto`, `full` or `lightweight`), `extraDomains`, `timezone` (UTC by default), `currency` (USD), `excludePaths` and `excludeIps`, `proxyHost`, `trackQueryParams`, `replayEnabled` with `replaySample`, `heatmapEnabled`, and `shareMode` (`off`, `links` or `public`) with `shareOptions`.

> **Watch out.** `DELETE /sites/:site` cannot be undone. Settings, goals, funnels, alerts and integrations go immediately, and analytics, replays and heatmaps are removed from storage within a few minutes. See [Deleting data](https://statsy.co/docs/account/delete-data).

Growth includes up to five websites; going past that returns `402 plan_limit`. Scale has no limit. See [Plans and the free trial](https://statsy.co/docs/account).

## Team

| Method and path | Purpose | Role |
| --- | --- | --- |
| `GET /team` | Lists members and pending invitations. | Any member |
| `POST /team/invites` | Invites an email as editor or viewer. Returns 201. | Owner |
| `PATCH /team/:id` | Changes a member’s role. | Owner |
| `DELETE /team/:id` | Removes a member. | Owner |
| `POST /invites/accept` | Accepts an invitation with its token. | Signed-in user |

Team membership belongs to the workspace, not to one site. Invitations can only be sent as `editor` or `viewer`; promote someone to owner afterwards with a `PATCH`. An invitation expires after seven days, and a workspace may hold 25 pending invitations and send 30 a day.

A workspace always keeps at least one owner: demoting or removing the last one returns `409 last_owner`. See [Team and roles](https://statsy.co/docs/account/team-and-roles).

> **Note.** Every write here needs a signed-in session, not a token: changing the team, managing tokens and anything to do with billing answer `403 session_required` for API tokens. Site tokens cannot reach workspace routes at all.

## The workspace itself

`GET /org` returns the current workspace: its name, plan, status and trial or renewal date. `GET /orgs` lists every workspace you belong to. This is what `statsy whoami` prints.

Previous: [Alerts and share links API](https://statsy.co/docs/developers/api-alerts-and-share)  
Next: [Plans and the free trial](https://statsy.co/docs/account)