Tracking

Read individual recorded website arrivals with their source, channel, campaign and timestamp, newest first. Later retargeting visits remain separate and never replace the contact's original source. Reads page-view acquisition evidence independently of ordinary browsing events; legacy rows use their recorded UTM/referrer when no explicit arrival marker exists. Each arrival carries url: the safe reopenable address for that visit, with its recorded query preserved and sensitive parameters stripped, or null when the stored address cannot be reopened. Filter by contact, resolved person, browser or site. Results follow the event retention window (395 days by default) and collection consent/limits; these are observed website arrivals, not ad impressions or a verified platform engagement report. Use nextOffset to load more; null means no more matching rows. Read-only, sends no messages and incurs no advertising cost.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.acquisition_history \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_acquisition_history at https://app.chirply.io/api/mcp, same bearer token, same input.

Allow a website address to report tracking data against this site. THIS GRANTS THAT DOMAIN WRITE ACCESS TO THIS ORGANIZATION'S CRM: anything served from that origin can create page views and, while 'Match form fills to contacts' and 'Add new people as contacts' are on, create real contact records. Add only hosts the tenant actually controls — a typo'd or attacker-supplied origin is a standing injection route into the CRM, and nothing else re-checks it. Add every host the script legitimately runs on: apex, www, and staging. Removing it again is tracking.remove_origin.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.add_origin \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11",
    "origin": "example"
  }'

Over MCP the same operation is the tool tracking_add_origin at https://app.chirply.io/api/mcp, same bearer token, same input.

Count recorded browsers on one website in a time range: identified and unknown browser records, distinct matched CRM contacts, and distinct fingerprints on unknown browsers. A contact may use multiple browsers; fingerprints estimate device identity and traffic may include bots. Counts include every matching row, without a recent-list cap. Read-only; sends no messages and incurs no provider charges.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.browser_summary \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11",
    "since": "2026-09-17T15:00:00Z"
  }'

Over MCP the same operation is the tool tracking_browser_summary at https://app.chirply.io/api/mcp, same bearer token, same input.

Check whether a tracked website's script is actually working, and explain why not if it isn't. Reports whether any beacon has ever arrived, when the last one did, and the specific blocker when one exists (collection paused, or no allowed website addresses so everything is being ignored). Read-only — it inspects what has already been received rather than fetching the site.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.check_install \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_check_install at https://app.chirply.io/api/mcp, same bearer token, same input.

Register a website for tracking and mint its public embed key. Collection FAILS CLOSED: until at least one allowed origin is added (pass `origin`, or call tracking.add_origin), the script records nothing. Creating a site costs nothing and sends nothing.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.create_site \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Example"
  }'

Over MCP the same operation is the tool tracking_create_site at https://app.chirply.io/api/mcp, same bearer token, same input.

PERMANENTLY delete one session recording and the stored video-like event data behind it. Cannot be undone. Use it to honour a visitor's erasure request, or to drop a recording that captured something it shouldn't have.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.delete_replay \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_delete_replay at https://app.chirply.io/api/mcp, same bearer token, same input.

Permanently delete a tracked website, along with every visitor and event recorded for it. The embed key stops working, so the script left on the site becomes a no-op. Contacts and their timeline entries are NOT deleted. This cannot be undone.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.delete_site \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_delete_site at https://app.chirply.io/api/mcp, same bearer token, same input.

Report whether this workspace is currently hiding bot traffic from its visitor screens. When hideBots is true, visits whose recorded browser identity is an identified or suspected crawler, unfurler or script are left out of the Live Visitors board, the Activity Log's website visits and every count above them, and the Traffic & Sources report defaults to its Exclude bots filter. Nothing stops being collected and nothing is deleted at any setting — the evidence stays on every row, the report's estimated bot share is still measured before the filter, and turning it off restores every hidden row. Visits with no recorded browser identity are never hidden, because rows that predate user-agent capture carry none and hiding those would remove real history. Read-only: changes nothing and costs nothing.

Parameters

No parameters — POST an empty body.

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.get_bot_visibility \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{}'

Over MCP the same operation is the tool tracking_get_bot_visibility at https://app.chirply.io/api/mcp, same bearer token, same input.

Fetch one page's heat map: which elements get clicked and how often (keyed by CSS selector, so it stays correct across screen sizes), the scroll-depth curve in 5% bands, and optionally the raw click density grid. Aggregate counts only — a heat map cannot be traced back to an individual visitor. Read-only, and free.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.get_heatmap \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_get_heatmap at https://app.chirply.io/api/mcp, same bearer token, same input.

Fetch one resolved visitor (person) with their whole story across every device: totals, first-touch attribution, the individual browsers folded into them, known IP addresses, and their most recent page views and form fills. This is the 'everything this person has ever done on our sites' view behind a visitor row. contactVia says how contactId was reached: "identified" is stored on the person, "friender" was resolved at read time from the recipient FRIENDER reported for the link they arrived on — an unverified provider claim about who a link was addressed to, not a sign-in. providerReferrer names the FRIENDER account that sent that link, when the provider reported one. Read-only.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.get_person \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_get_person at https://app.chirply.io/api/mcp, same bearer token, same input.

Fetch one session recording's details — who, which page, how long, how big, and when it expires — plus the link to watch it. Does NOT return the recorded events themselves: a recording is megabytes of DOM mutations that only the player can render, and it is not something a model can usefully read. Read-only, and free.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.get_replay \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_get_replay at https://app.chirply.io/api/mcp, same bearer token, same input.

Fetch one tracking source by id. External websites include their allowed origins and exact install snippet. The system-owned 'Hosted pages' source has hosted_pages=true and covers platform-hosted websites, funnels, invoices, payment pages, and receipts automatically; no snippet or allowed-origin setup is required.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.get_site \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_get_site at https://app.chirply.io/api/mcp, same bearer token, same input.

Fetch ONE BROWSER with its attribution and, optionally, its 50 most recent events — the 'what did this browser read?' view behind a contact record. This is a single browser, not the whole human: for everything one person has ever done across all their devices, use tracking.get_person, which is what the app's Visitor page shows. When the browser was never identified but FRIENDER reported the recipient of the link it arrived on, and that recipient matches exactly one contact, the match is returned as friender_contact_id with contact_via="friender"; that is an unverified provider claim about who a link was addressed to, not a sign-in, and a forwarded link means the reader may be somebody else. contact_via="identified" means contact_id was stored by a signed token or an identify/form submission. Read-only.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.get_visitor \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_get_visitor at https://app.chirply.io/api/mcp, same bearer token, same input.

For an EXTERNAL website, return the one-line <script> tag shown by the Copy button. Never instruct a user to install this on the system-owned 'Hosted pages' source: platform-hosted websites, funnels, invoices, payment pages, and receipts are tracked automatically and require no snippet.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.install_snippet \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_install_snippet at https://app.chirply.io/api/mcp, same bearer token, same input.

List recorded website activity — page views, form fills, identifications, and custom events — newest first with pagination. Each event includes trafficClassification (status, label, confidence, agent and reason): identified_bot is a self-reported crawler, suspected_bot is an automation signature, likely_human is an estimate, and unknown means insufficient event-time evidence. Browser names are spoofable; provider identity is not verified. Legacy events remain unknown. Includes recorded_url to reopen its safe saved query. FRIENDER identify events expose identity_provider, provider_name, provider_profile and provider_referrer (sender name and fb_profile_url) in props as unverified link-recipient reports. Page views also include props.chirply_url_parameters: filtered URL parameter names mapped to arrays of distinct values, including custom parameters, retained per event rather than overwritten across visits. Sensitive names/values are excluded; capture is bounded to 64 names, 8 values per name, 500 characters per value and 8192 characters aggregate. Each event includes its own utm/referrer and props.chirply_acquisition when captured by the current tracker: v=1 with touch=null marks ordinary navigation; a touch object records that arrival's source, campaign, landing path and time. These are individual recorded arrivals, not changes to the contact's original acquisition source. Legacy rows retain raw UTM/referrer evidence. Filter by site, visitor, contact, kind, or URL path. Read-only; recorded events follow the platform's retention window (395 days by default).

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_events \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_list_events at https://app.chirply.io/api/mcp, same bearer token, same input.

List the pages that have a click/scroll heat map, busiest first, with view and click counts, rage-click totals, and how far down the page half of visitors reached. Heat is kept separately per screen size (mobile/tablet/desktop) because a phone and a desktop render different layouts — filter by `device` to compare like with like. Read-only, and free.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_heatmap_pages \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_list_heatmap_pages at https://app.chirply.io/api/mcp, same bearer token, same input.

List the website addresses a tracking site is allowed to report from. An empty list means the script records nothing at all.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_origins \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_list_origins at https://app.chirply.io/api/mcp, same bearer token, same input.

List website visitors grouped as PEOPLE rather than browsers — one entry per resolved human, folding together every device and anonymous session stitched to them. Newest activity first, with each person's visit count, device count, and a link to their contact. contactVia says how that link was reached: "identified" means it is stored on the person (a signed token or an identify/form submission), while "friender" means it was resolved at read time from the recipient FRIENDER reported for the link they arrived on — an unverified provider claim about who a link was addressed to, not a sign-in, since a forwarded link means the reader may be somebody else. The identified filter matches only the stored kind. Read-only.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_people \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_list_people at https://app.chirply.io/api/mcp, same bearer token, same input.

List session recordings — replayable captures of what a visitor did on a tracked page — newest first, with who it was (when identified), which page, how long, and whether the recording was cut off. Filter to one site, contact, or person. Recording is opt-in per site and off by default. Read-only, and free.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_replays \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_list_replays at https://app.chirply.io/api/mcp, same bearer token, same input.

List the organization's tracking sources, newest first. A source with hosted_pages=true is the system-owned 'Hosted pages' source for platform-hosted websites, funnels, invoices, payment pages, and receipts; it is tracked automatically and never needs an install snippet. Other sources are external websites that require the tracking script. Returns no visitor data.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_sites \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_list_sites at https://app.chirply.io/api/mcp, same bearer token, same input.

List individual BROWSERS seen on a tracked website — the rows the app labels "Browsers seen" — most recently active first, with their page-view counts and first-touch attribution (first referrer, landing page, and campaign parameters). One row is one browser, so the same human on a laptop and a phone appears twice; for one row per resolved person use tracking.list_people, which is what the app's own Visitors list shows. Filter by site, contact, person, identified/unknown status, fingerprint availability, last-seen timestamp and a search term matching IP, fingerprint, browser key or device user agent. Includes fingerprint, browser key and device evidence for every row. Read-only; sends no messages and incurs no provider charges.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.list_visitors \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "limit": 25,
    "offset": 0
  }'

Over MCP the same operation is the tool tracking_list_visitors at https://app.chirply.io/api/mcp, same bearer token, same input.

Who is on the organization's tracked websites right now, plus the most recent visitors. Each row includes trafficClassification with status, label, confidence, agent and reason: identified_bot (self-reported crawler), suspected_bot (automation signature), likely_human (browser estimate) or unknown. Neither browser identity nor reported engagement proves a human; provider identities are unverified. Includes: the page each person is reading, how long that page and the current session have been open, how many pages are in the current session, when activity last arrived, which visitors are known contacts, and first/latest-source attribution badges with channel and UTM/campaign details even for anonymous visitors. A visitor matched to a contact who has paid also carries that person's money — lifetime value net of refunds and monthly run rate in integer cents, their payment and live-subscription counts, and how many connected Stripe accounts they have paid — so a customer browsing your pricing page is distinguishable from a stranger; the field is absent for anyone who has never paid. Returns everyone with a live open-tab lease followed by the most-recently-seen visitors up to the limit, regardless of how long ago they left. Read-only.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.live_visitors \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11",
    "limit": 50
  }'

Over MCP the same operation is the tool tracking_live_visitors at https://app.chirply.io/api/mcp, same bearer token, same input.

Merge two resolved visitors (people) into one, for when they are really the same human seen as two and the automatic stitching missed it. Every browser, page view and form fill from the second is moved onto the first, their counts are recombined, and the second visitor is deleted. Contacts and their timelines are untouched. This cannot be undone.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.merge_people \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "survivor_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11",
    "loser_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_merge_people at https://app.chirply.io/api/mcp, same bearer token, same input.

The Website tracking landing screen's headline numbers, for the WHOLE account rather than one site: total visitors ever seen across every tracked website, how many of them are matched to a CRM contact, and how many are on the sites right now. Also lists each tracked website with its own lifetime and live counts, split into the tenant's own installed sites and the system-owned 'Hosted pages' source. These are LIFETIME totals with no date window — tracking.stats answers a single site over the last 1–90 days and cannot reproduce these numbers, and tracking.live_visitors only ever answers 'in the last few minutes'. Read-only.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.overview \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "include_archived": false
  }'

Over MCP the same operation is the tool tracking_overview at https://app.chirply.io/api/mcp, same bearer token, same input.

Stop accepting tracking data from one website address. Takes effect on the next page view; already-recorded data is kept. Removing the last origin stops collection entirely.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.remove_origin \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_remove_origin at https://app.chirply.io/api/mcp, same bearer token, same input.

PERMANENTLY delete one page's heat map — every click position, element count and scroll sample for it. There is no per-click history behind these totals, so this cannot be undone and the data cannot be rebuilt. The honest use is after a redesign, when the old clicks describe a layout that no longer exists. Collection continues from zero on the next visit.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.reset_heatmap \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_reset_heatmap at https://app.chirply.io/api/mcp, same bearer token, same input.

Turn this workspace's bot-traffic filter on or off. It is remembered until it is changed again, and it applies to everyone in the workspace at once: the Live Visitors board and page, the Activity Log's website visits, every visitor count above those lists, and the Traffic & Sources report's default filter. Setting it to true hides visits whose recorded browser identity is an identified or suspected crawler, unfurler or script; setting it to false shows them again, still labelled with what they are. This changes DISPLAY only and is fully reversible — no tracking is switched off, no stored visit, page view or contact is altered or deleted, no message is sent and nothing is charged. Visits with no recorded browser identity stay visible at either setting. Owner or admin only, because it changes what a visitor total means for every teammate reading it.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.set_bot_visibility \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "hide_bots": true
  }'

Over MCP the same operation is the tool tracking_set_bot_visibility at https://app.chirply.io/api/mcp, same bearer token, same input.

TURN SESSION RECORDING ON OR OFF for a tracked website. When on, the script captures what real visitors do on the tenant's pages — mouse movement, clicks, scrolling and DOM changes — and stores it so anyone on the team can replay the visit at tracking.get_replay. Everything a visitor types is masked in their browser before it is ever sent, and pages listed in the site's excluded paths are never recorded, but this is still the most privacy-consequential switch in the product: it is OFF BY DEFAULT and deliberately opt-in, and whoever turns it on is taking on whatever their own privacy policy and local law require them to disclose. Recordings are deleted automatically once they reach retention_days old (default 30). Turning it off stops new recordings immediately; recordings already captured are kept until they age out — delete those with tracking.delete_replay. It is split out of tracking.update_site precisely so it cannot be flipped as a side effect of editing some other setting.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.set_replay \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11",
    "enabled": true
  }'

Over MCP the same operation is the tool tracking_set_replay at https://app.chirply.io/api/mcp, same bearer token, same input.

Headline numbers for a tracked website over a recent window: page views, unique visitors seen, how many were identified as contacts, and the busiest pages. Read-only.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.stats \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_stats at https://app.chirply.io/api/mcp, same bearer token, same input.

Read historical website traffic for a date range: exact visitors (tracked browsers), reconstructed visits, page views, daily trend, destination websites and arrival sources, plus a paginated visit list. Includes paid, organic, other and unattributed visit totals, the same visits split by the fine-grained arrival channel behind each bucket (channelKinds, e.g. organic_search / meta_social / direct), source/type breakdowns and per-visit classification evidence. Filter by website, destination hostname, source, traffic channel and bot_filter (all, exclude_bots, bots_only, likely_human). Exclude bots removes entire visits with identified or suspected automation evidence; unknown visits stay included. Every aggregate, source attribution, daily chart and paginated visit follows the bot filter. trafficQuality reports unfiltered totals and per-status counts within the same date/site/source/channel scope, so bot share remains measurable after exclusion; visits expose trafficStatus. The strongest event-time signal in the retained visit before the report end determines its status, including earlier pages before the range start. Legacy evidence stays unknown; likely human is an estimate, not verified identity. Traffic type comes from the same classifier the contact records use, then rolls up into four columns. Paid requires a recognized ad-click ID or a paid medium on a known ad network; a Meta click ID alone does not establish paid status, because Meta stamps one on organic post links too — that visit reads meta_social. Organic covers search and answer engines, unpaid social posts, and direct arrivals that carried no referrer and no campaign tag, since nobody buys a click that arrives carrying nothing; channelKind separates them. Other covers email, SMS, affiliate links and referrals from other websites. Unknown means only that the visit resumed after an inactivity break with no new arrival evidence. A recorded arrival or the site's inactivity threshold begins a visit; source and channel are the visit's original event evidence, never a contact's latest source. Only retained, recorded page views count; unknown sources remain explicit. Read-only: no messages sent and no provider spend. Requires Website Visitors access.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.traffic_report \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "2026-09-17T15:00:00Z",
    "to": "2026-09-17T15:00:00Z"
  }'

Over MCP the same operation is the tool tracking_traffic_report at https://app.chirply.io/api/mcp, same bearer token, same input.

Rename a tracked website, pause or resume collection, or change how it behaves. Omitted fields are left alone. Setting status to 'paused' stops all collection immediately without the tenant editing their website's HTML. This covers every control on the site's settings screen EXCEPT session replay — screen recording is turned on and off through tracking.set_replay, which requires an explicit human approval.

Marked confirm: this operation is irreversible, reaches real people, or spends money. Holding a credential is itself the confirmation for API and MCP callers — call it only when you mean it. The in-app assistant refuses to run it without a human approving first.

Parameters

Example

curl -X POST https://app.chirply.io/api/v1/actions/tracking.update_site \
  -H "Authorization: Bearer chp_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "2f6a1c1e-6c3b-4c62-9f6e-8a2d4b7c9e11"
  }'

Over MCP the same operation is the tool tracking_update_site at https://app.chirply.io/api/mcp, same bearer token, same input.