Public URL Statistics (password unlock)
Same as the GET variant, carrying a password in the JSON body.
The body is the ONLY way a password travels to this endpoint —
query-string passwords are ignored so they can’t land in URLs, logs,
or referrers. Wrong passwords answer 401 invalid_password
(retryable). The body may be absent or empty.
Authorizations
API key authentication. Pass your key as: Bearer spoo_<your_key>
Path Parameters
Query Parameters
Range start (ISO 8601). Defaults to 7 days before end_date.
50"2025-01-01T00:00:00Z"
Range end (ISO 8601). Defaults to now.
50"2025-12-31T23:59:59Z"
IANA timezone for time bucketing and formatting.
50"UTC"
"America/New_York"
Body
Optional JSON body carrying the stats-page password.
Password for a password-protected link's stats.
200Response
Successful Response
Response body for GET|POST /api/v1/public/stats/{short_code}.
v1, v2 Public facts about the link shown above the charts.
The modern stats wire shape (same as GET /api/v1/stats): summary, metrics keyed '{metric}by{dimension}', time_range, time_bucket_info, computed_metrics. v1 links carry a 'clicks_by_bots' dimension and no 'city'/'device'; v2 the reverse.

