> ## Documentation Index > Fetch the complete documentation index at: https://docs.spoo.me/llms.txt > Use this file to discover all available pages before exploring further. # Public URL Statistics (password unlock) > Same as the GET variant, carrying a password in the JSON body. The body is the ONLY way a password travels to this endpoint — query-string passwords are ignored so they can't land in URLs, logs, or referrers. Wrong passwords answer 401 `invalid_password` (retryable). The body may be absent or empty. ## OpenAPI ````yaml /openapi-v1.json post /api/v1/public/stats/{short_code} openapi: 3.1.0 info: title: spoo.me description: >- REST API for spoo.me — free and open-source URL shortening service serving 400k+ redirects/day. Authenticate using either: - **API Key**: `Authorization: Bearer spoo_` - **JWT Token**: `Authorization: Bearer ` (obtained via /auth/login) - **Session Cookie**: `access_token` cookie (set automatically on login) contact: name: spoo.me url: https://spoo.me/contact email: support@spoo.me license: name: AGPL-3.0 url: https://github.com/spoo-me/spoo/blob/main/LICENSE version: 1.0.0 servers: - url: https://spoo.me description: Production security: - ApiKeyAuth: [] - JWTAuth: [] tags: - name: URL Shortening description: Create new shortened URLs - name: Link Management description: List, update, and delete your shortened URLs - name: Statistics description: Click analytics and data export - name: API Keys description: Create and manage API keys for programmatic access - name: Authentication description: Login, register, password management, and email verification - name: OAuth description: OAuth provider login, linking, and unlinking - name: System description: Health checks and server metrics paths: /api/v1/public/stats/{short_code}: post: tags: - Public summary: Public URL Statistics (password unlock) description: |- Same as the GET variant, carrying a password in the JSON body. The body is the ONLY way a password travels to this endpoint — query-string passwords are ignored so they can't land in URLs, logs, or referrers. Wrong passwords answer 401 `invalid_password` (retryable). The body may be absent or empty. operationId: getPublicStatsWithPassword parameters: - name: short_code in: path required: true schema: type: string title: Short Code - name: start_date in: query required: false schema: anyOf: - type: string maxLength: 50 - type: 'null' description: Range start (ISO 8601). Defaults to 7 days before end_date. examples: - '2025-01-01T00:00:00Z' title: Start Date description: Range start (ISO 8601). Defaults to 7 days before end_date. - name: end_date in: query required: false schema: anyOf: - type: string maxLength: 50 - type: 'null' description: Range end (ISO 8601). Defaults to now. examples: - '2025-12-31T23:59:59Z' title: End Date description: Range end (ISO 8601). Defaults to now. - name: timezone in: query required: false schema: type: string maxLength: 50 description: IANA timezone for time bucketing and formatting. examples: - UTC - America/New_York default: UTC title: Timezone description: IANA timezone for time bucketing and formatting. requestBody: content: application/json: schema: anyOf: - $ref: '#/components/schemas/PublicStatsBody' - type: 'null' title: Body responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/PublicStatsResponse' '400': description: Bad Request — invalid parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized — missing or invalid credentials content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Forbidden — insufficient permissions or scope content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - {} - ApiKeyAuth: [] - JWTAuth: [] components: schemas: PublicStatsBody: properties: password: anyOf: - type: string maxLength: 200 - type: 'null' title: Password description: Password for a password-protected link's stats. type: object title: PublicStatsBody description: Optional JSON body carrying the stats-page password. PublicStatsResponse: properties: generation: type: string enum: - v1 - v2 title: Generation link: $ref: '#/components/schemas/PublicLinkFacts' stats: additionalProperties: true type: object title: Stats description: >- The modern stats wire shape (same as GET /api/v1/stats): summary, metrics keyed '{metric}_by_{dimension}', time_range, time_bucket_info, computed_metrics. v1 links carry a 'clicks_by_bots' dimension and no 'city'/'device'; v2 the reverse. type: object required: - generation - link - stats title: PublicStatsResponse description: Response body for GET|POST /api/v1/public/stats/{short_code}. ErrorResponse: properties: error: type: string title: Error code: type: string title: Code field: anyOf: - type: string - type: 'null' title: Field details: anyOf: - {} - type: 'null' title: Details type: object required: - error - code title: ErrorResponse description: Standard error JSON body produced by the AppError exception handler. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError PublicLinkFacts: properties: alias: type: string title: Alias short_url: type: string title: Short Url long_url: anyOf: - type: string - type: 'null' title: Long Url created_at: anyOf: - type: string format: date-time - type: 'null' title: Created At status: type: string enum: - active - inactive - expired - blocked title: Status max_clicks: anyOf: - type: integer - type: 'null' title: Max Clicks block_bots: type: boolean title: Block Bots password_protected: type: boolean title: Password Protected type: object required: - alias - short_url - status - block_bots - password_protected title: PublicLinkFacts description: Public facts about the link shown above the charts. ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: spoo_ description: 'API key authentication. Pass your key as: `Bearer spoo_`' JWTAuth: type: http scheme: bearer bearerFormat: JWT description: 'JWT access token from /auth/login. Pass as: `Bearer `' ````