Privacy boundary: the External API and MCP expose aggregate analytics and
commerce metrics only. They do not return personal data, raw visitor IPs,
or DSAR/erasure surfaces. Use the dashboard Settings flows for GDPR Art. 15/17 requests.
New:
/external/data-coverage answers a question no
cookie-based analytics tool can — how many of your store's real, paid orders your
browser tag never recorded, straight from your own order record. See
below.
Authentication
- In the dashboard: Settings → API Access → Generate key (shown once).
- Send the key on every request:
X-Qusto-API-Key: qk_live_…Base URL:
https://app.qusto.io/api/v1Example:
curl -sS -H "X-Qusto-API-Key: qk_live_…" \
"https://app.qusto.io/api/v1/external/account"Endpoints
Site-scoped routes require a site_id owned by the key's workspace. Foreign sites return 403.
| Method | Path | Tier | Notes |
|---|---|---|---|
| GET | /external/account | Core+ | Workspace metadata |
| GET | /external/sites | Core+ | Sites for this key |
| GET | /external/stats/aggregate | Core+ | site_id required |
| GET | /external/stats/timeseries | Core+ | site_id |
| GET | /external/stats/breakdown | Core+ | site_id |
| GET | /external/stats/realtime | Core+ | Current visitors |
| GET | /external/events | Core+ | site_id, from, to |
| GET | /external/revenue | Core+ | Revenue summary |
| GET | /external/funnel/conversion | Core+ | Funnel signal |
| GET | /external/cart/abandonment | Growth+ | Cart abandonment visibility |
| GET | /external/customers/ltv-bands | Growth+ | Customer spend distribution, k-anonymity-suppressed |
| GET | /external/customers/ltv | Growth+ | Deprecated — returns individual rows; use ltv-bands |
| GET | /external/attribution/summary | Professional+ | Multi-touch |
| GET | /external/data-coverage | Core+ | Orders your browser tag never recorded, straight from your store's own order record |
Machine-readable contract:
/docs/api/openapi.yaml
(API 1.1.0; also used by qusto-mcp on npm).
MCP (assistants)
Use the first-party qusto-mcp server with Claude Desktop, Cursor, or any MCP client.
{
"mcpServers": {
"qusto": {
"command": "npx",
"args": ["-y", "qusto-mcp"],
"env": {
"QUSTO_API_KEY": "qk_live_…",
"QUSTO_API_BASE": "https://app.qusto.io/api/v1"
}
}
}
}Only set QUSTO_API_KEY (and optionally QUSTO_API_BASE).
Use the merchant key from Settings → API Access — never internal service keys.
Rate limits
- Default ~1 000 requests/hour per API key (enforced server-side).
- Exceeding the limit returns
429. - Revoke unused keys in Settings → API Access.
Common errors
| Status | Meaning |
|---|---|
401 | Missing/invalid/revoked API key |
403 | Site not owned, or plan lacks the feature (e.g. attribution on Core) |
429 | Rate limit exceeded |
Need help?
Generate a key under Dashboard → Settings → API Access. Product questions: hello@qusto.io.