# Public shareable analytics

Source: https://developers.leonai.io/docs/guides/shareable-analytics/

Share a link's performance with clients or teammates who don't have a LeonAI account.
You mint a **share token**; anyone with the token can view a read-only, **PII-free**
analytics page — no IPs, no raw events, just curated aggregates. Tokens can carry an
optional expiry and can be revoked at any time. Managing shares requires `analytics:read`;
the public view needs **no auth**. Available on **all tiers**.

## Create a share

```bash
curl -X POST https://api.short.leonai.io/api/v1/analytics/<linkId>/share \
  -H "X-API-Key: $LEONAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "expiresAt": "2026-08-01T00:00:00Z" }'
```

Response (`201 Created`):

```json
{
  "success": true,
  "data": {
    "id": "share_...",
    "token": "sh_9f3a...",
    "shareUrl": "https://short.leonai.io/s/sh_9f3a...",
    "expiresAt": "2026-08-01T00:00:00.000Z",
    "createdAt": "2026-07-11T12:00:00.000Z"
  }
}
```

`REST: POST /api/v1/analytics/:linkId/share`. `expiresAt` is **optional** — omit it for a
share that never expires. The public page lives at `/s/{token}`.

## List and revoke shares

```bash
# List all shares for a link
curl https://api.short.leonai.io/api/v1/analytics/<linkId>/share \
  -H "X-API-Key: $LEONAI_API_KEY"

# Revoke a share by id
curl -X DELETE https://api.short.leonai.io/api/v1/analytics/shares/<shareId> \
  -H "X-API-Key: $LEONAI_API_KEY"
```

`REST: GET /api/v1/analytics/:linkId/share` and
`DELETE /api/v1/analytics/shares/:id`. Revoking makes the token return `404` immediately.

## The public analytics endpoint

Anyone can fetch the curated payload with just the token — no authentication:

```bash
curl https://api.short.leonai.io/api/v1/public/analytics/<token>
```

Response (`200 OK`):

```json
{
  "success": true,
  "data": {
    "totalClicks": 1284,
    "uniqueVisitors": 902,
    "clicksByDate": [{ "date": "2026-07-10", "clicks": 143 }],
    "topCountries": [{ "country": "US", "clicks": 512 }],
    "devices": [{ "device": "mobile", "clicks": 780 }],
    "browsers": [{ "browser": "Chrome", "clicks": 641 }],
    "referrers": [{ "referrer": "twitter.com", "clicks": 210 }],
    "botClicks": 47
  }
}
```

`REST: GET /api/v1/public/analytics/:token`. The payload is deliberately **curated and
PII-free** — it exposes only `totalClicks`, `uniqueVisitors`, `clicksByDate`,
`topCountries`, `devices`, `browsers`, `referrers`, and `botClicks`. Raw events, IP
addresses, and account details are never included. (`botClicks` reflects
[bot detection](https://developers.leonai.io/docs/guides/bot-detection/).)

## Error codes

| Status | When                                 |
| ------ | ------------------------------------ |
| `404`  | Token is unknown or has been revoked |
| `410`  | Token was valid but has **expired**  |

## Related

- [Analytics & conversions](https://developers.leonai.io/docs/guides/analytics/) — the full authenticated analytics API
- [Bot detection](https://developers.leonai.io/docs/guides/bot-detection/) — how `botClicks` is classified
- [White-label branding](https://developers.leonai.io/docs/guides/white-label/) — theme the public page and hide "Powered by LeonAI"
- [API Reference](https://developers.leonai.io/docs/api-reference/) — the full OpenAPI spec and Swagger UI