---
title: "List a site's configuration history"
method: GET
path: "/v1/sites/{siteId}/config-versions"
tags: ["Sites"]
---

# List a site's configuration history

`GET /v1/sites/{siteId}/config-versions`

## Request

- Base URL: `https://api.ironfang.com/analytics`
- URL: `https://api.ironfang.com/analytics/v1/sites/{siteId}/config-versions`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Every configuration version the site has had, newest first, as a bounded keyset page, with who made each one. Versions are never edited. Needs analytics.sites.read.

## Query parameters

- `cursor` string
- `limit` integer

## Response `200`

A page of configuration versions

- object
  - `config_versions` ConfigVersion[], required
    - `config` SiteConfig, required: What the site's recorder may capture. Whatever this says, anything that looks like a payment card number (13 to 19 digits passing the Luhn check) is masked wherever it appears, and card, CVV, password and one-time-code fields are blocked.
      - `analytics` object: Session analytics, from SDK 0.6.0. Sessions are the root: a recording belongs to its session, so a site records only while it follows sessions, and may follow sessions without recording. The site's consent mode and excluded addresses apply as they do to recording.
        - `console_errors` boolean: Add console.error calls to sessions (SDK 0.7.0), their arguments serialised safely and scrubbed as error messages are. A version stored before this switch reads as false.
        - `enabled` boolean: Report every eligible visitor's pages from page load, recorded or not. Must be true while recording.enabled is (422 otherwise). A version stored before this rule that records reads as true.
        - `errors` boolean: Add uncaught errors and unhandled rejections to sessions.
        - `request_sample_percent` integer: The share of successful requests kept, decided per request in the browser. Failures are never sampled. A session says the share it was kept at, and how many were left out.
        - `requests` boolean: Add requests that fail (an answer of 400 or above, no answer, a timeout, a resource that did not load), that the page aborted, or that take 5 seconds or longer, to sessions.
        - `successful_requests` boolean: Add the rest, quick successes, to sessions too (SDK 0.7.0). A version stored before this switch reads as false.
      - `recording` object
        - `allowed_query_parameters` string[]: Query parameters whose values are kept in recorded URLs while record_all_query_parameters is off; all others are removed.
        - `block_selectors` string[]
        - `checkpoint_interval_seconds` integer
        - `consent` 'opt_out' | 'required': opt_out records from page load unless the page opts the visitor out with setConsent({replay: false}), which the browser remembers. required records nothing until the page grants replay consent; the site's snippet then carries data-consent="required" so nothing is requested before it.
        - `enabled` boolean
        - `excluded_ip_ranges` string[]: Visitor addresses that are never recorded, such as the site owner's own networks: public IPv4 or IPv6 addresses, or CIDR ranges such as 203.0.113.0/24 or 2001:db8:1:2::/64. A visitor inside one is refused at admission, and a recording already open from there does not continue. The list is not sent to pages; the collector's GET /v1/address tells a browser its own address and the range to add for it.
        - `mask_inputs` boolean: Mask every form field's value and text typed into an editable region.
        - `mask_selectors` string[]
        - `mask_text` boolean: Mask every text node; unmask_selectors then expose reviewed static text.
        - `max_compressed_mib` integer
        - `max_duration_minutes` integer
        - `record_all_query_parameters` boolean: Keep every query value in recorded URLs except those in removed_query_parameters. Off, only allowed_query_parameters keep theirs. Fragments are removed either way. Needs SDK 0.2.1 or later; older recorders keep only the allowed parameters.
        - `removed_query_parameters` string[]: Query parameters whose values are removed while record_all_query_parameters is on, such as a token or an email address.
        - `sample_rate_percent` integer
        - `unmask_selectors` string[]
    - `created_at` string, date-time, required
    - `created_by` string, required: The user id, or key:<id> for a platform key.
    - `id` string, uuid, required
    - `sha256` string, required: SHA-256 of the stored configuration document.
    - `site_id` string, uuid, required
    - `version` integer, required
  - `next_cursor` string, required: Opaque cursor for the next page; empty on the last page.

## Other responses

- `400`: An unknown, repeated or malformed query parameter (`invalid_query`).
- `401`: No credential, an invalid one, an expired partner integration key, or a delegated token where none is accepted (`unauthorized`, `invalid_api_key`, `api_key_expired`, `delegated_not_allowed`).
- `403`: The credential lacks the permission or scope, names another organisation, or belongs to a partner integration that is not active (`forbidden`, `insufficient_scope`, `integration_inactive`).
- `404`: No such object in this organisation (`not_found`).

---

[API](https://skmtc.dev/ironfang/apis/ironfang-analytics-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-analytics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-analytics-api/revisions/08197080c3d7?raw)