---
title: "Publish or unpublish the site's stats"
method: PUT
path: "/sites/{id}/settings/public-dashboard"
tags: ["Sites"]
---

# Publish or unpublish the site's stats

`PUT /sites/{id}/settings/public-dashboard`

## Request

- Base URL: `https://statable.com/api/v1`
- URL: `https://statable.com/api/v1/sites/{id}/settings/public-dashboard`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/statable/apis/statable-stats-api/docs/sites/:id/settings/public-dashboard/put.ts> (a function with typed inputs; its response is checked against the schema)

Owner or admin only. `enabled` must be sent explicitly — this is the one setting that changes who can SEE the data, so an absent field must not read as "turn it off".

A hobby site on a free account is always public and answers `409 hobby_always_public` to `enabled: false`. Its stats are the widget it ships, and the hash that addresses them is already in the page's markup; `enabled: true` on one succeeds as a no-op. An owner with a paid subscription (`active`, or `past_due` during a retried renewal) may turn it off.

## Request body

- PublicDashboard
  - `site_id` integer
  - `enabled` boolean, required

## Response `200`

Applied.

- PublicDashboard
  - `site_id` integer
  - `enabled` boolean, required

## Other responses

- `400`: `invalid_request` — the body or a field is not acceptable.
- `401`: Missing/malformed/invalid/revoked bearer token (`unauthorized`), or a key past its expiry (`key_expired`; the message names the expiry time).
- `403`: `insufficient_scope`, `key_not_scoped`, or `not_site_owner`.
- `404`: `write_disabled` or `unknown_site`.
- `409`: `hobby_always_public` — the site is hobby and its owner has no paid subscription, so it cannot be made private.
- `429`: Hourly account (default 2000/h) or per-key (default 600/h) limit hit (`rate_limited`). Retry after the `Retry-After` seconds. The X-RateLimit-* headers report the window that tripped (account on an account limit).
- `500`: Unexpected server error (`internal`). Report it with the `request_id` from the body or the X-Request-ID header: it is what lets the exact log entry be found, and without it a 500 can only be matched by guessing at a time window.

---

[API](https://skmtc.dev/statable/apis/statable-stats-api.md) - [All operations](https://skmtc.dev/statable/apis/statable-stats-api/llms.txt) - [OpenAPI document](https://skmtc.dev/statable/apis/statable-stats-api/revisions/352b6d47c186?raw)