# analytics

Stateless API proxy for **Google Analytics 4** and **Sklik** (Seznam), running
in AppFactory behind the Caddy reverse proxy at `/apps/analytics`.

The service stores no secrets. Every credential is supplied **per request** as
an `X-` header and used only to call the upstream API.

## Endpoints

Interactive docs (Swagger UI): `/docs` — publicly `https://services.csbot.cz/apps/analytics/docs`.

| Area | Method | Path |
| --- | --- | --- |
| Meta | GET | `/health`, `/version` |
| GA4 Data | POST | `/ga/data/properties/{id}/runReport` |
| GA4 Data | POST | `/ga/data/properties/{id}/runPivotReport` |
| GA4 Data | POST | `/ga/data/properties/{id}/batchRunReports` |
| GA4 Data | POST | `/ga/data/properties/{id}/batchRunPivotReports` |
| GA4 Data | POST | `/ga/data/properties/{id}/runRealtimeReport` |
| GA4 Data | POST | `/ga/data/properties/{id}/checkCompatibility` |
| GA4 Data | GET | `/ga/data/properties/{id}/metadata` |
| GA4 Admin | GET | `/ga/admin/accounts`, `/ga/admin/accountSummaries` |
| GA4 Admin | GET | `/ga/admin/properties` (`?accountId=`), `/ga/admin/properties/{id}` |
| GA4 Admin | GET | `/ga/admin/properties/{id}/dataStreams` |
| Sklik | POST | `/sklik/login`, `/sklik/report/{entity}`, `/sklik/rpc/{method}` |
| Sklik | GET | `/sklik/limits` |

## Credentials (headers)

**Google Analytics** — token wins over service account:

| Header | Required | Meaning |
| --- | --- | --- |
| `X-GA-Access-Token` | one of these | Ready OAuth2 access token (used as Bearer). |
| `X-GA-Credentials` | one of these | Base64-encoded service-account JSON key; the proxy mints a token. |
| `X-GA-Quota-Project` | no | Google Cloud project id for quota/billing. |

**Sklik:**

| Header | Required | Meaning |
| --- | --- | --- |
| `X-Sklik-Token` | yes | Sklik API token from account settings. |
| `X-Sklik-User-Id` | no | Managed account id for agency/MCC access. |

## Run locally

```bash
pip install -r requirements.txt
uvicorn app.main:app --reload --port 8000
# open http://localhost:8000/docs
```

## Configuration (env)

Non-secret only — see [app/config.py](app/config.py): `ROOT_PATH`,
`GA_DATA_BASE_URL`, `GA_ADMIN_BASE_URL`, `GA_SCOPE`, `SKLIK_BASE_URL`,
`HTTP_TIMEOUT_SECONDS`, `LOG_LEVEL`.

See [documentation/](documentation/) for per-integration detail.