generated: '2026-08-13'
method: generated
source: >-
  openapi/ operationIds (grepped, not invented) + https://docs.umami.is/docs/api
  + the runtime rules captured in conventions/, errors/ and rate-limits/
provider: Umami
providerId: umami
description: >-
  Packaged Agent Skills for the Umami API — one per marquee flow. Every
  operation named in a skill's frontmatter exists in openapi/ or is documented
  in Umami's own API reference; nothing is invented. Each skill carries the
  cross-cutting rules an agent gets wrong on Umami specifically: the two base
  URLs, the 400-not-401 missing-credential response, the invisible 50/15s rate
  budget, the silent `unit` promotion, and the absence of any idempotency key on
  a billed collection endpoint.
provider_published_skills:
  searched: true
  found: false
  note: >-
    Checked the umami-software GitHub organization (12 public repos) and the
    full documentation corpus at https://docs.umami.is/llms-full.txt for an
    AGENTS.md, a skills/ directory or any packaged agent instructions. None
    exists. These skills are generated by API Evangelist.
skills:
  - name: umami-website-traffic-report
    file: umami-website-traffic-report.md
    summary: >-
      Headline stats, a bucketed pageview series and top dimension breakdowns
      for one website over a date range.
    operations: [listWebsites, getWebsite, getWebsiteStats, getWebsitePageviews, getWebsiteMetrics]
    read_only: true
    destructive: false
  - name: umami-onboard-a-website
    file: umami-onboard-a-website.md
    summary: >-
      Register a website, get its tracking ID, install the script, optionally
      enable replay and a public share URL, and verify data is arriving.
    operations: [listWebsites, createWebsite, getWebsite, updateWebsite, getActiveVisitors]
    read_only: false
    destructive: false
    note: >-
      Includes the duplicate-website hazard — there is no uniqueness constraint
      on domain and no idempotency key on create.
  - name: umami-send-server-side-events
    file: umami-send-server-side-events.md
    summary: >-
      Record pageviews and custom events from a server via the unauthenticated
      POST /api/send and POST /api/batch collection endpoints.
    operations: [sendEvent, sendBatch]
    read_only: false
    destructive: false
    operations_note: >-
      These two are documented by Umami at
      https://docs.umami.is/docs/api/sending-stats but are NOT present in
      openapi/, which captures only the authenticated analytics surface. The
      operationIds above are descriptive labels for that documented pair, not
      identifiers lifted from a spec.
    hazard: >-
      Highest-risk skill in the set. No idempotency key, events are the billing
      unit, and POST /api/batch returns 200 on partial failure.
  - name: umami-manage-teams-and-access
    file: umami-manage-teams-and-access.md
    summary: >-
      Create teams, add members via the access code, assign websites, manage
      users on self-hosted, and revoke access.
    operations: [listTeams, createTeam, joinTeam, getTeam, deleteTeam, listTeamWebsites, createUser, getUser, deleteUser, createWebsite]
    read_only: false
    destructive: true
    note: >-
      Carries the Umami Cloud restriction that /me/password, /users and
      /users/* are barred from API keys, so the user operations are
      self-hosted-only.
not_covered:
  note: >-
    Umami documents roughly 70 endpoints; openapi/ captures 23. The following
    documented surfaces have no skill because they have no captured contract to
    ground one in — writing them would mean inventing parameters. They are named
    here so the gap is visible rather than silent.
  surfaces:
    - Reports (attribution, breakdown, funnel, goal, journey, performance, retention, revenue, utm)
    - Revenue endpoints
    - Links and Pixels
    - Share management
    - Realtime
    - Event data and session data property/value/pivot queries
    - Boards
    - Admin
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com