Skip to main content
GET
/
api
/
admin
/
analytics
Admin: analytics
curl --request GET \
  --url https://api.example.com/api/admin/analytics \
  --header 'Authorization: <authorization>'
{
  "message": "<string>",
  "data": {
    "totalUsers": 123,
    "activeUsers": 123,
    "inactiveUsers": 123,
    "paidUsers": 123,
    "monthlyGrowth": 123,
    "topPlan": "<string>"
  }
}
This endpoint requires both a valid Bearer token and the admin role. Non-admin requests return 403 Forbidden.
Returns aggregated statistics across all user accounts on the platform. Use this endpoint to monitor overall platform health, track subscription adoption, and measure growth.

​
Authentication

Two middleware layers protect this endpoint:
  1. authenticate — validates the Bearer JWT and attaches the user to the request.
  2. isAdmin — checks that req.auth.role === "admin". Requests from regular user accounts are rejected.
​
Authorization
string
required
Admin Bearer token. Format: Bearer <token>.

​
Response

​
message
string
Human-readable status message.
​
data
object

​
Example

curl --request GET \
  --url https://api.hayon.app/api/admin/analytics \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'

​
Success response

{
  "message": "Analytics retrieved successfully",
  "data": {
    "totalUsers": 1482,
    "activeUsers": 1391,
    "inactiveUsers": 91,
    "paidUsers": 347,
    "monthlyGrowth": 25.5,
    "topPlan": "Free"
  }
}

​
Error responses

401
{
  "message": "Unauthorized"
}
403
{
  "message": "Forbidden - Admin only"
}
500
{
  "message": "Failed to retrieve analytics"
}

​
Field notes

This value is derived from the ratio of new accounts created in the current calendar month versus the previous calendar month. It is computed server-side from getUsersAnalytics() in the user repository.
topPlan reflects the plan that the majority of accounts are currently assigned to. The raw database value (free or pro) is mapped to a display label (Free or Professional) before being returned.
These counts are based on the isDisabled flag set via the update user activity endpoint. A user who has never logged in is still counted as active unless explicitly disabled.

Build docs developers (and LLMs) love

Get started for freeTalk to us