API Documentation

GET /api/status/{slug}

Public. Returns status page and monitors with daily uptime. Cache-Control: no-store

{
  "page": "default",
  "monitors": [{ "id": 1, "name": "API", "status": "up", "dailyUptime": [...] }]
}

POST /api/monitors

Auth required. Create monitor. Body: name, url, method?, expected_status?, interval_seconds?, timeout_ms?, body_must_contain?, body_must_not_contain?, max_response_time_ms?, custom_headers? (JSON)

Form posts redirect to /dashboard, JSON returns 201.

PUT /api/monitors/{id}

Update monitor. Same fields as create, partial allowed.

POST /api/monitors/{id}/toggle · POST /api/monitors/{id}/delete

Pause/resume or delete. Returns 204 or 404.

POST /api/checks/run

Auth required. Forces checked batch for due monitors. Returns { checked, failed }

GET /api/status-pages · POST /api/status-pages

List/create status pages. Fields: title, slug, description, branding_logo_url, branding_theme, custom_domain, is_public

PUT /api/status-pages/{id} · DELETE /api/status-pages/{id}

Update/delete page. Default page protected if sole page.

PUT /api/status-pages/{id}/monitors

Set ordered monitor ids: { monitorIds: [1,2] }

GET /api/notification-channels · POST /api/notification-channels

Types: email, webhook, slack, discord. Config: url/webhook_url, to, endpoint etc.

POST /api/incidents/{id}/resolve · POST /api/incidents/{id}/updates

Resolve incident or add timeline update (message, author).

POST /api/maintenance · DELETE /api/maintenance/{id}

Maintenance windows to suppress alerts. Fields: title, monitor_id (null=global), start_at, end_at (unix sec or ISO), description.

GET /api/badge/{slug}

Public. Returns an SVG uptime/status badge for a public status page — embeddable straight into a README. Query params: label, style.

POST /api/heartbeat/{id}/ping · GET /api/heartbeat/{id}/ping

Public (the URL is the secret). Dead-man's-switch endpoint for cron jobs and backups: id is the monitor id, and each ping marks the monitor up and resolves any open incident. If no ping arrives within grace_seconds, the scheduled worker marks it down. GET is accepted so curl in a crontab works without flags.

curl -fsS https://uptimecove.example/api/heartbeat/7/ping

Auth

Single admin token via ADMIN_TOKEN. Login POSTs to /api/auth/login and sets a uc_session HttpOnly cookie (7d, Secure in prod, SameSite=Lax). Machine clients can send Authorization: Bearer <api key> instead. Everything under /dashboard and /api/* requires auth except /api/auth/*, /api/status/*, /api/badge/* and /api/heartbeat/*/ping. The sessions table validates each request, so rotating ADMIN_TOKEN revokes existing sessions.