MetriBeacon
Menu

POST Show the heartbeat URL

/api/v1/monitors/{id}/heartbeat-url/reveal

Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

On this page

Access and permissions

Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

Browser session: __Host-mb_session cookie.

When using a browser session for a mutation, send the current CSRF token in X-CSRF-Token with the same-site cookie. OAuth consent uses its documented form field.

Parameters and headers

FieldLocationType and limitsRequiredMeaning
idPathstring; {"format":"uuid"}YesIdentifier of the heartbeat monitor.

Request body

No request body.

Responses

application/json

FieldType and limitsRequiredMeaning
$HeartbeatURLRevealYes—
$.revisioninteger; {"minimum":1}Yes—
$.urlstring; {"format":"uri"}Yes—
Stable error codes
unauthorized

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
browser_required
csrf
invalid_origin
workspace_scope
access_denied
forbidden

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
not_found

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
revision_conflict

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
body_not_allowed

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
invalid_request

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
quota_exceeded

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—
Stable error codes
unavailable

application/problem+json

FieldType and limitsRequiredMeaning
$ProblemYes—
$.codestringYesStable machine-readable error code
$.detailstringYesShort localized explanation without internal error details
$.instancestringYesUnique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.messagestringYesTemporarily identical to detail for existing clients
$.message_keystringYesStable translation key for changing the displayed language without another request
$.message_paramsobject; {"additionalProperties":true}YesNamed, safely rendered message parameters; never arbitrary HTML
$.request_idstring; {"pattern":"^[0-9a-f]{32}$"}YesServer-generated diagnostic identifier. It contains no login token or credential.
$.statusinteger; {"maximum":599,"minimum":400}Yes—
$.titlestringYesLocalized HTTP status title
$.typestring; {"const":"about:blank"}Yes—

Retries and asynchronous work

This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

shell
curl --fail --silent --show-error --request POST --cookie "$HOME/.config/metribeacon/cookies.txt" --header @"$HOME/.config/metribeacon/headers.txt" "https://metribeacon.com/api/v1/monitors/MONITOR_ID/heartbeat-url/reveal"
python
import json, urllib.request
request = urllib.request.Request('https://metribeacon.com/api/v1/monitors/MONITOR_ID/heartbeat-url/reveal', method='POST', headers={'Cookie': '__Host-mb_session=SESSION_TOKEN; __Host-mb_csrf=CSRF_TOKEN', 'X-CSRF-Token': 'CSRF_TOKEN', 'Origin': 'https://metribeacon.com', 'Content-Type': 'application/json'})
with urllib.request.urlopen(request) as response:
    print(response.status)
javascript
const response = await fetch("https://metribeacon.com/api/v1/monitors/MONITOR_ID/heartbeat-url/reveal",{method:"POST",credentials:"include",headers:{"X-CSRF-Token":"CSRF_TOKEN","Content-Type":"application/json"}});
if (!response.ok) throw new Error("HTTP " + response.status);
go
package main
import("net/http";"fmt")
func main(){r,_:=http.NewRequest("POST","https://metribeacon.com/api/v1/monitors/MONITOR_ID/heartbeat-url/reveal",nil);r.Header.Set("Cookie","__Host-mb_session=SESSION_TOKEN; __Host-mb_csrf=CSRF_TOKEN");r.Header.Set("X-CSRF-Token","CSRF_TOKEN");r.Header.Set("Origin","https://metribeacon.com");r.Header.Set("Content-Type","application/json");response,err:=http.DefaultClient.Do(r);if err!=nil{panic("request failed")};defer response.Body.Close();fmt.Println(response.StatusCode)}
  • HTTP API, OAuth and MCP

    Find the user API endpoints, their permissions, fields, examples and response formats.

  • DELETE Disable the heartbeat URL

    Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

  • GET Read heartbeat URL status

    Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

  • PUT Create or replace the heartbeat URL

    Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.