HTTP API, OAuth and MCP

API reference

Download the English OpenAPI contract or the German contract. API paths and technical identifiers are identical in both languages.

• GET Discover the OAuth authorization server

  Discover the OAuth authorization server.

• GET Discover the protected MCP resource

  Discover the protected MCP resource.

• POST Disable your account and queue its deletion

  Delete your own account after confirming with a fresh action code. Access ends immediately; removal of monitoring data and files continues in the background.

• PATCH Save account language preferences

  Update one or more account preferences. Omitted preferences remain unchanged. A browser session and CSRF token are required.

• GET Confirm that heartbeat and an enabled measurement were accepted

  Confirm the selected agent profile through saved data: a heartbeat and a numeric or state value from an enabled profile series, received since the requested time. Installer and process status do not establish readiness.

• GET Inspect a short confirmation code as a signed-in user

  Inspect a short confirmation code as a signed-in user

• POST Approve the device and its separate CLI/MCP management credential

  Requires CSRF. Select an owned workspace or create one; choose an unconfigured server or create one. Defaults select CPU, RAM and the system filesystem at 30 seconds. Account quotas are enforced in the same transaction. Replays by the same account do not create more keys; another account cannot approve an already completed request.

• POST Reject a pending device link

  Reject a pending device link

• POST Start a ten-minute device link

  Generate secrets locally and submit only hashes. Repeating an identical request with the same client token returns the same challenge. No account is created.

• DELETE Cancel a device link and revoke credentials already issued by it

  Cancel a device link and revoke credentials already issued by it

• GET Poll the linked device request

  Poll the linked device request

• GET Read the profile assigned to the device key

  The device-bound key can read only its active server monitor profile and assigned series. Capability and account admission limits still apply.

• POST Report discovered server components and collection status

  Discovery and unsupported/permission-denied reports do not count as measurement values or enable selections. Accepted reports update only the key’s server monitor.

• GET Read your incident history

  Read all stored incidents without an age cutoff. Follow next_cursor to load older pages. A page contains 50 incidents by default and at most 100. Keep the workspace and state filters unchanged while paging. Incident summaries remain until account deletion; delivery details expire after 90 days. Previously removed incidents cannot be restored.

• POST Acknowledge your incident

  Acknowledge your incident.

• GET Read channel-specific delivery attempts for an incident

  Read channel-specific delivery attempts for an incident.

• GET Read incident evaluation evidence

  Returns the actual bounded trigger and recovery evaluation snapshots and recorded delivery suppression reasons. Existing incidents without snapshots return null; retained measurement history must not be treated as proof of the original evaluation. Current recovery progress is available only for the same still-active incident and unchanged rule version. Requires telemetry:read and access to the incident workspace.

• DELETE Remove your maintenance window

  Remove your maintenance window.

• GET Read your active rules and persistent alarm state

  Read accessible active rules in pages of 50 (at most 100). Search rule and monitor names and filter type, severity or state before pagination. Follow next_cursor with the same filters, sort and limit; an empty cursor marks the end. Cursors expire after 15 minutes. Paused and muted rules remain available.

• POST Create a numeric, state, text, missing-data or run rule

  Create a numeric, state, text, missing-data or run rule.

• DELETE Archive a rule and close its open incidents

  Archive a rule and close its open incidents.

• GET Read one alert rule

  Open an accessible alert rule by its ID, independently of list filters or pagination.

• PUT Edit an individual rule with expected_version. Monitor, series and rule type stay fixed; managed rules use their configuration editor. A new evidence revision preserves incident history.

  Edit an individual rule with expected_version. Monitor, series and rule type stay fixed; managed rules use their configuration editor. A new evidence revision preserves incident history.

• GET Read your rule’s maintenance windows

  Read your rule’s maintenance windows.

• POST Create a maintenance window for your rule

  Maintenance prevents new firing and recovery evaluation during the selected window. Existing windows and incidents remain visible.

• POST Pause evaluation or mute delivery until a timestamp

  Pause stops rule evaluation; mute suppresses channel delivery while incidents remain visible. A finite UTC until timestamp is required.

• PUT Change notification destinations for an alert rule

  CSRF protected. The new selection applies from the next incident; existing incident destinations remain saved.

• POST Pause evaluation or mute delivery until a timestamp

  Pause stops rule evaluation; mute suppresses channel delivery while incidents remain visible. A finite UTC until timestamp is required.

• POST Resume evaluation or unmute delivery

  Clears the corresponding pause or mute field for an owned active rule. It does not change thresholds or delete existing history.

• POST Resume evaluation or unmute delivery

  Clears the corresponding pause or mute field for an owned active rule. It does not change thresholds or delete existing history.

• GET Read recent test-email attempts

  Read recent test-email attempts.

• POST Queue a test email to your verified address

  Queue a test email to your verified address.

• DELETE Cancel an analysis job

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• GET Read an analysis job

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• GET Export a completed report as CSV

  Download the CSV of a completed period report. SLO evaluation jobs have JSON results and return csv_not_supported (422) for CSV; unfinished report jobs return job_not_ready (409).

• POST Queue an authorized archive query

  Export numeric history at the selected raw, minute, quarter-hour or hourly resolution. Set multipart=true for up to 60,000 measurements and 25 MiB across at most 64 files, each limited to 2,000 measurements and 512 KiB. Set preview=true to estimate size without starting a job. Without multipart, existing single-file limits apply. Completed jobs include checksums and links for every part. UTC times, coverage, gap records and available counter increases/resets remain included. No part is published if the whole export fails. Cancel active jobs when no longer needed; downloads expire after one day. State and event history remains available as JSON.

• DELETE Cancel your pending or running archive query

  Cancel your pending or running archive query.

• GET Read an archive job and its bounded result

  Read status and progress of your authorized history job. Completed multipart CSV jobs include all part URLs, row counts, sizes, SHA-256 checksums and explicit coverage in the result. No part is available before the whole range succeeds.

• PATCH API: Continue a history job

  Confirm that your own queued, running or completed history or CSV job is retained when the page closes. The query snapshot and quotas are unchanged. Explicit cancellation remains available.

• GET Download a completed CSV export

  Only a completed owned CSV job can be downloaded. Formula-leading text is escaped. Expired or unavailable results cannot be recovered by guessing a filename.

• POST Request a code for one sensitive action

  Request a six-digit confirmation code for a sensitive account or workspace change. It lasts five minutes and allows five incorrect attempts. Use the same signed-in browser, action, target and parameters when confirming. A replacement requested after 60 seconds invalidates the previous code for that action. For your own account use link_identity, unlink_identity, add_passkey, remove_passkey or delete_self; workspace membership actions require owner permission. Do not use sign-in codes to confirm changes.

• DELETE Cancel your pending action confirmation

  Only an outstanding confirmation belonging to the current account and session can be cancelled.

• POST Confirm a new email address and revoke sessions

  Confirm a new email address and revoke sessions.

• DELETE Cancel the browser entry flow

  Cancels outstanding email challenges and the browser-bound entry flow, then clears its pre-authentication cookie. It does not revoke an existing application session. Requires the allowed browser origin.

• GET Read the current browser entry step

  Reads the flow bound to __Host-mb_auth without creating an application session. Missing, expired, completed or cancelled flows return status idle. Active flows describe verification, consent or explicit identity linking.

• POST Accept current legal documents and finish entry

  Complete sign-up after identity verification by accepting the current terms and acknowledging the privacy notice. A successful response creates the browser session. New accounts require open registration.

• POST Confirm email proof in the requesting browser

  Accepts exactly one proof form: link token, or challenge_id with a six-digit code. Proof and flow are browser-bound and single-use; at most five incorrect attempts are allowed. Existing verified email accounts receive a seven-day session. New accounts proceed to consent_required; provider identities for an existing account proceed to link_confirmation_required without automatic linking.

• POST Request an email proof for the browser entry

  Requests a ten-minute magic link and six-digit code bound to the requesting browser. An active verified account can sign in regardless of the registration gate. A new human account is created only when registration and its rate limits permit; successful proof still requires current legal consent. The 202 reply does not disclose whether mail was sent. Resending within 60 seconds returns the existing challenge; later requests replace that browser flow only.

• POST Explicitly confirm an identity link

  Confirm the displayed sign-in provider connection in the original browser. Supply the verification token or challenge_id and code; if mail_verified is true, an empty object confirms the verified connection.

• GET Read your linked identities and pending links

  Read your linked identities and pending links.

• DELETE Unlink a provider identity with an action code

  The code binds provider and identity ID. Unlinking revokes browser sessions; sign in again by email. Machine identity, origin, quotas and telemetry remain unchanged.

• POST Link a verified provider identity with an action code

  A provider callback must have completed for an attempt owned by this session. The code binds provider and attempt ID. One provider identity belongs to only one account.

• POST Explicitly accept an invitation without a password

  Explicitly accept an invitation without a password.

• POST Retired password endpoint: use email sign-in

  Always returns HTTP 410. Request a magic link or login code instead; this operation neither authenticates nor changes a password.

• POST Confirm a login link or code and create a session

  Explicitly confirm the email sign-in request to create a seven-day browser session. Opening the link alone does not sign in. In another browser, enter the code in the browser where it was requested.

• POST Request a browser-bound magic link and login code

  A magic link and six-digit code share one ten-minute challenge. The Secure/HttpOnly browser-binding cookie is required. Replies do not reveal unknown or suspended accounts. return_to is limited to allowed local app or OAuth-consent paths.

• POST End your current browser session

  End your current browser session.

• POST Request a one-time Ed25519 machine challenge

  Requires the enabled registration/recovery capability for the requested purpose. Save the private Ed25519 recovery identity and proposed management credential locally before the request. The challenge binds purpose and public key and expires in five minutes.

• POST Request email verification for a machine account

  Requires account:write on a machine credential. The existing verified address and tier remain until confirmation. Replies are generic for addresses already in use.

• POST Replace a machine management credential using recovery

  Sign a fresh recover challenge with the existing recovery identity. Persist the replacement credential before requesting recovery. Repeating with a fresh challenge yields the same account and returns no secret.

• POST Register or retrieve a machine account

  The version-2 Ed25519 signature binds the challenge and both legal-document versions and acknowledgements. Only a SHA-256 credential hash is stored. A retry needs a fresh challenge and the same locally persisted credential.

• POST Issue a short-lived resource-bound MCP token

  Requires account:read and an enabled remote MCP endpoint. Requested scopes must be a subset of the management credential. Only the canonical own /mcp resource is accepted. Revoking the source credential revokes derived access immediately.

• GET Read your authenticated account

  Read your authenticated account.

• GET Confirm a provider callback in the original browser

  The callback verifies browser binding, state, PKCE and provider identity. Tokens are not placed in the redirect URL. Existing mail accounts require explicit linking rather than automatic matching.

• POST Start sign-in, registration or identity linking

  login, register and link have separate intent. Registration requires the gate and current legal acceptance. Linking requires a browser session and later a fresh action code. Browser cookie, state and PKCE bind the flow for ten minutes.

• GET List your passkeys

  Lists only this verified account’s passkey names and timestamps. Public keys and credential IDs are omitted. The enabled flag controls enrollment and sign-in; removal remains available.

• POST Complete passkey sign-in

  Checks the signature, user verification, origin, account status and browser-bound single-use challenge before creating a normal session. Errors do not reveal account existence. Limit: forty attempts per network address in fifteen minutes.

• POST Start passkey sign-in

  Creates a discoverable challenge without an email address or account lookup. Requires the configured Origin and a browser-bound cookie. Limit: twenty starts per network address in fifteen minutes.

• POST Complete passkey enrollment

  Complete passkey registration using the device's WebAuthn response in the same signed-in browser. Each account can store up to ten passkeys.

• POST Authorize passkey enrollment

  Requires a fully activated account, browser session and fresh add_passkey email confirmation bound to the trimmed name. Consumes the confirmation and returns one five-minute enrollment ceremony. This cannot create an account.

• DELETE Remove a passkey

  Requires a fresh remove_passkey confirmation bound to this key ID. Removes the key and ends all browser sessions; email sign-in remains available.

• PATCH Rename a passkey

  Renames an owned passkey without changing authentication data. Requires the active browser session and CSRF token.

• POST Retired password endpoint: use email sign-in

  Always returns HTTP 410. Request a magic link or login code instead; this operation neither authenticates nor changes a password.

• GET Read available Google and GitHub sign-in providers

  Only configured providers are listed. Sign-in never silently creates an account or associates an existing matching email address.

• POST Register without a password and request verification

  Registration requires the current gate and legal-document acknowledgements. Existing addresses do not create duplicate accounts. Verification and first sign-in use the same browser-bound link/code challenge.

• POST Retired password endpoint: use email sign-in

  Always returns HTTP 410. Request a magic link or login code instead; this operation neither authenticates nor changes a password.

• POST Retired password endpoint: use email sign-in

  Always returns HTTP 410. Request a magic link or login code instead; this operation neither authenticates nor changes a password.

• GET Read your active sessions without their secrets

  List active browser sessions with coarse device hints and recorded activity. Sessions are paginated; machine credentials cannot access this endpoint.

• DELETE End every other active browser session

  End all other active browser sessions, including sessions outside the loaded pages. The current session and account are checked again inside the transaction. The current session, machine credentials, device keys and MCP tokens are retained. Repeating the request succeeds with revoked equal to zero. No email code is required.

• DELETE Revoke one of your sessions

  Revoke one of your sessions.

• POST Redeem a one-time verification token

  Redeem a one-time verification token.

• GET Read currently enabled API capabilities

  Read which monitoring features are currently available and which template version to use. Your account's own usage limits still apply.

• GET Read your saved dashboard configuration

  Customize your personal dashboard directly: move cards, choose sources, set titles and widths, and add monitor, metric, chart or maintenance cards. Changes take effect only after saving and always respect the group filter.

• PUT Save dashboard configuration atomically

  Customize your personal dashboard directly: move cards, choose sources, set titles and widths, and add monitor, metric, chart or maintenance cards. Changes take effect only after saving and always respect the group filter.

• GET Read an authorized workspace summary

  Customize your personal dashboard directly: move cards, choose sources, set titles and widths, and add monitor, metric, chart or maintenance cards. Changes take effect only after saving and always respect the group filter.

• GET Search and page through devices in your workspace

  Search and page through devices in your workspace.

• POST Create a device

  Create a device.

• DELETE Permanently delete a monitor

  Only the workspace owner may permanently delete a monitor. First request a five-minute configuration-bound preview, then send preview_id, confirm_deletion: true and an Idempotency-Key. Unconfirmed legacy archive requests are rejected. The monitor is immediately blocked; a durable job removes all its database, archive and cache data and cleans linked displays. Read the job until complete; paused jobs show a technical error and retry automatically. Daily quotas and security counters remain unchanged. Previously delivered messages and downloaded files cannot be recalled.

• GET Read your active device

  Read your active device.

• PATCH Update your device

  Update your device.

• DELETE Reset shared device charts

  Restore automatic charts and their original arrangement using the latest revision. Series and stored measurements remain unchanged.

• GET Read shared device charts

  Read saved numeric/state charts, layout and revision. Unassigned series remain automatically displayed.

• PUT Save shared device charts

  Save numeric charts with up to eight series and two compatible unit axes, or state charts with one Boolean/enum series. Each series belongs to one custom chart. Supply the latest revision. An omitted layout is preserved; supplying it updates chart definitions and placement atomically.

• PATCH Arrange monitor charts

  Save chart order and areas without changing their series. Supply the latest revision; a competing change returns 409. Automatic chart IDs remain automatic.

• POST Copy a device’s active metadata and series

  Copy a monitor's active settings and series, without keys or historical readings. The copy needs sufficient free monitor and series slots.

• GET List calculated series

  Closed UTC minute formulas use 1–8 numeric sources from one workspace, at most 64 AST nodes and dependency depth 4. Addition and subtraction require matching units. Missing inputs and division by zero remain gaps. Each new immutable revision uses the owner data budget; replayed work is free. Defaults apply next minute; explicit backfill is at most 24 hours. Reads allow Viewer; changes need Editor, config:write and session CSRF. An optional Idempotency-Key protects retries and rejects changed payloads. Existing telemetry keys cannot write calculated series.

• POST Create calculated series

  Closed UTC minute formulas use 1–8 numeric sources from one workspace, at most 64 AST nodes and dependency depth 4. Addition and subtraction require matching units. Missing inputs and division by zero remain gaps. Each new immutable revision uses the owner data budget; replayed work is free. Defaults apply next minute; explicit backfill is at most 24 hours. Reads allow Viewer; changes need Editor, config:write and session CSRF. An optional Idempotency-Key protects retries and rejects changed payloads. Existing telemetry keys cannot write calculated series.

• GET Read your device’s text events

  Read your device’s text events.

• DELETE Archive a group and detach its devices

  Archive a group and detach its devices.

• PATCH Rename your group

  Rename your group.

• PATCH Update group device memberships

  Add or remove active monitor assignments in this workspace. Other assignments are kept. Repeating the same change is safe; duplicate IDs or an ID in both lists are invalid.

• GET Read public readiness status

  Read public readiness status.

• POST Commit a device-bound batch of text or run events

  Up to 1,000 events and 256 KiB before and after decompression; each event is at most 4 KiB and message at most 2 KiB UTF-8. Event IDs are account-wide idempotency keys. The optional type label controls aggregates; absent type is generic. Structured run data requires enabled run ingestion and reserves normalized type/run_id labels.

• POST Report contact from the device key without a body

  Report contact from the device key without a body.

• POST Commit a numeric batch atomically

  Store a numerical batch. Success confirms stored data; identical point IDs and content count as duplicates. Limits: 1,000 items and 256 KiB before and after decompression. identity and gzip are supported; decoded bytes count toward usage. Readings may be up to 24 hours old or two minutes ahead. Distinct readings of one series must be at least one second apart, including existing readings.

• POST Register a series for the device key idempotently

  Name and labels identify the series on the key’s device. Different labels create another series and consume allowance. Existing type/unit conflicts return 409; foreign-device access is not possible.

• POST Commit device-bound boolean or enum states

  Boolean series require JSON booleans; enum series require strings of at most 128 bytes. States share the event allowance. Body limits apply before and after decompression. Aggregate validity extends to the next sample, bounded by twice the expected interval and a one-to-five-minute cap.

• GET Read active key prefixes without secrets

  Read active key prefixes without secrets.

• POST Create a device-bound write key displayed once

  Choose selected devices or all existing and future devices in one workspace. Use workspace_id, device_scope and device_ids; the one-device form uses device_id. Secrets are shown only once.

• POST Claim a locally saved write key idempotently

  Persist a random mbk_<12 hex>_<64 hex> secret locally before requesting its prefix and SHA-256 hash. The same active device/hash replays; conflicting content returns 409. No plaintext secret is returned.

• DELETE Revoke a write key immediately

  Revoke a write key immediately.

• PATCH Edit API key name and device access

  Changes take effect immediately without changing the secret. The workspace is immutable. Send the current revision from GET /keys; stale revisions return 409. All devices includes devices created later.

• POST Revoke and replace a key atomically

  Replace a key and immediately revoke the old one. Update every sender using that key.

• POST Activate a locally saved replacement key idempotently

  Persist the replacement secret before the request. Old-key revocation, replacement activation and rotation receipt commit together. An identical retry replays; a different hash or revoked replacement conflicts.

• GET Stream authorized current values and states over SSE

  Browser sessions and machine credentials with telemetry:read can subscribe to live data. Machine access requires the independent runtime gate and is limited to two connections per account and 64 per API process. Credentials, accounts, roles and every series are rechecked before each five-second update. Connections end after 15 minutes. Tokens in URLs are not accepted.

• DELETE Remove a private maintenance schedule

  Private one-time or weekly maintenance. Telemetry and alarm states continue; deliveries are suppressed. IANA gaps are skipped and repeated times use their first occurrence. Disabled schedules consume one of 20 slots. Edits preserve past coverage; group changes take effect going forward. Public notices require a separate draft and status page publication permission.

• PUT Save a private maintenance schedule

  Private one-time or weekly maintenance. Telemetry and alarm states continue; deliveries are suppressed. IANA gaps are skipped and repeated times use their first occurrence. Disabled schedules consume one of 20 slots. Edits preserve past coverage; group changes take effect going forward. Public notices require a separate draft and status page publication permission.

• GET Read your monitors

  Read your monitors.

• POST Create a monitor with its enabled type

  Create a monitor with its enabled type.

• POST Apply reviewed actions to selected monitors

  Send the same selection and operation UUID with the preview version and confirmed=true. Existing HTTP checks that can change targets additionally require actions_confirmed=true. A configuration, allowance or selection change requires a new preview. All selected monitors change together or none change; retries do not repeat the action. External client intervals and cron schedules use their individual settings.

• POST Review actions for selected monitors

  Select 1–100 monitors in one workspace and choose pause, resume, group assignment or collection interval. The preview lists the exact selection and account-wide daily consumption before and after the change. Reviewing changes nothing and reserves no capacity. Unsupported intervals or an increased allowance violation block the whole selection.

• DELETE Permanently delete a monitor

  Only the workspace owner may permanently delete a monitor. First request a five-minute configuration-bound preview, then send preview_id, confirm_deletion: true and an Idempotency-Key. Unconfirmed legacy archive requests are rejected. The monitor is immediately blocked; a durable job removes all its database, archive and cache data and cleans linked displays. Read the job until complete; paused jobs show a technical error and retry automatically. Daily quotas and security counters remain unchanged. Previously delivered messages and downloaded files cannot be recalled.

• GET Read your monitor and configuration

  Read your monitor and configuration.

• PATCH Update a monitor with a revision check

  Update a monitor with a revision check.

• POST Explicitly save HTTP availability and certificate alarms

  Create only the selected alarm suggestions within account limits. Reusing a suggestion keeps later user edits.

• GET Read HTTP header names without their secret values

  Returns header names and whether values are configured; it never returns secret values. Use config_revision when making concurrent changes.

• PUT Store or remove encrypted HTTP headers

  At most eight stored headers are allowed. Values are encrypted with AES-256-GCM and bound to account, monitor, origin and header name. Use explicit removal instead of an empty replacement secret.

• GET Read hourly run and schedule summaries

  Returns at most 168 hours of local run/schedule details. Missing hours are unknown, not successful runs. A schedule expectation is counted as missing only while it remains unmatched.

• GET Read recent job and workflow runs

  Returns at most 100 runs from the last seven days. Completion may arrive before start, leaving started_at null until backfill. Runtime limits are captured at start; a late actual completion corrects overdue_at.

• GET Read a server profile and provisioning status

  The versioned catalog describes supported Linux components. Discovery does not activate selections. Provisioning reserves account-wide series places and retains existing history.

• PUT Update a server profile with a revision check

  The expected revision prevents lost updates. Existing components cannot silently change identity. Explicit reuse mapping preserves known history; newly selected parameters are provisioned asynchronously within account limits.

• POST Preview a server profile change

  Preview a server profile change without saving it. Returns new and retained series, required capacity, expected data volume and alarm suggestions. Use the current revision and review the preview before saving.

• GET Read available alert channels and setup requirements

  Seven channels with availability and setup requirements, destination limit, public VAPID key, bot username and shared test limit

• GET List your named notification destinations

  Destinations including connection status and last delivery result; no credentials

• POST Create a named destination or register a browser push subscription

  CSRF protected; supports Idempotency-Key. The current verified account email is confirmed automatically; other email recipients require a one-time verification. Telegram requires a private /start proof. The default limit is 20 destinations per account and is centrally configurable. A webhook signing_secret is returned only in the first response.

• DELETE Remove a destination, erase credentials and cancel queued delivery

  Credentials erased immediately; completed history remains until retention expiry

• GET Read your destination without credentials

  Owned destination

• PUT Change destination name, activation or complete connection settings

  CSRF protected. revision protects concurrent changes. Changes increase the connection revision and cancel queued messages. Change an email address or Telegram chat through a new destination or a new connection proof.

• POST Queue a test through the same durable delivery flow

  CSRF protected and idempotent through Idempotency-Key. At most ten tests per hour across all destinations. An explicitly requested test may use a paused, verified destination.

• POST Create an email verification or destination-bound Telegram link

  Verification queued or private Telegram link valid for ten minutes

• POST Recipient explicitly confirms or ends an email connection

  Public endpoint with rate limiting and same-origin validation. The link first opens /benachrichtigungen/bestaetigen with the token in a fragment; GET never confirms. A verification token is single-use and valid for 24 hours. An unsubscribe token ends only the specific destination.

• DELETE Disconnect your Telegram chat

  Disconnecting removes unused link codes and cancels pending Telegram messages.

• GET Read your Telegram connection and delivery status

  Read your Telegram connection and delivery status.

• PUT Enable or pause your linked Telegram channel

  Enable or pause your linked Telegram channel.

• POST Create a one-time Telegram connection link

  The link expires after ten minutes and replaces a prior unused link for this account. Successful /start automatically enables delivery and queues a success message.

• POST Queue a test message to your Telegram chat

  Provider handoff is asynchronous. A queued response is not proof that the user read the message. Email and Telegram share the test-message budget.

• GET Read shared test history using a cursor

  Up to 50 tests with channel, destination name, status, error_code, attempts, next_attempt_at and next_cursor

• DELETE Reset setup for another device

  Existing devices, telemetry, keys and rules remain. Reset explicitly before setting up a different device.

• GET Read your saved setup and accepted telemetry

  Progress contains resource IDs and accepted-data timestamps, never stored device-key secrets. A running local process alone does not complete setup.

• POST Save a suggested alarm and complete setup

  Actual accepted telemetry is required. Repeating the same choice does not create another rule; completing without an alarm is an explicit alternative.

• POST Complete setup after actual data acceptance

  Use an alarm belonging to this setup, or explicitly set skip_alarm. Data acceptance is checked again before completion.

• GET Download a Agent configuration without secrets

  Download a Agent configuration without secrets.

• POST Create or explicitly rotate a once-only setup key

  The secret appears once and responses are no-store. A lost secret requires the explicit rotate operation. Rotation revokes the previous key atomically.

• POST Create or explicitly rotate a once-only setup key

  The secret appears once and responses are no-store. A lost secret requires the explicit rotate operation. Rotation revokes the previous key atomically.

• GET Read the immutable agent release matching this API

  Release with native acceptance on Linux x64, macOS ARM64 and Windows x64; other architectures are not natively tested; 503 while native acceptance or publication is pending. Operating-system signing is currently unavailable.

• POST Select or create setup resources atomically

  Prepare resources or explicitly change the saved selection with replace_existing=true and its expected_updated_at revision. Unchanged selections and exact request replays preserve progress without creating resources. Changes run atomically, retain existing resources and keys, preserve a key only for the same device, and require a new heartbeat and measurement for the resulting series. Stale revisions return 409 onboarding_changed.

• POST Submit an anonymous contact request

  Same-origin browser form; JSON or URL-encoded body, at most 64 KiB. The email address is Reply-To only; delivery recipient is fixed. Five attempts per network address in 15 minutes, 100 globally per hour. Success confirms SMTP acceptance; failures preserve input. No attachments or automatic reply.

• GET Read published contact, privacy and terms information

  Draft text is never exposed. Email addresses remain encoded. All responses are no-store; document versions are content-derived SHA-256 values. Version-specific public HTML is noindex.

• GET Read only approved public data

  Only explicitly approved fields are exposed; drafts, monitor addresses, IPs, credentials, configurations, logs and internal alarm texts are excluded. revision, generated_at and fallback identify the publication and data freshness. Resource data is wrapped in the same metadata. public_api controls JSON access. Subscriptions require same-origin admission and email proof; webhooks additionally require receiver verification.

• POST Request double-opt-in subscription

  Only explicitly approved fields are exposed; drafts, monitor addresses, IPs, credentials, configurations, logs and internal alarm texts are excluded. revision, generated_at and fallback identify the publication and data freshness. Resource data is wrapped in the same metadata. public_api controls JSON access. Subscriptions require same-origin admission and email proof; webhooks additionally require receiver verification.

• GET Read only approved public data

  Only explicitly approved fields are exposed; drafts, monitor addresses, IPs, credentials, configurations, logs and internal alarm texts are excluded. revision, generated_at and fallback identify the publication and data freshness. Resource data is wrapped in the same metadata. public_api controls JSON access. Subscriptions require same-origin admission and email proof; webhooks additionally require receiver verification.

• DELETE Remove a report schedule

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• PUT Update a report schedule

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• POST Generate the latest completed period report

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• GET Read series belonging to your device

  Read series belonging to your device.

• POST Create a measurement series

  Create a measurement series.

• DELETE Archive a series and close its alarm incidents

  Archive a series and close its alarm incidents.

• PATCH Update a series name, description or expected interval

  Type, unit and labels are immutable after creation. Only the documented mutable fields can be changed.

• GET Read series metadata

  Read metadata for an authorized active series independently of collection filters or cursor pages, including its device_id.

• POST Copy active series metadata in the same device

  Copy active series metadata in the same device.

• PUT Update calculated-series formula

  Closed UTC minute formulas use 1–8 numeric sources from one workspace, at most 64 AST nodes and dependency depth 4. Addition and subtraction require matching units. Missing inputs and division by zero remain gaps. Each new immutable revision uses the owner data budget; replayed work is free. Defaults apply next minute; explicit backfill is at most 24 hours. Reads allow Viewer; changes need Editor, config:write and session CSRF. An optional Idempotency-Key protects retries and rejects changed payloads. Existing telemetry keys cannot write calculated series.

• GET Read incidents and maintenance in a series time range

  Read incidents and maintenance in a series time range.

• POST Query local and archived history

  With prefer_local=true, safely complete local raw charts return immediately without a job. Other queries use an asynchronous job combining local and archived history. Charts return at most 1,000 points and tables at most 2,000 rows per page. Auto selects an appropriate resolution. Results include actual resolution, source, completeness, snapshot and gaps; state results also include validity_seconds. A table cursor is an owned completed-job UUID preserving measurement-time/point-ID ordering; jobs and cursors expire after one day. At most two active jobs per account. Original-value charts accept at most 1,000 expected points. Denser requests return HTTP 422 with code invalid_resolution, message_key errors.api.historyChartTooDense, and message_params.limit and message_params.interval_seconds. Use resolution=auto for a chart or mode=table with resolution=raw to page original values within retention.

• GET Read the latest numeric observation

  Read the latest numeric observation.

• GET Read local numeric observations or aggregates

  raw, minute, quarter_hour and hour select local observations or aggregates. Numeric rollups include count, sum, min, max, last, mean and reset-aware counter increase. Request cold raw data and older aggregates through archive jobs.

• GET Read the latest boolean or enum state

  Read the latest boolean or enum state.

• GET Read local state history

  Read local state history.

• GET Read a server-profile provisioning job

  Read a server-profile provisioning job.

• POST Cancel a server-profile provisioning job

  Cancels pending provisioning. Already created series and their history remain; unused pending selections release reservations.

• POST Retry a failed server-profile provisioning job

  Retries an owned failed job without duplicating already created series. Follow the returned job state rather than assuming immediate completion.

• DELETE Remove an availability SLO

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• PUT Update an availability SLO

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• POST Queue an SLO evaluation

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• GET List status pages and invitations

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Create a private status page

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• DELETE Revoke or delete public delivery

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read a status page draft

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• PUT Save a status page draft

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Accept a page invitation

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Validate and re-encode a brand image

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read an authorized private brand image

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read the private audit

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read status domain operating states

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Reserve a unique status domain

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• DELETE Remove a status domain binding

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Check domain ownership and routing

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET List page collaborators

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Invite an existing account to a page

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• DELETE Remove a page collaborator

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Render a private preview

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Explicitly publish an approved page revision

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read incident and maintenance drafts

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Save an editorial draft

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Publish an approved editorial update

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Withdraw an editorial report

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET List owner-approved monitor sources

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• PUT Approve a source and optional historical import

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• DELETE Revoke an approved source and erase its public projections

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read subscriber and delivery states

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• DELETE Remove a page subscriber

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Revoke or delete public delivery

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read the versioned template catalog

  Suggestions do not activate alarms automatically. Applying HTTP and run templates also requires the corresponding feature flags.

• POST Apply a template atomically in your workspace

  Atomically applies a template within account limits. Server/NAS v2 reserves the monitor, series and selected alarm slots and returns a resumable job; other templates are applied immediately. Repeated normalized requests replay the existing monitor.

• POST Check template capacity without reserving it

  Preview the resources and capacity needed by a template without creating them. A preview does not reserve slots; apply checks the available capacity again.

• POST Validate a template without changing resources

  Validates syntax, version, configuration and alarm choices without reserving resources. Ownership and capacity checks belong to plan and apply.

• GET Read account-wide usage and limits

  With table=1, returns the complete authorized monitor contributor collection as filtered cursor pages. Sort also accepts items, bytes and planned for descending numeric contributions. The unpaged response remains the account usage summary.

• POST Accept a workspace invitation

  Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.

• GET Read your workspaces

  Read your workspaces.

• POST Create a workspace within account limits

  An external_id makes the same account/name request repeatable. Reusing the ID with different input returns 409. A replay does not consume another creation allowance.

• DELETE Archive a workspace and revoke contained keys

  Archive a workspace and revoke contained keys.

• PATCH Rename your active workspace

  Rename your active workspace.

• GET Read workspace membership audit

  Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.

• POST Copy active workspace metadata

  Copies active groups, devices and series metadata, but no credentials, observations or alarm state. Every copied resource is checked and charged atomically against creation limits.

• GET List calculated-series sources

  Closed UTC minute formulas use 1–8 numeric sources from one workspace, at most 64 AST nodes and dependency depth 4. Addition and subtraction require matching units. Missing inputs and division by zero remain gaps. Each new immutable revision uses the owner data budget; replayed work is free. Defaults apply next minute; explicit backfill is at most 24 hours. Reads allow Viewer; changes need Editor, config:write and session CSRF. An optional Idempotency-Key protects retries and rejects changed payloads. Existing telemetry keys cannot write calculated series.

• GET Read a workspace’s active groups

  Read a workspace’s active groups.

• POST Create a group in your workspace

  Create a group in your workspace.

• POST Invite a verified account to a workspace

  Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.

• POST Revoke a pending workspace invitation

  Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.

• GET List workspace maintenance

  Private one-time or weekly maintenance. Telemetry and alarm states continue; deliveries are suppressed. IANA gaps are skipped and repeated times use their first occurrence. Disabled schedules consume one of 20 slots. Edits preserve past coverage; group changes take effect going forward. Public notices require a separate draft and status page publication permission.

• POST Create a private maintenance schedule

  Private one-time or weekly maintenance. Telemetry and alarm states continue; deliveries are suppressed. IANA gaps are skipped and repeated times use their first occurrence. Disabled schedules consume one of 20 slots. Edits preserve past coverage; group changes take effect going forward. Public notices require a separate draft and status page publication permission.

• GET List workspace members and invitations

  Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.

• PATCH Change or remove a workspace member

  Workspace roles and management scopes are checked together. The owner pays shared quotas. Invitations expire after 48 hours and can only be accepted by the invited verified email address. Membership mutations require an action-bound email confirmation; repeating the same confirmation and payload replays the result without consuming it again. Removing Editor rights revokes issued credentials; member removal cancels their archive jobs. Status-page publishing permissions are separate.

• GET List report schedules

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• POST Create a report schedule

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• GET List immutable workspace reports

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• GET List workspace SLOs

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• POST Create an availability SLO

  Workspace SLOs use the aggregate availability series of HTTP, TCP, UDP, DNS, TLS, ping, service, domain and browser monitors. Unknown and unobserved time remain explicit; satisfaction is only proven by the lower availability bound. Ten SLOs and three report schedules are allowed per workspace. Calendar reports are immutable for 90 days. Email requires explicit owner opt-in and a verified destination, and shares the existing notification quota. Asynchronous jobs share four global slots and one per owner, can be cancelled and cannot cross workspace boundaries. Choose daily, weekly or monthly reports and a dispatch time (HH:MM) in an IANA timezone. Reports cover the previous local calendar day, Monday–Sunday week or month. Processing starts at that time; delivery may be later. During daylight-saving changes, a missing time moves to the next valid minute and a repeated time runs only once. Manual generation uses the last closed period regardless of the dispatch time.

• DELETE MCP transport method: DELETE

  The canonical stateless SDK transport validates an OAuth or machine MCP token on every request. GET with an SSE Accept header returns 405. DELETE requires a nonempty Mcp-Session-Id header and acknowledges transport closure with 204, without revoking the token. POST uses JSON responses and accepts the MCP initialization, notification and tool methods.

• GET MCP transport method: GET

  The canonical stateless SDK transport validates an OAuth or machine MCP token on every request. GET with an SSE Accept header returns 405. DELETE requires a nonempty Mcp-Session-Id header and acknowledges transport closure with 204, without revoking the token. POST uses JSON responses and accepts the MCP initialization, notification and tool methods.

• POST Submit MCP JSON-RPC

  The canonical stateless SDK transport validates an OAuth or machine MCP token on every request. GET with an SSE Accept header returns 405. DELETE requires a nonempty Mcp-Session-Id header and acknowledges transport closure with 204, without revoking the token. POST uses JSON responses and accepts the MCP initialization, notification and tool methods.

• GET Request or confirm OAuth consent

  GET prepares explicit browser consent after sign-in. POST confirms one pending consent request using Origin and CSRF. Requires PKCE S256, an exact registered redirect and the canonical /mcp resource; codes expire after five minutes. Required query parameters occur exactly once. URI length is limited to 2048 bytes. The redirect must exactly match a registered HTTPS or loopback URI. Supported scopes: account:read, config:read, config:write, telemetry:read.

• POST Request or confirm OAuth consent

  GET prepares explicit browser consent after sign-in. POST confirms one pending consent request using Origin and CSRF. Requires PKCE S256, an exact registered redirect and the canonical /mcp resource; codes expire after five minutes. The CSRF value is supplied as form field csrf_token and must match the __Host-mb_csrf cookie and this session. Consent is consumed once; an authorization code is issued only for approve.

• POST Register a public OAuth client

  Registers a public client with token_endpoint_auth_method none and authorization_code only. HTTPS redirect URIs and explicit loopback redirects are validated; registration is rate-limited.

• POST Exchange an authorization code for an MCP access token

  Accepts application/x-www-form-urlencoded authorization_code, client_id, redirect_uri, code_verifier and resource. Codes are single-use; access tokens last 15 minutes and no refresh token is issued. All form fields occur exactly once. The code expires after five minutes, is consumed once, and is bound to the exact client, redirect, resource and S256 verifier. The resulting Bearer token expires after 900 seconds. No refresh token is issued.

• PUT Explicitly enable or disable telemetry:write on the current machine credential. Requires keys:write; keeps its workspace binding. Existing MCP tokens do not gain scopes; issue a new token.

  Explicitly enable or disable telemetry:write on the current machine credential. Requires keys:write; keeps its workspace binding. Existing MCP tokens do not gain scopes; issue a new token.

• POST Observe accessible series for ten seconds by default, at most 15 seconds. Revalidates credential, scope, account and workspace every five seconds. Shares the two-per-account and 64-per-process machine live limits. Requires the machine live runtime gate.

  Observe accessible series for ten seconds by default, at most 15 seconds. Revalidates credential, scope, account and workspace every five seconds. Shares the two-per-account and 64-per-process machine live limits. Requires the machine live runtime gate.

• POST Send points, states, events or a heartbeat with an explicitly authorized machine credential. Uses the existing telemetry validation, quotas, deduplication and alarm pipeline. A concrete monitor is required. Run start and completion use the existing events contract. The runtime write gate must be enabled; ingest endpoints still accept only device keys.

  Send points, states, events or a heartbeat with an explicitly authorized machine credential. Uses the existing telemetry validation, quotas, deduplication and alarm pipeline. A concrete monitor is required. Run start and completion use the existing events contract. The runtime write gate must be enabled; ingest endpoints still accept only device keys.

• GET Show your connected account identity.

  Show your connected account identity.

• GET List your active plugin connections.

  List your active plugin connections.

• DELETE Revoke your plugin connection and all its tokens.

  Revoke your plugin connection and all its tokens.

• POST Inspect a browser-bound machine OAuth request.

  Inspect a browser-bound machine OAuth request.

• POST Approve explicitly selected scopes with your private machine identity.

  Approve explicitly selected scopes with your private machine identity.

• POST Deny a machine OAuth request.

  Deny a machine OAuth request.

• POST Revoke an OAuth token or refresh connection.

  Revoke an OAuth token or refresh connection.

• GET Receive bounded synthetic reviewer test requests.

  Receive bounded synthetic reviewer test requests.

• POST Receive bounded synthetic reviewer test requests.

  Receive bounded synthetic reviewer test requests.

• GET Start a browser-bound machine OAuth connection.

  Start a browser-bound machine OAuth connection.

• POST Start a browser-bound machine OAuth connection.

  Start a browser-bound machine OAuth connection.

• POST Complete the confirmed machine OAuth connection.

  Complete the confirmed machine OAuth connection.

• GET Read retention settings (account)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• PUT Save confirmed retention settings (account)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• DELETE Restore inherited retention settings (account)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• POST Preview retention changes (account)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• GET Read retention settings (device)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• PUT Save confirmed retention settings (device)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• DELETE Restore inherited retention settings (device)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• POST Preview retention changes (device)

  Whole rolling 24-hour days, at least one. The effective lifetime is the minimum of system limits, the owning account and monitor overrides. Null inherits. Shortening immediately hides expired data and schedules physical cleanup; a paused cleanup shows its reason. Expired data does not return after lengthening or reset. Incidents, delivery history, reports and security logs have separate lifetimes; external copies are unaffected. Changes require an owning browser account, CSRF and a current revision. Account settings always belong to the authenticated person, including when a shared workspace is selected. Monitor readers may inspect the policy; only its workspace owner may change it. If this feature is unavailable, changes respond with HTTP 503; the read response reports whether you may change the setting.

• GET Catalog MCP OAuth resource metadata

  Discover the OAuth resource and supported permissions for the catalog MCP endpoint. Catalog connections never grant keys:write.

• GET Read collection settings

  Read the current configuration and its agent acknowledgement. The collection interval is separate from the refresh interval of unchanged states. Custom definitions contain only declared field types and source identities, never commands or credentials.

• PATCH Change collection settings

  Uses stable source identities. Each changed field is applied in server acceptance order; unrelated fields and measurement history remain intact. Repeat the same operation_id and body after a lost response. Names, descriptions, activation and collection intervals synchronize. Executables and arguments remain in the locally approved policy.

• POST Preview collection changes

  Uses stable source identities. Each changed field is applied in server acceptance order; unrelated fields and measurement history remain intact. Repeat the same operation_id and body after a lost response. Names, descriptions, activation and collection intervals synchronize. Executables and arguments remain in the locally approved policy.

• GET Receive collection revisions

  An outgoing HTTPS event stream signals new revisions. Fetch the current snapshot after each event or reconnect; Last-Event-ID is not a replay log. CLI and MCP credentials receive one JSON revision for bounded polling. Without events, poll every five seconds and apply error backoff.

• GET Read bound agent configuration

  Read the current configuration and its agent acknowledgement. The collection interval is separate from the refresh interval of unchanged states. Custom definitions contain only declared field types and source identities, never commands or credentials.

• PATCH Synchronize local changes

  Uses stable source identities. Each changed field is applied in server acceptance order; unrelated fields and measurement history remain intact. Repeat the same operation_id and body after a lost response. Names, descriptions, activation and collection intervals synchronize. Executables and arguments remain in the locally approved policy.

• POST Report checks and applied configuration

  Read the current configuration and its agent acknowledgement. The collection interval is separate from the refresh interval of unchanged states. Custom definitions contain only declared field types and source identities, never commands or credentials.

• GET Receive bound agent revisions

  An outgoing HTTPS event stream signals new revisions. Fetch the current snapshot after each event or reconnect; Last-Event-ID is not a replay log. CLI and MCP credentials receive one JSON revision for bounded polling. Without events, poll every five seconds and apply error backoff.

• POST Preview affected links before deleting a monitor

  Only the workspace owner may permanently delete a monitor. First request a five-minute configuration-bound preview, then send preview_id, confirm_deletion: true and an Idempotency-Key. Unconfirmed legacy archive requests are rejected. The monitor is immediately blocked; a durable job removes all its database, archive and cache data and cleans linked displays. Read the job until complete; paused jobs show a technical error and retry automatically. Daily quotas and security counters remain unchanged. Previously delivered messages and downloaded files cannot be recalled.

• GET List your monitor deletion jobs

  Only the workspace owner may permanently delete a monitor. First request a five-minute configuration-bound preview, then send preview_id, confirm_deletion: true and an Idempotency-Key. Unconfirmed legacy archive requests are rejected. The monitor is immediately blocked; a durable job removes all its database, archive and cache data and cleans linked displays. Read the job until complete; paused jobs show a technical error and retry automatically. Daily quotas and security counters remain unchanged. Previously delivered messages and downloaded files cannot be recalled.

• GET Read a monitor deletion job

  Only the workspace owner may permanently delete a monitor. First request a five-minute configuration-bound preview, then send preview_id, confirm_deletion: true and an Idempotency-Key. Unconfirmed legacy archive requests are rejected. The monitor is immediately blocked; a durable job removes all its database, archive and cache data and cleans linked displays. Read the job until complete; paused jobs show a technical error and retry automatically. Daily quotas and security counters remain unchanged. Previously delivered messages and downloaded files cannot be recalled.

• GET Stream original numeric measurements

  Receive a snapshot and committed numeric point batches using server-sent events. Only actual stored samples are delivered. Point IDs allow deduplication; the owner-bound cursor resumes interruptions for twenty minutes. Expired cursors and corrected calculated series refresh the selected window. Each frame contains at most 1,000 points and 256 KiB. Session, workspace, series access and account limits are rechecked before every frame.

• GET Count open incidents

  Count all unresolved incidents in the selected workspace, including acknowledged and muted incidents. Requires the same read access as the incident list. Pagination, search and time filters do not affect this count.

• POST Create a local plugin ownership challenge

  Create a five-minute challenge bound to the current machine account, recovery key, management credential and registered client. No rights are granted.

• POST Authenticate the local plugin identity

  Verify a signed ownership challenge. Initial access is restricted to catalog read scopes; revoked or expired connections require browser approval. Tokens returned here are private helper state and must never be shown in chat.

• GET Read the current plugin connection

  Read the connection, scopes, permission revision and email verification state identified by this catalog OAuth token.

• POST Request email verification or plugin rights

  Create a ten-minute browser request for this token’s own connection. Email verification never merges accounts; rights proposals are restricted to the five catalog scopes and cannot approve themselves.

• GET Read the status of an own plugin request

  Read an own request and its currently effective connection state. Another connection’s requests cannot be inspected.

• PUT Change plugin permissions in the browser

  Apply browser-selected catalog scopes with CSRF protection and an expected revision. Older access tokens become invalid; an empty scope list revokes the connection. Workspace roles remain unchanged.

• GET Open a plugin browser approval

  Show current and proposed rights or an email claim. Unverified local machine owners must upload the helper’s one-use signed file before a separate approval. The file lasts ten minutes and the confirmation context five minutes.

• POST Confirm or deny a plugin request

  Verify the signed file or separately approve, partially approve or deny the bound request. Email verification uses a thirty-minute link; occupied addresses are disclosed only after proof of address ownership.

• POST Read local chart previews in a batch

  Read up to 16 numeric or state series belonging to this monitor for one time window. Each result is complete locally or indicates that a separate history query is needed. Local previews cover at most 24 hours and 1,000 display points per series; the response is limited to 4 MiB. Read permissions are sufficient. No archive jobs are created by this request.

• GET Available check locations

  Lists authorized, healthy locations and enabled check capabilities. Unavailable or disabled locations are omitted.

• GET Check results by location

  Read seven days of HTTP, network and browser checks with stable cursor pagination and result, location and period filters. Overview and history views return compact rows without diagnostic payloads or totals; fetch counts independently using the page snapshot and full diagnostics with view=detail. Current states consider every selected location and observation freshness. summary_only=1 returns only current states. Missing historical metadata stays unknown.

• GET API: Read check secret metadata

  Read the configured secret names and whether a value is stored. Secret values cannot be read. Changing the target clears its secrets; changing thresholds or selected metrics retains them.

• PUT API: Write check secrets

  Store or remove named values referenced by the check configuration. Send expected_revision to reject concurrent changes. The response contains only the new configuration revision. Values are never returned; existing runs are cancelled and subsequent runs use the new revision.

• POST Preview expected executions

  Validate a job schedule without saving it and return the next ten expected UTC timestamps. The preview does not create a monitor or alarms.

• GET Read a monitor schedule

  Read the saved schedule, next ten expected executions, accepted heartbeat and current running/overdue counts. Paused and event-driven monitors have no upcoming executions. Counts use available retained run details.

• POST API: Preview check settings and consumption

  Validate a check configuration, authorized healthy locations and selectable measurement series before creating or changing a monitor. The preview shows new and retained series, remaining account capacity and estimated checks per minute. It neither creates resources nor reserves quota. Creation checks current permissions and capacity again; measurements per day are an upper bound, not actual usage. A location outage or a disabled type does not produce an invented successful preview.

• GET Read check alarm suggestions

  Read available suggestions and existing rule identities for the current selected measurements. Reading creates no rules.

• POST Save selected check alarm suggestions

  Save explicitly selected keys against the current monitor revision. Repeating a selection reuses live rules and preserves user edits. The global availability rule follows the configured location quorum and confirmation counts.

• POST Start a monitor test

  Run an explicit test at a selected location without changing monitoring history or alarm confirmations. Retry the same request ID to read the original request.

• GET Read a monitor test

  Read the authorized test status, quota pause and private diagnostic result. A missing result does not confirm that the target is reachable.

• POST Cancel a monitor test

  Cancel your explicit test and invalidate its active execution lease. Repeating cancellation does not restart the test or change the normal monitor schedule.

• POST API: continue or cancel check setup

  Retry or cancel pending measurement series for a check monitor. Cancellation releases pending slots, pauses the monitor and retains existing history. Retrying rebuilds the reservations from its saved configuration; resuming remains an explicit action.

• GET Check results by location

  List the unexpired private browser recordings of this monitor, with filters and snapshot pagination.

• GET Check results by location

  Download one private encrypted recording after a fresh permission check.

• DELETE Start a monitor test

  Delete one browser recording and release its storage. Result replay never recreates deleted recordings.

• POST Start a monitor test

  Explicitly confirm a screenshot as a visual reference for the current target and viewport. Confirmation does not extend its retention.

• GET Read the monitor’s aggregate availability source

  HTTP and TCP, UDP, DNS, TLS, ping, service, domain and browser monitors use one aggregate availability series per monitor. For multiple checking locations, this series follows the monitor’s configured confirmation and any/all/quorum policy. Per-location and per-engine durations are never added together. The catalog includes active monitors with availability collection enabled; the individual source also exposes retained history when collection is disabled. Unknown, paused and unobserved time never count as confirmed availability. SLOs and reports use the same source and retain their separate maintenance calculations.

• GET List availability sources in a workspace

  HTTP and TCP, UDP, DNS, TLS, ping, service, domain and browser monitors use one aggregate availability series per monitor. For multiple checking locations, this series follows the monitor’s configured confirmation and any/all/quorum policy. Per-location and per-engine durations are never added together. The catalog includes active monitors with availability collection enabled; the individual source also exposes retained history when collection is disabled. Unknown, paused and unobserved time never count as confirmed availability. SLOs and reports use the same source and retain their separate maintenance calculations.

• POST Evaluate monitor availability

  Evaluates the last 90 days and periods of 24 hours, 7, 30 and 90 days using the monitor’s aggregate availability source. Calendar days use the requesting account’s time zone. Unknown, paused and missing time is not confirmed uptime. Existing history-query capacity and retention apply. Reuses equivalent running jobs or results up to five minutes old; poll the returned archive job for completion.

• POST Claim pending analytics receipts

  Browser-only operation for a verified regular human account. Requires its existing session, same-origin request and CSRF token. Returns up to three committed first-success receipts with a 90-second delivery lease. Retry delivery with the unchanged event ID. No historical events or machine access. Delivery may begin within seven days of the fact; retries stop after 47 hours from the first attempt, within the collector deduplication window.

• POST Acknowledge an accepted analytics receipt

  Use the ID and lease returned by claim, under the same browser session. Acknowledge only after the collector reports stored, duplicate or filtered. Repeated acknowledgements are idempotent. Do not acknowledge production receipts during diagnostic test mode. Keep the lease private; only the opaque event ID reaches the collector.

• POST Test a monitor draft

  Run the configured check once at a selected authorized location without creating a monitor, series or alerts. Reuse the same request_id after an uncertain response. Protected credentials and private results expire after 15 minutes. Browser and mail actions require actions_confirmed; browser recordings are disabled and visual baselines require a saved monitor. Executions share regular network/browser budgets.

• GET Read a draft test result

  Read your private draft test in its authorized workspace before its 15-minute expiry. Pending, running, unknown and confirmed target failures remain distinct.

• POST Cancel a draft test

  Cancel your own active draft test. Repeating cancellation is safe. Running browser time remains charged and late results are rejected.

• GET Read the website favicon

  Return the public favicon of this HTTP or browser monitor as an image. Requires the same workspace read access as the monitor. If no icon is available, the response is empty.

• GET Read monitor notifications

  Read the saved outage, expiry and message settings.

• PUT Save monitor notifications

  Save settings with the current configuration and alerting revisions. Managed alarm rules and resource limits are checked together.

• GET List escalation policies

  List your reusable notification policies.

• POST Create an escalation policy

  Choose up to five stages with verified destinations. The first stage starts immediately; later delays increase, up to 24 hours.

• PUT Update an escalation policy

  Use the current revision. Changes apply to new incidents.

• DELETE Delete an escalation policy

  Policies used by monitors cannot be deleted.

• GET Read available notification choices

  Read verified destinations and policies available in the selected workspace.

• POST Create a single-use server installation code

  Browser-authorized ten-minute code bound to this workspace and selected profile. Creates no monitor until redemption; requires editor rights. Only a code hash is stored.

• GET Read automatic server setup progress

  Reports receipt of the first heartbeat and selected measurements after enrollment. The issuing browser can read this status after the code expires.

• DELETE Revoke an unused installation code

  Revokes an unused code. Already enrolled servers and their device keys remain managed through the existing monitor and key interfaces.

• POST Enroll a server with an installation code

  Atomically creates or connects the bound server, profile, groups and a device-scoped key from the locally generated key hash. Identical claims resume safely; a private device key can recover a committed claim after code expiry.

• GET Download the Linux/macOS setup script

  Resolves the latest released native agent at execution time. Pins all binary URLs and SHA-256 checks to the same signature-verified release; the agent verifies its signed manifest before setup. Pass the code as a local argument.

• GET Download the Windows setup script

  PowerShell bootstrap for the latest released Windows agent. Detects architecture, verifies downloads and starts automatic enrollment and native service installation. Administrator approval may be required.

• GET Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• PUT Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• PUT Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read incident and maintenance drafts

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• POST Register a signed webhook and verify its receiver

  Authenticated page administration with active-session, ownership, page-role and CSRF checks. Sources, members, domains, delivery rules and whole-page withdrawal require the owner. Editors save drafts; publishers release approved content. version detects parallel edits. Public delivery acknowledges matching publication revisions before publication or revocation is complete.

• GET Read your personal list order

  Personal list order for the signed-in user in this workspace. Owner, editor and viewer can change their own order. Browser sessions only; changes need CSRF and an Idempotency-Key. Manual sorting keeps other entries in their relative order; new entries append and deleted or reassigned entries lose their position.

• DELETE Reset your personal list order

  Personal list order for the signed-in user in this workspace. Owner, editor and viewer can change their own order. Browser sessions only; changes need CSRF and an Idempotency-Key. Manual sorting keeps other entries in their relative order; new entries append and deleted or reassigned entries lose their position.

• POST Move an entry in your personal list order

  Personal list order for the signed-in user in this workspace. Owner, editor and viewer can change their own order. Browser sessions only; changes need CSRF and an Idempotency-Key. Manual sorting keeps other entries in their relative order; new entries append and deleted or reassigned entries lose their position.

• GET Read responsibility and internal notes

  Read the assignee and actual acknowledgement actor. Internal notes have 50-row cursor pages. Only workspace members can read them.

• PATCH Assign an incident

  Assign an active owner or editor using the current collaboration revision and an operation UUID. Send an empty assignee ID to clear the assignment.

• POST Add an internal incident note

  Editors can add plain-text notes up to 4 KiB with an operation UUID. Limits per owner account: 10 per minute, 100 per UTC day and 1,000 per incident, including deleted notes. Reusing the UUID returns the same note. Notes are never automatically published or sent.

• DELETE Delete an internal incident note

  An editor can delete their own notes; the owner can delete any note in this workspace. Repeated deletion succeeds. The note text is removed; admission metadata remains until the incident or account is deleted.

• GET API: List your background jobs

  List your own CSV exports, retained history queries and recent availability analyses or reports in one workspace. Results remain subject to membership and retention.

• GET Current authorized server summaries and removed identifiers.

  Read the latest values and contact status for up to 50 servers in one workspace. Browser sessions only. Unknown, removed or moved identifiers are returned in removed_ids without exposing other workspaces.

• GET Receive full summaries events for the selected servers, initially and after reconnecting. New saved values are delivered within five seconds on a healthy connection. A control snapshot runs every four seconds; sessions and workspace access are checked before each response. access_revoked clears private values and ends the stream. Background tabs should close the stream.

  Receive full summaries events for the selected servers, initially and after reconnecting. New saved values are delivered within five seconds on a healthy connection. A control snapshot runs every four seconds; sessions and workspace access are checked before each response. access_revoked clears private values and ends the stream. Background tabs should close the stream.

• PATCH Mark job details as read

  Marks your job notices as read. Repeated confirmation is harmless; access is checked for every job.

• POST Receive new job notices

  Returns up to three newly completed notices once across your browser tabs. Unread markers remain until you open the details.

• POST Repeat a history or export job

  Creates a new job for the same period with a fresh snapshot. Current access, data availability and limits apply. Reusing the operation ID returns the same new job.

• POST Repeat your SLO or report analysis

  Creates a new analysis for the original period and unchanged source settings. Changed or removed sources require a new analysis from their current view.

• GET Saved personal navigation

  Read your account-synchronized favorites and recently opened resources. Current access is checked for every resource.

• GET Search accessible resources

  Search monitors, series, status pages, groups, alert rules, incidents, maintenance plans, service-level objectives, report schedules and reports by name or ID. You can filter by resource type. At most 20 accessible results are returned: exact IDs first, then name prefixes.

• PUT Save a resource as a favorite

  Save one accessible resource to your account favorites. Repetition is harmless; the account-wide limit of 50 favorites is checked atomically.

• DELETE Remove a personal favorite

  Remove a resource from your favorites without changing the resource itself. Repeated removal is harmless and an existing recent visit is retained.

• POST Record an opened resource

  Remember a resource you opened after checking your current access. Your account keeps at most 20 recent resources for 30 days.

• GET Live monitor and server lists

  Live monitor or server list for browser sessions only. Uses the same filters and page as getDevices, including empty selections. devices events contain the complete page, status counts and facets; access_revoked clears private data, invalidated requires reloading the page. Shared streams refresh within five seconds while connected and pause in background tabs.

• POST Availability and response time

  Customize your personal dashboard directly: move cards, choose sources, set titles and widths, and add monitor, metric, chart or maintenance cards. Changes take effect only after saving and always respect the group filter.

• GET Read one incident

  Open an accessible incident by its ID, including retained older and resolved incidents.

• POST Evaluate HTTP response times by location and region

  Compare all retained regular HTTP check durations by location or world region in one snapshot. Means are weighted by sample count; the overall average includes hidden locations. Missing measurements remain gaps. Automatic display shares a 16,000-point and 4 MiB result budget across both representations. Original and live capacity limits are explicit; realtime alarm series are unchanged.

• GET Read SSL certificate details

  Read bounded, location-bound certificate evidence. Automatic certificate diagnostics and remaining-day measurements run hourly; domain diagnostics run daily. Rechecks require edit rights, a saved target, the current configuration revision and an operation id. They use check quotas without changing regular HTTP measurements or alarm confirmations. Unknown or stale evidence does not confirm validity.

• POST Recheck an SSL certificate

  Start a revision-bound, TLS-only certificate diagnosis at one saved monitor location. Requires write access and available checker capacity; it does not resend the HTTP request or change regular telemetry. Reuse the operation ID when retrying.

• GET Read certificate recheck status

  Read the status and completion time of your certificate recheck for this monitor. A completed diagnostic does not confirm availability; retrieve the TLS view for its current certificate evidence.

• GET Read alarm rule diagnosis

  Read bounded evaluation evidence and reasons for an active or archived rule without creating an incident or sending notifications. Requires telemetry:read for machine access and access to the rule workspace.

• GET Read browser journey overview

  Returns browser-run statistics, duration and Web Vitals for the selected engine, location and retained time window. Filter options list only engine/location combinations with stored results anywhere in the same window, independently of the active filters and history pagination.

• GET Read browser run and source

  Read one retained browser result and its original configuration snapshot without secret values. An unavailable historical snapshot remains null.

• GET List draft browser recordings

  List completed recordings belonging to your private draft test. Recordings expire with the draft, no later than fifteen minutes after its creation.

• GET Download draft browser recording

  Download a completed, authorized draft recording before it expires. Videos contain masked frames and no audio.

• POST Prepare a report export

  Creates or reuses an export of the completed snapshot. CSV includes every filtered row of one section. PDF accepts one section or * for all selected sections. PDF is limited to 60 seconds, 20 MiB and 100 pages; excessive output fails without truncation.

• GET Read export progress

  Returns queued, running, completed or failed export status. Download only a completed export.

• GET Download a report export

  Downloads all CSV rows or the complete PDF from the same frozen snapshot. Account, workspace and concrete source access must still be valid.

• GET Read report rows

  Reads a completed section in pages of 50 rows. Filters and totals are frozen with the report. Use the returned cursor for the following page. Downloads check current workspace and resource access again.

• GET List report sources

  Lists report sections and authorized monitor, group, location and filesystem choices. Viewer access is sufficient; machine clients need telemetry:read.

• POST Calculate a report

  Creates or reuses a bounded analysis job. Periods support up to 365 days; hourly grouping supports 14 days. Group members are frozen at calculation start. Interactive results expire after 24 hours. Inspect the returned analysis job until it completes.

• GET List personal report selections

  Browser-session-only preferences for an accessible workspace. Up to 50 named selections per person and workspace, including viewers. Saves definitions, filters and period, never results or computation jobs. Writes require CSRF. Reuse the client-generated ID and identical create payload after a lost response. Updates and deletion require the current expected_revision; stale changes return 409. Source permissions and result expiry remain unchanged.

• POST Save a personal report selection

  Browser-session-only preferences for an accessible workspace. Up to 50 named selections per person and workspace, including viewers. Saves definitions, filters and period, never results or computation jobs. Writes require CSRF. Reuse the client-generated ID and identical create payload after a lost response. Updates and deletion require the current expected_revision; stale changes return 409. Source permissions and result expiry remain unchanged.

• PUT Update a personal report selection

  Browser-session-only preferences for an accessible workspace. Up to 50 named selections per person and workspace, including viewers. Saves definitions, filters and period, never results or computation jobs. Writes require CSRF. Reuse the client-generated ID and identical create payload after a lost response. Updates and deletion require the current expected_revision; stale changes return 409. Source permissions and result expiry remain unchanged.

• DELETE Delete a personal report selection

  Browser-session-only preferences for an accessible workspace. Up to 50 named selections per person and workspace, including viewers. Saves definitions, filters and period, never results or computation jobs. Writes require CSRF. Reuse the client-generated ID and identical create payload after a lost response. Updates and deletion require the current expected_revision; stale changes return 409. Source permissions and result expiry remain unchanged.

• GET Get live and history limits

  Returns only the effective account limits required for history and live views. With workspace_id, uses the authorized workspace owner’s shared limits. Does not calculate usage or forecasts.

• GET Read public readiness status

  Checks public service readiness without returning private diagnostics or monitoring data.

• GET Read agent update availability and progress

  New native installations enable remote updates with a separate key permission. An icon in the server list appears when a newer approved version is available. The workspace owner confirms each update; wait for confirmation after restart. Configuration-write permission is independent. Temporary contention returns 503 with update_busy and Retry-After: 1. Retry with the same operation_id and confirmed target; the interface retries for up to ten seconds. An accepted request is returned again without creating another update. The opaque target_id binds the approved release and source installation/version; refresh and confirm again if they change.

• POST Confirm an agent update

  New native installations enable remote updates with a separate key permission. An icon in the server list appears when a newer approved version is available. The workspace owner confirms each update; wait for confirmation after restart. Configuration-write permission is independent. Temporary contention returns 503 with update_busy and Retry-After: 1. Retry with the same operation_id and confirmed target; the interface retries for up to ten seconds. An accepted request is returned again without creating another update. The opaque target_id binds the approved release and source installation/version; refresh and confirm again if they change.

• POST Claim the update for the bound native installation

  Claim the update for the bound native installation

• POST Report native update progress

  Report native update progress

• GET Read approved log policy

  A source write key reads only its own enabled state and masking policy. It cannot approve new local files or commands.

• POST Report log collection coverage

  Report a selected log stream’s collection or delivery state. A ready status alone does not prove complete delivery; cursor checkpoints are acknowledged together with their log batches. Buffered interruptions remain pending until continuity is confirmed.

• GET List log alerts

  Read log rule definitions, delivery configuration and current evaluation coverage for the authorized workspace.

• POST Create log alert

  Create a count or silence rule with its own filter and notification destinations. Incomplete observation never confirms recovery.

• DELETE Delete log alert

  Archive a log rule and its grouped instances and stop further evaluations and queued notification delivery.

• PUT Update log alert

  Update a revision-bound log rule and its grouped instances, retaining their existing incidents and collaboration.

• POST Create log export

  Start a CSV or NDJSON export over a frozen filter snapshot. Exceeding the complete-export limit fails explicitly instead of returning truncated output.

• GET Read log export status

  Read the status of your protected export job. Download becomes available only after the complete export is ready.

• GET Download log export

  Download a complete export while its current workspace access, source revisions and retention remain valid.

• POST Ingest native logs

  Accept JSON, arrays or NDJSON with optional gzip. Mask before durable acceptance; stable batch and record IDs prevent duplicate charging and storage.

• POST Ingest platform logs

  Verify the configured platform and normalize its documented payload. Provider identifiers are preserved; retries without stable IDs are not deduplicated by message text.

• POST Preview log masking

  Return the masked form of one sample without storing its original or booking log usage.

• POST Start log search

  Create a protected asynchronous search over a frozen available data snapshot. Counts, histogram and facets cover all matching rows, independently of cursor pagination.

• DELETE Cancel log search

  Cancel or remove your query job. A running worker cannot republish a deleted result.

• GET Read log search result

  Read an actor-bound query status or its completed result after rechecking workspace access and current source retention.

• GET List log sources

  Read sources and the owner’s separate daily log usage in an authorized workspace.

• POST Create log source

  Create a source without a monitor or series. Collection is disabled unless explicitly enabled.

• DELETE Delete log source

  Revoke access, discard waiting ingestion and invalidate queries and exports. Physical deletion follows within 24 hours.

• PUT Update log source

  Change a revision-bound source. Shorter retention requires confirm_delete and immediately invalidates affected query results.

• POST Replace source client certificate

  Issue a source-bound TLS client certificate and return its private key once. Earlier source certificates are revoked.

• DELETE Revoke source credentials

  Immediately revoke all source keys and client certificates without deleting stored log entries.

• POST Replace source write key

  Issue one write-only source key and revoke previous source credentials. The plaintext is returned exactly once.

• GET Stream live logs

  Stream authorized indexed logs using SSE. Resume with Last-Event-ID or after; gaps are explicit and access is rechecked during the stream.

• GET Read log usage

  Read accepted daily log bytes and entries across all workspaces of the resource owner, including the effective quota and next UTC reset.

• GET List saved log views

  Read your personal views and shared views of the selected workspace.

• POST Save log view

  Save a personal query definition or share it with editor rights. Alert filters remain independent of later view changes.

• DELETE Delete saved log view

  Delete your own saved view without deleting logs or changing alert definitions.

• PUT Update saved log view

  Update your own view with its expected revision; changing a shared view also requires editor rights.

• POST Ingest OTLP logs

  Accept OTLP/HTTP Protobuf or Protobuf-JSON logs with a source write key. Retryable failures include Retry-After and use OTLP status responses.

• POST Read dashboard card previews

  Read current data for visible dashboard cards, including unsaved previews. The selected workspace and group always limit the sources. This operation does not save a layout.

• GET Find dashboard sources

  Search authorized sources for a dashboard card. Follow next_cursor to read further results. Selections change only the dashboard.

• POST Test a saved monitor at public locations

  Start an idempotent diagnostic using the saved revision at all public locations. Unsupported or unavailable locations are reported separately. Results expire after 15 minutes and do not enter monitoring history, measurements or alerts. Browser, mail and mutating HTTP checks require explicit confirmation.

• GET Read temporary diagnostic results

  Read one snapshot with progress and results for each location. Only the initiating user can read the diagnostic, for at most 15 minutes after it started.

• POST Cancel a diagnostic

  Stop all pending and running location checks. Repeated cancellation is safe; late results cannot restart cancelled work.

• DELETE Disable the heartbeat URL

  Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

• GET Read heartbeat URL status

  Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

• PUT Create or replace the heartbeat URL

  Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

• POST Show the heartbeat URL

  Only a signed-in workspace owner or editor may manage this credential. Reveal requires CSRF protection and returns a secret that must not be persisted in browser storage. Replacement and disabling require expected_revision. Replacement immediately invalidates the previous URL; an uncertain response must be resolved by reading the current status, not by blindly repeating replacement.

• GET Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• HEAD Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• POST Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• GET Available servers

  Lists servers in this workspace with bounded log metadata, capability and last contact. No log content is included.

• POST Connect a log source

  Explicitly creates or updates a source and selected streams. Repeating the same operation ID and settings preserves resources. Codes and keys are returned only once.

• GET Connection progress

  Returns progress and non-secret settings for the issuing actor. Historical receipts do not confirm a new setup.

• POST Replace a lost setup code

  Explicitly replaces a lost or expired code for the same current selection. Existing working source keys are preserved.

• POST Configure provider forwarding

  Configures only the explicitly selected provider target using the bound authorization. Existing unrelated forwarding is never replaced.

• DELETE Stop a log stream

  Immediately rejects further records for this stream while preserving its history and local position. New access requires local consent.

• GET Log integration methods

  Returns supported connection methods and availability of configured provider authorization.

• GET Provider authorizations

  Lists this actor’s active workspace-bound provider authorizations without returning credentials.

• POST Authorize a provider

  Validates a provider API token and stores it encrypted for this actor and workspace. Provider permissions and charges apply.

• GET Available provider targets

  Returns authorized projects, applications or zones for this actor’s provider connection.

• DELETE Revoke provider authorization

  Removes stored provider credentials. Existing forwarding remains active until disabled at the provider or the source.

• POST Start provider authorization

  Starts a short-lived actor- and workspace-bound provider authorization in the browser.

• GET Complete provider authorization

  Validates browser session and one-time state, stores encrypted authorization and returns to log setup.

• GET Local provider setup command

  Downloads the fixed helper for AWS, Fly.io and an existing Kubernetes Collector. Local provider authorization and explicit consent are required.

• POST Claim local provider setup

  Exchanges a short-lived setup code for its fixed target and protected configuration. Repeated application reuses owned resources.

• POST Report discovered log sources

  Reports up to 100 metadata-only candidates using the installed device identity. Discovery never grants read access.

• POST Approve agent log selection

  Previews and claims the exact code-bound selection using the bound server identity. Confirm only after local administrator consent; report applied or failed.

• GET Available log types

  Lists log datasets available for an authorized selected Cloudflare zone. Selection is verified again before creating Logpush.

• GET List company connections

  List company connections. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Create a company connection

  Create a company connection. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• GET Read a company connection

  Read a company connection. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• PUT Save an SSO configuration draft

  Save an SSO configuration draft. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• DELETE Delete a company connection

  Delete a company connection. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• PUT Set workspace SSO policy

  Set workspace SSO policy. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Verify a company DNS domain

  Verify a company DNS domain. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• GET Read company directory and audit

  Read company directory and audit. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Rotate a SCIM token

  Rotate a SCIM token. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• DELETE Revoke the SCIM token

  Revoke the SCIM token. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• PUT Map company group permissions

  Map company group permissions. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Decide an access request

  Decide an access request. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Grant temporary owner access

  Grant temporary owner access. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Publish a tested SSO configuration

  Publish a tested SSO configuration. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• GET Read the saved SSO draft

  Read the saved SSO draft. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Adopt company memberships

  Adopt company memberships. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• POST Start company sign-in

  Start company sign-in. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• GET Receive an OIDC sign-in response

  Receive an OIDC sign-in response. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• POST Receive a SAML sign-in response

  Receive a SAML sign-in response. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• GET Use company sign-in

  Use company sign-in. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• GET Read a company sign-in operation

  Read a company sign-in operation. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• POST Complete company sign-in

  Complete company sign-in. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• GET Read the workspace sign-in link

  Read the workspace sign-in link. Company sign-in is browser-bound. Existing accounts require explicit linking and fresh email confirmation; an email address never merges identities.

• GET List SCIM users

  List SCIM users. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• POST Create SCIM users

  Create SCIM users. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read a SCIM user

  Read a SCIM user. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• PUT Replace a SCIM user

  Replace a SCIM user. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• PATCH Patch a SCIM user

  Patch a SCIM user. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• DELETE Delete a SCIM user

  Delete a SCIM user. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET List SCIM groups

  List SCIM groups. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• POST Create SCIM groups

  Create SCIM groups. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read a SCIM group

  Read a SCIM group. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• PUT Replace a SCIM group

  Replace a SCIM group. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• PATCH Patch a SCIM group

  Patch a SCIM group. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• DELETE Delete a SCIM group

  Delete a SCIM group. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read SCIM service capabilities

  Read SCIM service capabilities. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read SCIM schemas

  Read SCIM schemas. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read a SCIM schema

  Read a SCIM schema. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read SCIM resource types

  Read SCIM resource types. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• GET Read a SCIM resource type

  Read a SCIM resource type. Directory tokens are restricted to one directory. Deactivation revokes company access without deleting the personal account. Group mappings grant only Viewer or Editor.

• POST Receive native alert callbacks

  Receive native alert callbacks. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• POST Confirm an incident from Slack

  Confirm an incident from Slack. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• POST Start Slack app authorization

  Start Slack app authorization. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• GET Complete Slack app authorization

  Complete Slack app authorization. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• GET List authorized Slack workspaces

  List authorized Slack workspaces. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• GET List available Slack channels

  List available Slack channels. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• POST Link a personal Slack identity

  Link a personal Slack identity. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• POST Verify an alert recipient number

  Verify an alert recipient number. New destinations remain disabled and require explicit alarm routing. Callback authentication is provider-specific; external closure never resolves a measured incident. SMS and voice require recipient verification and a separate paid budget.

• POST Grant temporary owner access

  Grant temporary owner access. Owner configuration requires a fresh action-bound email confirmation. Test the configuration before enabling required SSO. Personal and unrelated company access remain independent.

• GET Manage optional authenticator protection

  Verified browser account only. Enrollment requires a fresh purpose-bound email confirmation; activation also requires a valid authenticator code and acknowledgement of ten recovery codes. Existing factors require fresh strong reauthentication for changes. Other browser sessions are revoked. Secrets are returned once and must not be cached.

• DELETE Manage optional authenticator protection

  Verified browser account only. Enrollment requires a fresh purpose-bound email confirmation; activation also requires a valid authenticator code and acknowledgement of ten recovery codes. Existing factors require fresh strong reauthentication for changes. Other browser sessions are revoked. Secrets are returned once and must not be cached.

• POST Manage optional authenticator protection

  Verified browser account only. Enrollment requires a fresh purpose-bound email confirmation; activation also requires a valid authenticator code and acknowledgement of ten recovery codes. Existing factors require fresh strong reauthentication for changes. Other browser sessions are revoked. Secrets are returned once and must not be cached.

• POST Manage optional authenticator protection

  Verified browser account only. Enrollment requires a fresh purpose-bound email confirmation; activation also requires a valid authenticator code and acknowledgement of ten recovery codes. Existing factors require fresh strong reauthentication for changes. Other browser sessions are revoked. Secrets are returned once and must not be cached.

• POST Manage optional authenticator protection

  Verified browser account only. Enrollment requires a fresh purpose-bound email confirmation; activation also requires a valid authenticator code and acknowledgement of ten recovery codes. Existing factors require fresh strong reauthentication for changes. Other browser sessions are revoked. Secrets are returned once and must not be cached.

• GET Complete second-factor verification

  The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.

• POST Complete second-factor verification

  The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.

• DELETE Complete second-factor verification

  The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.

• POST Complete second-factor verification

  The first login proof creates only a browser-bound five-minute challenge. Submit an authenticator code or one-use recovery code. No usable session exists before success. At most five incorrect attempts per challenge; additional account and network limits apply. GET inspects the current challenge; DELETE cancels it. Reauthentication additionally requires the existing session and CSRF.

• GET Inspect incident log context

  Returns saved source and rule-filter context for new incidents, or clearly identified current associations for older incidents. Current access and retention always apply. Optional incident_id, incident_scope (associated or workspace) and incident_mode (matched, warnings or all) on log queries reuse the normal query worker and budgets. Workspace expansion is explicit. Later search results are investigation context, not original alarm evidence.

• GET Find incidents overlapping a log window

  Returns up to 100 overlapping incidents for authorized workspace sources. limited indicates truncation. source_ids is a JSON array of at most 100 UUIDs. Marker overlap does not establish causation.

• GET Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• HEAD Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• POST Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• GET Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• HEAD Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• POST Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• GET Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• HEAD Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• POST Measure a job run using its heartbeat URL

  Empty-body GET, HEAD or POST. /start begins a run; the base URL succeeds; /fail fails; /abort aborts. Only success confirms a scheduled heartbeat. Optional UUID run_id pairs parallel runs and makes repeated identical phases idempotent; conflicting endings return 409. Without an ID only one measurement may be open. A base heartbeat without an open measurement keeps its original behavior. Duration measures server receipt times; missing starts produce no duration. Each new phase consumes one ordinary event; retries do not double charge. Never put secrets in logs or automatically retry uncertain calls without a run ID.

• GET Read central phone allowance

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• GET List your sender domains

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Add a sender domain

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Revoke sender domain

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Rotate sender signing key

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Recheck sender DNS

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• GET Read sender delivery status

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• PUT Save status-page sender draft

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Preview branded visitor mail

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Review status-page sender

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Send a brand test to your verified address

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• GET Read ownership transfer status

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Propose ownership transfer

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Preview ownership transfer

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Accept workspace ownership

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• POST Withdraw ownership proposal

  Requires a verified browser session and the current role. Mutations require CSRF. Sender identity and ownership changes additionally require fresh action-bound confirmation. No provider secrets are returned.

• GET Read safe monitor alarm settings, recipients and suggested rules. Channel credentials are never included.

  Read safe monitor alarm settings, recipients and suggested rules. Channel credentials are never included.

• PUT Save the monitor recipient default with its expected revision. Individual exceptions and existing incident snapshots remain unchanged. Explicit adoption is limited to 100 rule IDs.

  Save the monitor recipient default with its expected revision. Individual exceptions and existing incident snapshots remain unchanged. Explicit adoption is limited to 100 rule IDs.