Tune it when the defaults aren't right.
Interval, slow threshold, timeout, failure streak, redirects, SSL and domain expiry. Every knob the create form has, with a sane default on each.
Assert on the JSON, not on the status code.
An API monitor parses the JSON your endpoint returns and asserts on a field inside it. Not the status line, not the raw text: the value at a path you name.
That matters because a health endpoint's whole job is to answer a question, and
200is not the answer.{"status":"degraded"}ships with a 200. So does{"db":false}. An API check reads the thing your endpoint went to the trouble of telling you.A rule names a dot path and, optionally, the value you expect there:
statusequalsok,checks.dbequalstrue. Omit the expected value and the rule becomes a presence check, which passes as long as the field exists at all.This is what separates an API check from a keyword one. Keyword asks whether the text
okappears anywhere in the body, which a field callednot_okwould satisfy. API asks whatstatusis.When the body isn't JSON, the check fails and says so rather than guessing. An HTML error page where JSON should be is exactly the outage you want caught, and it's a distinct verdict from "the field was missing" and from "the field said something else".
Each of those three reads differently in the incident: not JSON, missing, or the value it got instead.
Name the field that matters
Point it at an endpoint that answers in JSON, then say what to assert. Every rule has to pass, and read-only methods still apply: GET is the default, and HEAD isn't offered, because a body is the entire point.
Everything around the check.
Alerts on the change, not every minute.
Once when it breaks, once when it recovers, to Slack, Discord, a webhook, email, or your phone. A confirmation streak holds back the blips.
A status page your users can read.
Every monitor can back a public status page with ninety days of history, on your own domain, so the question answers itself.
Every outage, written down as it happens.
A confirmed failure opens an incident and keeps the timeline, detected to resolved. The first half of the post-mortem writes itself.
Planned downtime that pages no one.
Schedule a window and the monitors it covers stop being checked, so nothing alerts, no incident opens, and the time is left out of your uptime.
Everything else you can watch.
HTTP / Website, Keyword, Heartbeat, Scheduler, DNS, and Port. Every one reports up, slow, or down, on the same interval, into the same alerts.