REST API
Monitors, incidents, status pages and metrics. Six abilities, named per route, and no wildcard scope — a token that can do everything is a password with extra steps.
For developers
Everything the dashboard does, over HTTP
Tokens are scoped per resource and read is separate from write, so a dashboard you build can read metrics without also being able to delete every monitor.
Heartbeat URLs
Add a curl to the end of your cron line and get told when it stops finishing. A paused monitor still answers 200, because making your backup fail because monitoring is paused would be an absurd thing to do to you.
JSON assertions
Assert on a field in the response rather than on the status code. Useful for the endpoint that returns 200 with an empty array when its upstream is down.
Metrics that admit what they do not know
Uptime and latency come from hourly and daily rollups. A bucket with no checks in it returns null rather than 0 or 100 — charting a gap is honest, and inventing either number is not.
Rate limits
Per token, not per account. A noisy integration throttles itself rather than the one your colleague is relying on, and the token name on the management screen says which it was.
curl https://unimonitor.unibagency.com/api/v1/monitors \
-H "Authorization: Bearer $UNIMONITOR_TOKEN" \
-H "Accept: application/json"Verifying an outbound webhook
Add a webhook channel with an endpoint and a signing secret, and we POST JSON when a monitor goes down, recovers, or escalates. The signature is an HMAC-SHA256 over the timestamp, a dot, and the raw request body — verify against the bytes you received, not a re-encoding of the parsed JSON, or key order will make a valid delivery look forged. Reject anything whose timestamp is more than a few minutes old.
$raw = file_get_contents('php://input');
$stamp = $_SERVER['HTTP_X_UNIMONITOR_TIMESTAMP'];
$expected = 'sha256=' . hash_hmac('sha256', $stamp . '.' . $raw, $secret);
if (! hash_equals($expected, $_SERVER['HTTP_X_UNIMONITOR_SIGNATURE'])) {
http_response_code(400);
exit;
}
if (abs(time() - (int) $stamp) > 300) {
http_response_code(400);
exit;
}Set it up this afternoon
Add your first monitor in about a minute. Add the rest of the portfolio over a coffee.