Give your tools a scoped key to your nest

Create a little bridge

Workspace owners can open Account → API access on every plan. Give the token a recognizable name and choose 7, 30 or 90 days. Each workspace can have up to 10 active tokens. Copy the token immediately into your tool’s secret storage; it is shown only once.

Choose Read monitor status for monitors:read, or explicitly choose Read, pause and resume for monitors:control. For provisioning tools, explicitly choose Create and edit monitors (monitors:write); it also includes read and pause/resume. No scope allows deletion, billing access or website sign-in. Admins, viewers and support sessions cannot create tokens.

Read monitor status

Send GET https://uptimeowl.online/api/v1/monitors with Authorization: Bearer YOUR_TOKEN. Use limit=20 (up to 100); pass the returned nextCursor as after to fetch the next page. No workspace header is needed: the token is bound to its workspace.

Responses include monitor ID, name, enabled state, last recorded status, last check time, latency and configured interval. They omit target URLs, request credentials and response logs. A last recorded status is not a fresh probe: always check lastCheckedAt, and respect paused monitors.

Pause or resume with control access

A monitors:control token can send PATCH /api/v1/monitors/MONITOR_ID/state with Content-Type: application/json and exactly {"enabled":false} to pause, or {"enabled":true} to resume. Include the same Authorization header. Existing read-only tokens cannot do this; create a separate control token when needed.

Repeating the same state is safe and does not restart detection state. Send requests in order: an old retry after a newer opposite instruction would change the state again. Control allows up to 30 requests per minute per workspace and records the owner and token in Workspace history.

Create or edit from your own tool

A monitors:write token can POST /api/v1/monitors to create, or PATCH /api/v1/monitors/MONITOR_ID to edit. Send JSON and a unique Idempotency-Key header for each intended operation. Existing monitor settings, plan allowances and interval rules still apply. Use enabled: false if a new monitor should begin paused.

If the response is lost, retry with the same token, key and request within 24 hours. The API returns the saved result without creating another monitor or repeating an edit. A key reused for different content is rejected. Use a new key for a new change, and inspect current state before retrying beyond 24 hours. These responses acknowledge the original operation; they do not replace newer changes.

Keep the key safe

Use tokens only in trusted server-side tools, never in public browser JavaScript or URLs. Each workspace has a shared limit of 120 requests per minute; wait 60 seconds after a 429 response. Requests may also be limited by source IP. A 503 means API access is temporarily unavailable; back off before retrying.

Expired or revoked tokens return 401. Access also stops when the issuing owner loses owner access, their account is disabled, or the workspace is suspended or deleted. Revocation prevents new requests; a read already admitted may finish.

Rotate or retire a token

Create a replacement, update your tool and then revoke the old token. Revoke asks for confirmation. Creation and revocation appear in Workspace history, without the secret. Expired tokens disappear from the active list. If a token is exposed, revoke it immediately and issue a replacement.