Monitoring that explains what happened
API monitoring with response assertions
Check a small, predictable endpoint and confirm the response your application depends on. Avoid using a monitor request that creates a purchase or another irreversible action.
More than an HTTP 200
Choose GET, POST, PUT, PATCH, DELETE or HEAD. Check the status range, a JSON dot-path value, required or forbidden response text, a response header, and a response-time threshold.
Keep credentials scoped
Use a dedicated credential with the minimum permissions. Request headers and bodies are encrypted at rest and are not returned in monitor responses. Credential-bearing requests require HTTPS; API redirects are not followed.
Bounded checks for predictable results
Requests have a configured timeout of up to 30 seconds. Request bodies are limited to 16 KB and responses to 1 MB. This is endpoint monitoring, not a load test or a browser journey.
Chain bounded API scenarios
Authenticate with a dedicated test identity, extract a JSON or header value and use it in a later request header or JSON body. Plans allow up to five steps within one execution timeout. Every fixed public URL is revalidated; redirects are rejected. Extracted values and arbitrary response bodies are not retained.
Common questions
Which JSON paths can I assert?
Simple dot-separated object keys and array indices, such as data.status or items.0.id. Wildcards, filters and executable expressions are not supported.
Can I monitor a private API?
Only publicly routable destinations are supported in this phase. Private networks and local addresses are rejected.