API Documentation

1. Base URL

All API requests are made to:

https://api.kawze.com

A quick way to confirm connectivity and check the running API version is GET /v1, which doesn't require authentication:

curl https://api.kawze.com/v1

2. Authentication

Every other endpoint requires an API key, sent as a bearer token in the Authorization header:

curl https://api.kawze.com/v1/monitors \
  -H "Authorization: Bearer kawze_live_<your-key>"

Create and manage API keys from Account › Admin APIs once you're logged in. Each key is issued with a role - read, write, or admin - which gates what it can do using the same permission checks as a human account member. Keys can't be issued with billing or owner access, so a leaked key can never touch your subscription or account ownership.

You can reveal or regenerate a key later from the same page if you need to see it again or rotate it. Revoke a key at any time if it's no longer needed or may have leaked.

Admin keys (this page) cover /v1/account, /v1/monitors, and /v1/outages below. A separate kind of key, scoped only to sending heartbeat pings, is created from Account › Heartbeat APIs - see section 7. The two aren't interchangeable: an admin key can't send a heartbeat ping, and a heartbeat key can't read or write anything else.

3. Errors

Every response includes a status field, either "ok" or "error". Error responses also include a human-readable message:

{
  "status": "error",
  "message": "You do not have permission to update monitors on this account"
}

Common status codes: 400 bad request or not authenticated, 403 the key's role doesn't permit the action, 404 not found.

4. Account

Returns the account your key belongs to, and its members.

5. Monitors

Lists every monitor on the account.

Returns a single monitor.

Creates a monitor. Requires write role or higher. Body is { "monitor": { ... } } - the monitor shape depends on type (http, heartbeat, domain, timings, cache-warming, or tcp). A minimal HTTP monitor:

curl -X POST https://api.kawze.com/v1/monitors \
  -H "Authorization: Bearer kawze_live_<your-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "monitor": {
      "type": "http",
      "name": "Marketing site",
      "url": "https://example.com",
      "intervalSeconds": 60,
      "regions": ["uk"]
    }
  }'

Server-managed fields (status, enabled, lastChecked, and similar) are always assigned by the server and ignored if sent - see the full field reference for each monitor type in the dashboard's monitor editor.

Updates a monitor. Requires write role or higher. Same body shape as create. PUT and PATCH on the same path do the exact same full-replace update, for tooling that expects those verbs instead of POST.

Deletes a monitor. Requires write role or higher.

6. Outages

Lists incidents across all of the account's monitors.

Returns a single incident, including its comment thread.

7. Heartbeat

Marks a heartbeat monitor up, same effect as calling its own per-monitor ping URL (shown on the monitor's Heartbeat APIs card). Only works with a heartbeat- purpose key - an admin key gets 403. No body required:

curl -X POST https://api.kawze.com/v1/heartbeat/<monitorId> \
  -H "Authorization: Bearer kawze_live_<your-heartbeat-key>"

8. Notes

Alert configuration isn't a separate resource - it lives on each monitor's notifications array, so it's read and written through /v1/monitors like any other monitor field.

Enabling/disabling, duplicating a monitor, and the ad-hoc URL checker aren't part of the public API yet - those stay dashboard-only for now.