Monitor everything you run. From code.

Create an http monitor with an assertion

AssertRuleLang rules judge the response, not just the status code - here, up means a 2xx that also contains the text a working checkout page always renders.

curl -X POST https://api2.host-tracker.com/monitor \
  -H "Authorization: Bearer $HT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: checkout-monitor-1" \
  -d '{
    "type": "http",
    "url": "https://example.com/checkout",
    "name": "Checkout flow",
    "interval": 60,
    "locations": { "pools": ["westeurope"] },
    "settings": { "assertMode": true, "assertsSource": "status isOk\nbody contains \"Add to cart\"" }
  }'

Pause a monitor during a deploy

A monitor's enabled flag is a plain PATCH - flip it off before a release and back on when the deploy is done.

curl -X PATCH https://api2.host-tracker.com/monitor/MONITOR_ID \
  -H "Authorization: Bearer $HT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'

List what is down

The same filter the dashboard uses, straight over the wire.

curl -s "https://api2.host-tracker.com/monitor?state=down" \
  -H "Authorization: Bearer $HT_TOKEN"

Open a status-page incident

Declaring an incident fans out to the page's subscribers, so this is one of the nine writes that require an Idempotency-Key.

curl -X POST https://api2.host-tracker.com/statuspage/PAGE_ID/incident \
  -H "Authorization: Bearer $HT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: incident-2026-08-23-1" \
  -d '{"title": "Elevated error rates", "state": "investigating", "message": "We are looking into a spike in errors on checkout.", "impact": "major"}'

Run an instant check from several regions and poll it

An instant check is synchronous work behind an async door - it answers 202 with a Retry-After, and the same id resolves the result.

curl -X POST https://api2.host-tracker.com/check \
  -H "Authorization: Bearer $HT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "type": "http", "pools": ["westeurope", "asia"]}'

curl -s https://api2.host-tracker.com/check/DB_ID/CHECK_ID \
  -H "Authorization: Bearer $HT_TOKEN"

Subscribe a contact to a monitor

Setting the alert-type set for a (monitor, contact) pair is idempotent - send the whole set every time, not a diff.

curl -X PUT https://api2.host-tracker.com/monitor/MONITOR_ID/alert/CONTACT_ID \
  -H "Authorization: Bearer $HT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"alertTypes": ["down", "up"]}'

Verify a webhook signature

HMAC-SHA256 over the timestamp and the raw body, keyed on the whole secret string - the full working code, in Python and Node, is in the webhooks guide.

signed   = timestamp + "." + raw_body_bytes
expected = hmac_sha256_hex(secret, signed)
if not any(hmac_equal(expected, s) for s in signatures_from(header)):
    reject()  # never trust a re-serialized body

Bulk-create monitors from a CSV, safely

The bulk door is async and requires an Idempotency-Key - a timed-out request can be retried without creating the batch twice.

curl -X POST https://api2.host-tracker.com/monitor/bulk \
  -H "Authorization: Bearer $HT_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: csv-import-2026-08-23" \
  -d '{"items": [{"type": "http", "url": "https://a.example.com"}, {"type": "http", "url": "https://b.example.com"}]}'

curl -s https://api2.host-tracker.com/job/JOB_ID \
  -H "Authorization: Bearer $HT_TOKEN"