HTTP / HTTPS monitor

The HTTP monitor performs a request against a URL and asserts on the response. It’s the workhorse check type for most “is the site up?” questions.

Configuration

Field	Type	Default	Notes
URL	URL	—	Full URL including scheme. Required.
Method	enum	GET	One of GET, POST, HEAD, PUT, DELETE.
Expected status	integer	200	Single HTTP status code, 100–599. For body-content assertions use the keyword monitor.
Timeout	seconds	30	5–60.
Headers	string map	—	Arbitrary request headers (key/value strings).
Body	string	—	Request body. Shown in the UI for POST and PUT.
Follow redirects	bool	true	Follow 3xx redirects up to a sane internal cap.
SSL verification	bool	true	Validate the certificate chain. Disable only for self-signed targets you control.
Authentication	object	{type: "none"}	One of: none, basic (with username/password), bearer (with token). Stored alongside the monitor config — there is no separate secrets store.
Degraded threshold	ms	—	Optional. Responses slower than this return degraded instead of up.
IP versions	array	["ipv4", "ipv6"]	Which families to test. Each requested version runs independently; aggregate status is down if any fails. Cloud runners are IPv4-only — IPv6 against cloud regions is skipped.

Result data

Each check returns:

• HTTP status code
• Total response duration (ms)
• DNS lookup, TCP connect, TLS handshake, TTFB breakdowns
• Response body size (bytes)
• Content-Type header
• IP versions actually used during the request

Status mapping

Outcome	Status
Response status matches expected_status and arrives under the degraded threshold	up
Response status matches but takes longer than degraded_threshold_ms	degraded
Response status doesn’t match expected_status	down
Timeout, DNS failure, TLS error, connection refused	down

Private & internal targets

Cloud checkers block requests to private or reserved addresses — RFC 1918 ranges, localhost, link-local / cloud-metadata, CGNAT and similar. A check against a blocked or unresolvable target records an explicit down result with the block or DNS-failure reason in the error message; it never silently disappears. To monitor internal services, use a self-hosted runner.

Common patterns

Auth-protected endpoint — set Authentication to bearer and paste the token. Rotating a token in the monitor config is cleaner than maintaining a shared password.

JSON API — POST with Content-Type: application/json in Headers, your payload in Body, and either an explicit expected status (200) or pair with a keyword monitor to assert on response body content.

Staging environments — disable SSL verification for self-signed certificates. Don’t disable it for anything you don’t control.