Monitoring, status pages and incidents, over REST.

One REST API at https://app.upfour.io/v1 with 271 routes for monitors, scheduled jobs, incidents, status pages, alerting, on-call, playbooks, clients, teams, webhooks, reports and company settings. Managing API keys, billing and personal account settings stays in the signed-in app. This page summarizes how requests are shaped, how they fail and how changes are announced; each topic has its own page. Every reference page has a “Try it” panel that runs real requests from your browser with your own key.

Authentication

Create an API key in the app under Settings → API tokens and send it as a Bearer token. Every key starts with pls_ and carries scopes such as monitor.read or incident.write; each endpoint names the scope it needs. A key cannot create or manage other keys. API keys and scopes has the details and the errors.

curl -s https://app.upfour.io/v1/me \
  -H "Authorization: Bearer $UP4_API_KEY"

Response envelope

Successful calls made with an API key return their payload as { "data": … }; lists add a pagination object. See responses and errors.

Errors

Every 4xx and 5xx response is { "error": { "code", "message", "request_id" } }, with details when there is more to say. Branch on the code. The error catalogue lists every code with its cause and fix.

Pagination

GET /monitors pages with signed cursors (limit up to 250, pagination.next_cursor); the incident lists use page and per_page, and most other lists return everything at once. Pagination has the parameters and the cursor errors.

Idempotency

Send Idempotency-Key on POST and PATCH requests. The same key with the same body returns the stored response for 24 hours; the same key with a different body is 409 idempotency_key_conflict. Idempotency lists what is and is not stored.

Versioning

Every operation is served under /v1; there is no /v2, and the API sends no Deprecation or Sunset header. The changelog records every change, with a filter for breaking ones, and versioning says what X-API-Version does today.

Rate limits

Authenticated calls are limited per key (1,200 requests per minute, bursts of 300) and per IP address (3,000 per minute). A 429 carries Retry-After. Rate limits explains the headers and how to back off.

Client scope

In agency mode, pass client_id or all_clients=true on list calls and client_id in request bodies. See client scope.

Conventions

IDs are UUIDs. Timestamps are RFC 3339 in UTC. Boolean query values are a strict true or false. Browser API calls use Authorization, Idempotency-Key and X-API-Version. Documentation and marketing origins are bearer-only CORS origins and never receive credentialed session access; only the exact app origin may send the product's HttpOnly session cookie.

Machine-readable

Every route as files, generated from the router’s route inventory: OpenAPI 3.1 (YAML) · OpenAPI 3.1 (JSON) · Postman collection. Parameters are typed; most request bodies are open objects, and the field tables on the reference pages cover monitors, scheduled jobs and alert channels so far. For AI tooling there is an llms.txt index of every docs page.

Reference