# Recipe: deploy hooks

> Pause monitors during deploys, resume after — a GitHub Actions example that keeps restart blips out of your uptime history.

Source: https://upfour.io/docs/api/recipes/deploy-hooks

A rolling restart that drops requests for eight seconds is not an outage — but a 10-second monitor can notice it. Pause around the deploy and the planned restart stays out of your alert history and your uptime numbers. Paused monitors also cost nothing.

## The two calls

Set `UP4_API_KEY` and `MONITOR_ID` first.

```bash
curl -fsS -X POST "https://app.upfour.io/v1/monitors/$MONITOR_ID/pause" \
  -H "Authorization: Bearer $UP4_API_KEY"

# … deploy …

curl -fsS -X POST "https://app.upfour.io/v1/monitors/$MONITOR_ID/resume" \
  -H "Authorization: Bearer $UP4_API_KEY"
```

## GitHub Actions

Store the key as a repository secret. `if: always()` on the resume step matters — the monitor must come back even when the deploy fails (_especially_ then):

```yaml
name: deploy
on: { push: { branches: [main] } }

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      UP4_API_KEY: ${{ secrets.UP4_API_KEY }}
      MONITOR_ID: 42ded714-482c-4c3e-b7f2-bcd2e7ece4f1
    steps:
      - uses: actions/checkout@v4

      - name: Pause monitoring
        run: |
          curl -fsS -X POST "https://app.upfour.io/v1/monitors/$MONITOR_ID/pause" \
            -H "Authorization: Bearer $UP4_API_KEY"

      - name: Deploy
        run: ./deploy.sh

      - name: Resume monitoring
        if: always()
        run: |
          curl -fsS -X POST "https://app.upfour.io/v1/monitors/$MONITOR_ID/resume" \
            -H "Authorization: Bearer $UP4_API_KEY"
```

## Variants

**A whole fleet:** list the affected monitors first (`GET /monitors?q=…`, following the cursor) and loop. **Scheduled maintenance instead:** for recurring windows (nightly restarts), a [maintenance window](https://upfour.io/docs/plan-maintenance.md) on the monitor is cleaner than pausing from CI. **Scoped key:** give CI a key with only `monitor.write` — nothing else is reachable if the secret leaks.

![API token form with the name CI integration, access level Read-only, and monitor.read and monitor.write checked.](https://upfour.io/docs/images/api-tokens.webp)

**Create a scoped token.** Name, access level and permissions in the token form.

1. **Token name** Choose a name that identifies the integration, such as CI integration.
2. **Access level** The default for a token without explicit scopes. Read-only is the safe start. The screenshot shows the form before a token is created.
3. **Scopes** Select only the operations the integration needs. The example allows reading and writing monitors.