REST API | Nextvision Status

Authentication

Browser login creates an HttpOnly SameSite=Lax session cookie. HTTPS installations set Secure. Unsafe cross-origin requests are rejected. Authenticated REST requests select an organization with X-Organization-ID; the API verifies membership and role before entering the tenant transaction.

curl -c cookies.txt -H 'Content-Type: application/json' \
  -d '{"email":"operator@your-company","password":"your-password"}' \
  https://your-status-host/api/v1/auth/login

curl -b cookies.txt -H 'X-Organization-ID: YOUR_ORGANIZATION_UUID' \
  https://your-status-host/api/v1/monitors

Contract

Download the machine-readable specification from /api/v1/openapi.json on your installation. Responses use JSON; errors contain an error string. Create calls return the new ID. Resource lists return arrays limited to 200 items; lists for monitors, incidents, maintenance, pages, components, audit and deliveries accept an offset query parameter.

The API includes auth, domain verification, invitations, pages, components, probes, monitors, metrics, incidents, attachments, maintenance, subscriptions, webhooks, reports, Business contact and platform quota administration. REST publication endpoints require Operator or above. Domain ownership activation requires Owner.

Probe protocol

Probe calls use a separate Bearer credential, never a browser session. POST /api/v1/probe/lease claims up to 50 jobs. POST /api/v1/probe/results submits up to 50 results carrying the job ID and lease token. Claims expire after 45 seconds. Expired claims can be reclaimed; duplicate successful submissions are idempotent.

Roles

Viewer reads workspace data. Operator adds monitors and publishes incidents/maintenance. Admin manages members, probes, pages and webhooks. Owner additionally activates the domain. Platform administration is a separate user flag, granted explicitly with the CLI.