Status Pages
Public status pages, their sections, resources, incidents and subscribers
View an organization's default public status page
Renders the same payload as GET /api/v1/status-pages/{org}/{slug}, resolved to the organization's default page. No authentication required.
View a public status page
Full public rendering of a status page: sections, per-resource live status, and (when enabled) availability/response-time history. A disabled or non-public page returns 404, identical to a page that doesn't exist. No authentication required. Caching follows the page's visibility: a `public` page carries Cache-Control: public, max-age=60, stale-while-revalidate=30 — a cache may serve an expired copy for up to 30 s while it refreshes in the background — while a `password` or `private` page, and every 401/404 answer, carries Cache-Control: private, no-store, so a shared cache can never retain a gated page's body. Holding a valid unlock cookie does not change that: it authorizes the visitor, not the CDN in front of them. Public responses carry Vary: X-Forwarded-Proto (the header the absolute URLs in these payloads derive their scheme from); gated ones add Cookie.
Lightweight status summary for a status page
Cheap 'is it up?' companion to the full page view: overall status, per-category counts, page identity, and the canonical public URL — no sections, no per-resource history. Same visibility gate AND the same caching rule as the full page view: Cache-Control: public, max-age=60, stale-while-revalidate=30 for a `public` page, private, no-store (no grace window) for a `password` or `private` one (unlocked or not) and for every 401/404 answer. A disabled or non-public page returns 404, identical to a page that doesn't exist. No authentication required.
SVG badge for a status page's overall status
Public SVG badge (shields.io style) reflecting the page-level rollup status — the static, script-free sibling of the JS embed widget, for contexts like GitHub READMEs where scripts can't run. Same visibility gate as the full view and the summary endpoint: a disabled or non-public page returns 404, identical to a page that doesn't exist. Same caching rule too: Cache-Control: public, max-age=60, stale-while-revalidate=30 for a `public` page, private, no-store for a `password` or `private` one — the badge renders the rollup status of a page the requester may not be entitled to see. No authentication required.
Embeddable live status widget script
Self-contained JavaScript (IIFE) that renders a live status pill on a third-party site. It is loaded by an async script tag carrying data-page='org/slug', and configured entirely through data-attributes: data-mode (inline|floating), data-position (bottom-right|bottom-left), data-theme (light|dark|auto), data-size (sm|md|lg), per-state label overrides data-label-operational|degraded|down|maintenance|unknown, and data-force-status (operational|degraded|down|maintenance|unknown) to render a status statically without polling. The widget polls the status page summary endpoint every 60 s with an uncredentialed request and renders into a shadow root; a failed request or an unknown page renders nothing. Everything under /embed/v1/ is a frozen public contract — behavior changes ship under /embed/v2/, but additive, backward-compatible data-attributes may land within v1. Response carries Cache-Control: public, max-age=3600. No authentication required.
Public incident history for a status page
The customer-facing incidents published on this page (spec 2026-08-19-08). Without `active`, returns the page's history window; with `active=true`, only the incidents that are still open — the same set the full page view embeds as `activeIncidents[]`.
Atom feed of a status page's status-update timeline
Public Atom/RSS feed of the page's recent status updates (incident posts and manual updates). Same visibility gate as the full page view, and the same visibility-driven caching: Cache-Control: public, max-age=300, stale-while-revalidate=30 for a `public` page, private, no-store for a `password` or `private` one — the feed quotes update titles and bodies verbatim. No authentication required.
Unlock a password-protected status page
Verifies the page password and, on success, sets the unlock cookie every gated public read then requires.
Unlock an organization's password-protected default status page
Same as POST /api/v1/status-pages/{org}/{slug}/unlock, resolved to the organization's default page — the form a client reaching a default page through /s/{org} can use, having no slug to send.
List status pages
List status pages
Create a status page
Create a status page
Get a status page
Get a status page
Update a status page
Update a status page
Delete a status page
Delete a status page
Mint or regenerate a status page's kiosk (TV mode) token
Mints the page's single kiosk token — a long-lived, revocable, per-page secret a wallboard presents as a `kiosk` query parameter so an office TV can render a `password` or `private` page unattended. It grants READ-ONLY view of this one page and nothing else.
Revoke a status page's kiosk token
Clears the stored hash. Any screen still presenting the old token falls straight back to the page's ordinary visibility rules — 401 for a `password` page, 404 for a `private` one — with no distinguishable 'revoked' answer. Idempotent: revoking a page that has no token succeeds.
Verify a status page's custom domain
Resolves the domain's CNAME and compares it against the expected target for the configured mode (server.custom_domain_cname_mode: 'shared' uses the installation target, 'token' uses the page-specific '<token>.cname.<target>' host — there is no dual-accept). Stamps the result. Rate-limited per organization.
Edge-TLS custom-domain check (public)
Returns 204 when the queried domain currently resolves to a verified, enabled, public status page, and 404 otherwise. No body. This is the contract for Caddy on_demand_tls / cert-manager gating on an external TLS edge; it is unchanged by, and independent of, the server's own in-server ACME support (config acme.enabled).
List sections of a status page
List sections of a status page
Create a section
Create a section
Reorder the sections of a status page
Reorder the sections of a status page
Get a section
Get a section
Update a section
Update a section
Delete a section
Delete a section
List resources of a section
List resources of a section
Add a check as a resource to a section
Add a check as a resource to a section
Reorder the resources of a section
Reorder the resources of a section
Update a resource
Update a resource
Remove a resource from a section
Remove a resource from a section
List subscribers of a status page
List subscribers of a status page
Subscribe an email address to a status page
PUBLIC, unauthenticated. Double opt-in: a confirmation email is sent and nothing is delivered until its link is followed, which is the primary anti-abuse control.
Register a webhook or Slack delivery for a status page
AUTHENTICATED, operator-side. Creates a subscription that delivers to a URL rather than a mailbox, already confirmed — the operator registering their own endpoint IS the verification.
Remove a subscriber from a status page
Remove a subscriber from a status page
List the incident publications on a status page
List the incident publications on a status page
Publish a hand-written incident on a status page
Publish a hand-written incident on a status page
Get one incident publication with its narrative
Get one incident publication with its narrative
Edit a publication's title, severity or state
Edit a publication's title, severity or state
Append a narrative update to a published incident
Append a narrative update to a published incident