Unlock a password-protected status page
POST/api/v1/status-pages/:org/:slug/unlock
Verifies the page password and, on success, sets the unlock cookie every gated public read then requires.
The cookie is HOST-ONLY (no Domain attribute), HttpOnly, SameSite=Lax, Secure when the request arrived over TLS, and lasts 12 hours. Host-only is what makes it work on a customer's own domain without ever minting a cookie for solidping.io. It is signed with a key derived from the stored password hash, so changing or clearing the password invalidates every outstanding unlock immediately.
Attempts are rate limited per (client IP, page).
Request
Responses
- 204
- 401
- 404
- 422
- 429
Unlocked. The response carries Set-Cookie: sp_unlock_
Response Headers
The host-only unlock cookie.
Incorrect password. Same STATUS_PAGE_LOCKED code the gated reads use, so a client can keep the visitor on the unlock form with one branch.
No live, password-protected page under this slug. A public page answers 404 here too — telling a caller "this page exists but needs no password" would be a needless disclosure.
Validation error
Too many requests