Update outage-detection settings
const url = 'https://api.nsin.cloud/uptime/settings?domain=example.com';const options = { method: 'PUT', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"enabled":true,"threshold_pct":1,"window_min":1,"min_requests":1,"min_active_min":1,"recover_min":1}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PUT \ --url 'https://api.nsin.cloud/uptime/settings?domain=example.com' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "enabled": true, "threshold_pct": 1, "window_min": 1, "min_requests": 1, "min_active_min": 1, "recover_min": 1 }'Partial update — omitted fields keep their current value.
Out-of-range values are rejected, not clamped. A threshold_pct outside
50–100, a window_min outside bounds.window_min_min–window_min_max,
a min_requests below 1, a min_active_min outside 1–window_min, or
a recover_min outside 1–30 fails the whole request with 400, naming
the offending field, and nothing is written. The one value the server
adjusts silently is min_active_min: if the update lowers window_min
below it, it is pulled down to match, because it can never exceed the
window.
Requires analytics.view, not domain.settings. The handler resolves
the domain with the same permission the uptime reads use, and every role
has analytics.view — so a viewer, who can change nothing else on the
domain, can switch outage alerts off or move the thresholds far enough
that no incident ever opens. Treat viewer on a domain as “can silence
outage alerting” and grant it accordingly.
A disabled domain does not block this write either. The disabled-domain
guard only covers configuration permissions and analytics.view is not
one of them, so there is no 409 here.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”The domain name (for example example.com). These endpoints take the
domain as a query parameter rather than a path segment.
Example
example.comRequest Body required
Section titled “Request Body required ”Every field is optional; omitted fields keep their current value.
object
Example generated
{ "enabled": true, "threshold_pct": 1, "window_min": 1, "min_requests": 1, "min_active_min": 1, "recover_min": 1}Responses
Section titled “ Responses ”The settings as stored, with the valid range for each in bounds.
object
Whether outage alerts are sent for this domain.
Per-minute origin-error percentage that counts as down.
Minutes the host must stay down before an incident opens.
Traffic floor — below this, no incident opens.
Minimum populated one-minute buckets required in the window.
Consecutive clear minutes before an incident resolves.
Valid range for each configurable field.
object
Example generated
{ "enabled": true, "threshold_pct": 1, "window_min": 1, "min_requests": 1, "min_active_min": 1, "recover_min": 1, "bounds": { "threshold_pct_min": 1, "threshold_pct_max": 1, "window_min_min": 1, "window_min_max": 1, "min_requests_min": 1, "recover_min_min": 1, "recover_min_max": 1 }}The domain query parameter is missing, the body is malformed, or a
value is outside its bound — for example
threshold_pct must be between 50 and 100. Nothing is saved.
The error shape used by every endpoint. error is always present. code
is present only on the failures that have one — do not require it, and do
not parse error to recover it.
object
Human-readable description of what went wrong.
Stable machine-readable reason. Present on some failures only; the
wording of error may change, this will not.
account_suspended—403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.domain_disabled—409, not403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.managed_by_reseller—403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.invite_email_mismatch—403fromPOST /invites/{token}/accept. The invitation was addressed to a different email; the body also carriesinvited_email, masked.
A panel session — not an API key — can additionally see
session_check_failed on a 503, which means the session could not
be verified, not that it is invalid. Retry it; do not discard the
token.
Example
{ "error": "read-only API key"}Missing, malformed, revoked or expired API key, or a key whose owning
user row is gone. A key whose owning account has merely been deactivated
is not this: that is 403 with code: account_suspended, because the
credential itself is intact and re-issuing it changes nothing.
The error shape used by every endpoint. error is always present. code
is present only on the failures that have one — do not require it, and do
not parse error to recover it.
object
Human-readable description of what went wrong.
Stable machine-readable reason. Present on some failures only; the
wording of error may change, this will not.
account_suspended—403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.domain_disabled—409, not403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.managed_by_reseller—403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.invite_email_mismatch—403fromPOST /invites/{token}/accept. The invitation was addressed to a different email; the body also carriesinvited_email, masked.
A panel session — not an API key — can additionally see
session_check_failed on a 503, which means the session could not
be verified, not that it is invalid. Retry it; do not discard the
token.
Examples
{ "error": "invalid API key"}The key is read-only and this endpoint is a write. Read-only keys may
only issue GET, HEAD and OPTIONS.
The error shape used by every endpoint. error is always present. code
is present only on the failures that have one — do not require it, and do
not parse error to recover it.
object
Human-readable description of what went wrong.
Stable machine-readable reason. Present on some failures only; the
wording of error may change, this will not.
account_suspended—403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.domain_disabled—409, not403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.managed_by_reseller—403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.invite_email_mismatch—403fromPOST /invites/{token}/accept. The invitation was addressed to a different email; the body also carriesinvited_email, masked.
A panel session — not an API key — can additionally see
session_check_failed on a 503, which means the session could not
be verified, not that it is invalid. Retry it; do not discard the
token.
Examples
{ "error": "read-only API key"}No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.
The error shape used by every endpoint. error is always present. code
is present only on the failures that have one — do not require it, and do
not parse error to recover it.
object
Human-readable description of what went wrong.
Stable machine-readable reason. Present on some failures only; the
wording of error may change, this will not.
account_suspended—403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.domain_disabled—409, not403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.managed_by_reseller—403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.invite_email_mismatch—403fromPOST /invites/{token}/accept. The invitation was addressed to a different email; the body also carriesinvited_email, masked.
A panel session — not an API key — can additionally see
session_check_failed on a 503, which means the session could not
be verified, not that it is invalid. Retry it; do not discard the
token.
Example
{ "error": "read-only API key"}The key exceeded its request budget (300 requests per minute by default).
The error shape used by every endpoint. error is always present. code
is present only on the failures that have one — do not require it, and do
not parse error to recover it.
object
Human-readable description of what went wrong.
Stable machine-readable reason. Present on some failures only; the
wording of error may change, this will not.
account_suspended—403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.domain_disabled—409, not403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.managed_by_reseller—403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.invite_email_mismatch—403fromPOST /invites/{token}/accept. The invitation was addressed to a different email; the body also carriesinvited_email, masked.
A panel session — not an API key — can additionally see
session_check_failed on a 503, which means the session could not
be verified, not that it is invalid. Retry it; do not discard the
token.
Examples
{ "error": "rate limit exceeded"}