Monitor an authenticated HTTPS API

By CodaSky LLC · Updated October 15, 2026

Use a Pro monitor with custom request headers when your HTTPS health endpoint requires a Bearer token or another header credential. CodaURL sends those headers with its scheduled checks and immediate checks.

Keep the two credentials separate

The Bearer token used to call the CodaURL REST API identifies your CodaURL session. The value in request_headers authenticates requests to your own service. Use a scoped credential for the target service and supply it from your environment or secret manager.

Create the monitor

Send the following JSON to POST https://api.codaurl.com/api/v1/monitors, with Authorization: Bearer <CODAURL_SESSION_TOKEN> and Content-Type: application/json. Replace the example URL and target token placeholder at request time.

{
  "url": "https://my-service.com/health",
  "name": "Protected API",
  "expected_status": [
    200
  ],
  "check_interval_seconds": 300,
  "request_headers": [
    {
      "name": "Authorization",
      "value": "Bearer <TARGET_SERVICE_TOKEN>"
    }
  ]
}

Custom request headers require Pro. You can send up to 5 headers, with a combined limit of 2,048 UTF-8 bytes across names and values. Headers such as Host, Content-Length, Connection, Transfer-Encoding, and Cookie aren't accepted.

Understand credential handling

Header values are encrypted at rest and are write-only. Monitor responses expose the saved header name and has_value, without returning the credential:

{
  "request_headers": [
    {
      "name": "Authorization",
      "has_value": true
    }
  ]
}

Use PATCH /api/v1/monitors/<id> to replace request_headers. A supplied array replaces all saved headers, an empty array removes them, and omitting the field keeps them. Rotate the target credential by sending a replacement array.

Check the right HTTP response

Checks use HEAD first. Only HTTP 405 or 501 triggers a GET fallback; HTTP 401 or 403 doesn't. If a credential expires and the endpoint returns an unexpected status code, the monitor reports DOWN with unexpected_status.

Redirects aren't followed. The target must be a public HTTPS URL; credentials don't make private network addresses reachable. To inspect a response body, add a keyword condition, which makes the check use GET directly.

Inspect the result

Read GET /api/v1/monitors/<id> for the latest status, last_http_code, and last_error_code. Use POST /api/v1/monitors/<id>/check for an immediate check, subject to its cooldown and account limits.

The OpenAPI specification describes request fields. The CLI and API documentation explains authentication and how to read monitor results.