Public API

SLAtus has two kinds of HTTP endpoints:

• Read-only public endpoints for status consumers, no authentication.
• Write endpoints for integrations (monitoring tools, CI pipelines, chat bots). They require a Bearer API token.

The machine-readable specification is the OpenAPI 3.1 document at /openapi.json (source: public/openapi.json). It is also rendered interactively at /api-docs (Swagger UI, no login required, English only). The document covers /api/status, /api/outage/*, /api/incidents and /api/maintenances. /api/health is not included.

Public endpoints

Method	Path	Description
GET	/api/status	Overall status, component list with status and 90-day uptime. Cached for 30 seconds.
GET	/api/health	Infrastructure health (process and SELECT 1). Returns no business data and is never cached. Used by the Docker HEALTHCHECK.
GET	/feed.xml	RSS feed of incidents
GET	/badge.svg	SVG status badge (parameters style and label)

/api/status returns status (operational, maintenance, degraded, partial_outage, major_outage), a label, updatedAt and a components array with id, name, group, status and uptime90d.

/api/health answers 200 with {"status":"ok"}, or 503 with {"status":"error","error":"database unavailable"} if the database cannot be reached.

Write endpoints (Bearer token)

Method	Path	Body (main fields)	Purpose
POST	/api/outage/start/{serviceId}	severity	Start an outage for a service
POST	/api/outage/end/{outageId}	end (optional ISO time)	End an outage
POST	/api/outage/service/{serviceId}	start, end, severity	Create, replace or close outages for a service
POST	/api/incidents	title, impact, message, componentIds, componentStatus, optional status, occurredAt, respondedAt	Create an incident
POST	/api/maintenances	title, scheduledStart, scheduledEnd, componentIds, optional description	Create a maintenance window

Notes:

• Times are sent as ISO 8601 with a timezone (for example 2026-09-11T10:00:00Z). External clients do not know the server time zone.
• severity values are degraded_performance, partial_outage and major_outage. /api/outage/service additionally accepts operational to close running outages, and end may be null (the outage keeps running).
• impact values are none, minor, major and critical.
• POST /api/incidents accepts an initial status of investigating, identified, monitoring or resolved.
• Status changes triggered by the API produce the same notifications as changes made in the admin UI. Creating a maintenance window sends maintenance_scheduled.
• /api/outage/start answers 409 if the service already has a running outage with the same severity ("Service already has an ongoing outage with this severity."). A different severity is applied. /api/outage/end answers 409 if the outage has already ended ("Outage is already ended.").
• /api/incidents and /api/maintenances check the token scope for every component passed.

Response format

The write routes return the same envelope as server actions (lib/api/response.ts):

{ "ok": true, "data": { "id": "…", "status": "partial_outage" } }

{ "ok": false, "error": "This token is not authorized for the requested service." }

Validation errors contain fieldErrors instead of a raw Zod issue list. /api/status and /api/health, on the other hand, return flat objects without ok and data.

Status codes

Code	Meaning
200	Success
400	Invalid input. Validation errors include fieldErrors; invalid JSON only returns error ("Invalid JSON body.").
401	Missing, unknown, expired or revoked token. Counts as a failed attempt.
403	Valid token, but not allowed for the service ("This token is not authorized for the requested service.", for incidents and maintenance "… for one or more of the requested services."). Does not count as a failed attempt.
404	Unknown service or outage
409	Conflict, see the notes above
429	Too many failed attempts. The Retry-After header tells when to retry.

Example

curl -X POST https://status.example.com/api/incidents \
  -H "Authorization: Bearer $SLATUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "title": "Login errors for some users",
        "impact": "major",
        "message": "We are investigating elevated login failures.",
        "componentIds": ["<component-uuid>"],
        "componentStatus": "partial_outage"
      }'

Create and revoke tokens in the admin UI under Settings → API, card API Access (admin role only). Each token can be limited to selected services and can have an expiry date.