MonitorInput

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/uptimemonitoring-com/json-schema/uptimemonitoring-com-monitor-input-schema.json",
  "title": "MonitorInput",
  "description": "All string fields must be valid UTF-8 with no null bytes.\nURL fields must additionally be free of ASCII control characters\n(U+0000..U+001F and U+007F). Violations return HTTP 400.\n",
  "x-generated": "2026-10-31",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/uptimemonitoring-com-openapi.yaml#/components/schemas/MonitorInput",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "maxLength": 255
    },
    "url": {
      "type": "string",
      "maxLength": 2048,
      "description": "Target URL. Format depends on `type`:\n  * `http` — full http(s) URL.\n  * `tcp` — `host:port` or `tcp://host:port`, port restricted to\n    a fixed allowlist (issue #331): 21, 22, 25, 80, 110, 143,\n    443, 465, 587, 993, 995, 2222, 3000, 3306, 5000, 5432, 6379,\n    8000, 8080, 8443, 8888, or 27017. Every create,\n    and every update whose body includes `url` or `type`, stores\n    the canonical `tcp://host:port` form (lowercase, no path)\n    regardless of which shape was sent — `example.com:443`,\n    `tcp://example.com:443`, and `tcp://EXAMPLE.com:443/` all\n    store as `tcp://example.com:443`. An update that changes\n    neither `url` nor `type` leaves the stored URL as it is. A\n    bracketed IPv6 literal is required (`[2001:db8::1]:443`); an\n    unbracketed one is rejected as ambiguous.\n  * `ping` — a bare hostname or IP literal (e.g.\n    `api.example.com`, `1.1.1.1`) — no scheme, path, query,\n    userinfo, or port.\n  * `dns` / `ssl` — reserved formats (a bare hostname for `dns`)\n    for a `type` that is defined but not yet serviced by the\n    check engine; see the `type` field.\n"
    },
    "type": {
      "type": "string",
      "description": "`http`, `tcp`, and `ping` are accepted on create or update.\n`dns` and `ssl` are defined in the wire format but rejected\nwith `400` (issue #209): `type must be one of: http, tcp, ping,\ndns, ssl (currently available: http, ping, tcp)` for an\nunrecognized value, or `type '<type>' is not available yet; the\ncheck engine currently supports: http, ping, tcp` for one of\nthose two.\n",
      "enum": [
        "http",
        "tcp",
        "ping"
      ]
    },
    "interval_sec": {
      "type": "integer",
      "minimum": 60,
      "description": "Check interval in seconds. Default 60."
    },
    "expected_status": {
      "type": "string",
      "description": "HTTP status range. Default: 200-399. Accepted but silently\nignored for `type: tcp` or `type: ping` (neither has an HTTP\nresponse to evaluate it against).\n"
    },
    "body_match": {
      "type": "string",
      "maxLength": 1024,
      "description": "Optional string to match in the response body. HTTP only —\nrejected with `400` (`body_match is not applicable to tcp\nmonitors`) when `type` is `tcp`. Accepted but silently ignored\n(a harmless no-op; wopher's ping check never reads it) when\n`type` is `ping`.\n"
    },
    "enabled": {
      "type": "boolean",
      "description": "Default true."
    },
    "maintenance": {
      "$ref": "#/$defs/MaintenanceWindow"
    },
    "method": {
      "type": "string",
      "enum": [
        "GET",
        "POST",
        "PUT",
        "DELETE",
        "PATCH",
        "OPTIONS"
      ],
      "description": "HTTP request method (issue #364). Default `GET`. HTTP only —\nsending this field at all (including its default value) on a\n`tcp` or `ping` create/update is `400`\n(`method is only applicable to http monitors`). On update,\nomitting it leaves the stored method unchanged; an explicit\n`null` is `400` (`method must not be null`) — but only when\n`null` is the value the request body actually decodes to:\nexact-duplicate JSON keys (same spelling) resolve via\n`encoding/json`'s last-value-wins before this check ever runs,\nso `{\"method\":null,\"method\":\"POST\"}` is accepted as `POST`;\nonly a differently-cased duplicate (e.g. `Method` alongside\n`method`) is itself rejected, as more than one key for the\nsame field. The same caveat applies to `body`/`timeout_sec`\nbelow, which share this rejection rule.\n"
    },
    "body": {
      "type": "string",
      "maxLength": 4096,
      "description": "Request body (issue #364). Default `\"\"` — a bodiless POST is\nallowed. Must be valid UTF-8 with no null bytes. HTTP only, same\nrejection rule as `method`. Cleared by sending `\"\"` on update.\n"
    },
    "headers": {
      "type": "array",
      "maxItems": 20,
      "items": {
        "type": "object",
        "required": [
          "name"
        ],
        "description": "The case-insensitive duplicate-key rejection described below\nfor `name`/`value` applies only to the request's TOP-LEVEL\nkeys (`method`, `body`, `headers`, `timeout_sec` — see\n`method`'s description above). It does NOT recurse into each\nheader object: a header entry is decoded by\n`encoding/json` into a plain struct, which matches `name`/\n`value` case-insensitively and, when more than one JSON key\nin the same object folds to the same field (any casing, not\njust an exact-spelling duplicate), keeps whichever key\noccurs LAST in that object — e.g. `{\"value\":null,\"Value\":\"x\"}`\ndecodes to `value: \"x\"`, not a rejection. Unknown properties\non a header object are silently ignored by the same decode,\nnot rejected.\n",
        "properties": {
          "name": {
            "type": "string",
            "description": "An RFC 7230 token. `Host`, `Content-Length`,\n`Transfer-Encoding`, and `Connection` are rejected\ncase-insensitively, as are two entries with the same name\n(case-insensitive). This is a check across the headers\narray's entries, not of this field's own JSON key\nspelling within one entry — see this schema's own\ndescription above for that.\n"
          },
          "value": {
            "type": "string",
            "description": "On `PUT`, an entry with `value` omitted keeps the\ncurrently stored value for that name (case-insensitive\nmatch) — the array as a whole still REPLACES the full\nstored list, so omitting `headers` entirely (not sending\nan entry at all) is what leaves every header untouched.\nA name with no stored value and no `value` sent is `400`.\nAn explicit `null` is `400` (`header \"<name>\" value must\nnot be null`) when `null` is the value `encoding/json`\nresolves this field to — see this schema's own\ndescription above for how a same- or differently-cased\nduplicate `value`/`Value` key within one header object\nresolves instead (last occurrence wins, never rejected).\nOn `POST`, every entry must carry a `value` — there is\nnothing stored yet to keep.\n"
          }
        }
      },
      "description": "Custom request headers (issue #364), at most 20 entries and\n8192 bytes total (`len(name)+2+len(value)` summed). HTTP only,\nsame rejection rule as `method`. Values must be valid UTF-8 with\nno CR, LF, NUL, or other control character except horizontal\ntab. On update, sending `url` with a different scheme,\nlowercased host, or effective port than the stored URL requires\nevery resulting header to carry a `value` in THIS request — an\nomitted `headers` field (when headers are stored) or any\nkept-by-name entry is `400`\n(`headers must be resent with their values when the URL's\nscheme, host, or port changes`), closing the path where one\naccount member could repoint another member's monitor (with\nits still-live secret header) at a host they control. An empty\narray (`[]`) clears every header.\n"
    },
    "timeout_sec": {
      "type": "integer",
      "minimum": 1,
      "maximum": 30,
      "description": "Request timeout in seconds (issue #364). Default 30. HTTP only,\nsame rejection rule as `method`.\n"
    }
  },
  "$defs": {
    "MaintenanceWindow": {
      "type": "object",
      "description": "A monitor's single alert-silencing window (issue #361). Always\npresent on a `Monitor`; `{\"type\":\"none\"}` (the default) silences\nnothing. Accepted on `MonitorInput`/`MonitorCreateInput` as one of\nthree discriminated shapes — each accepts ONLY the fields listed\nfor it, plus `type`; any other field (including one that belongs to\na different shape) is `400` naming it, e.g.\n`maintenance.timezone: not allowed for type \"once\"`.\n  * `none` — no other fields.\n  * `daily` — `start_time`, `end_time`, `timezone` all required.\n    Repeats every day in that IANA zone; may span midnight\n    (`start_time > end_time`). `start_time` must differ from\n    `end_time`. The zone must be a real IANA name — empty, `Local`,\n    and anything `LoadLocation` can't resolve are all rejected.\n  * `once` — `starts_at`, `ends_at` both required, `ends_at` after\n    `starts_at`. A single absolute span; no zone, since both\n    instants are already pinned by their offsets. Both timestamps\n    are normalized to UTC at microsecond precision (PostgreSQL's\n    `timestamptz` precision) before being validated or stored, so\n    two timestamps that differ only below a microsecond collapse to\n    equal and are rejected as `ends_at` not being after `starts_at`.\nOn `PUT`, omitting `maintenance` entirely leaves the stored window\nunchanged; an explicit JSON `null` is `400`\n(`maintenance must not be null`) — the same rule `recipients`\nfollows elsewhere. `POST` omitting it defaults to `{\"type\":\"none\"}`.\n",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "none",
            "daily",
            "once"
          ]
        },
        "start_time": {
          "type": "string",
          "description": "\"HH:MM\", daily only. Canonical: zero seconds, below 24:00."
        },
        "end_time": {
          "type": "string",
          "description": "\"HH:MM\", daily only."
        },
        "timezone": {
          "type": "string",
          "description": "IANA zone name, daily only."
        },
        "starts_at": {
          "type": "string",
          "format": "date-time",
          "description": "RFC3339, once only. Echoed back UTC-normalized at microsecond precision."
        },
        "ends_at": {
          "type": "string",
          "format": "date-time",
          "description": "RFC3339, once only. Echoed back UTC-normalized at microsecond precision."
        }
      }
    }
  }
}