API Documentation
Programmatic access to FlareCanary. Manage endpoints, view drift events, configure alerts, and monitor MCP servers via REST API.
Contents
Authentication
All authenticated endpoints accept either a session cookie (from the dashboard) or an API key via the x-api-key header.
curl -H "x-api-key: fc_your_api_key_here" \
https://flarecanary.com/api/endpointsGenerate an API key in Dashboard → Settings. Keys use the fc_ prefix.
Header encryption: Any authentication headers you configure for monitored endpoints are encrypted at rest using AES-256-GCM. They are only decrypted in memory during polling. You can use the Header Helper in the dashboard to generate common auth header formats (Bearer tokens, Basic auth, custom headers) without manual JSON editing.
Endpoints
FlareCanary monitors two types of endpoints: REST APIs (tracks JSON schema structure) and MCP servers (tracks tool catalogs via the Model Context Protocol). Set endpointType when creating an endpoint.
/api/endpointsAuth requiredList all your monitored endpoint subscriptions.
Query: ?active=true|false (default: true)
// Response
{
"endpoints": [
{
"id": "sub_abc123",
"name": "Stripe Charges",
"url": "https://api.stripe.com/v1/charges",
"method": "GET",
"endpointType": "rest",
"pollIntervalMinutes": 60,
"isActive": true,
"tags": ["payments", "critical"],
"driftCount": 2,
"lastCheckedAt": "2026-03-16T10:00:00Z",
"lastStatusCode": 200
}
],
"count": 1
}/api/endpointsAuth requiredSubscribe to a new API endpoint or MCP server for monitoring.
// REST endpoint
{
"name": "Stripe Charges",
"url": "https://api.stripe.com/v1/charges",
"method": "GET",
"endpointType": "rest",
"headers": { "Authorization": "Bearer sk_..." },
"requestBody": null,
"pollIntervalMinutes": 60,
"tags": ["payments"]
}
// MCP server
{
"name": "My MCP Server",
"url": "https://mcp.example.com/mcp",
"endpointType": "mcp",
"headers": { "Authorization": "Bearer token" },
"pollIntervalMinutes": 60,
"tags": ["ai-tools"]
}
// Response (201)
{ "id": "sub_abc123", "name": "Stripe Charges", ... }For MCP servers, method is automatically set to POST. The initial poll connects via MCP protocol and captures the tool catalog as the baseline schema. MCP response includes mcpServerInfo with serverName, protocolVersion, toolCount, and lastToolNames.
/api/endpoints/:idAuth requiredGet a single endpoint subscription with full details.
/api/endpoints/:idAuth requiredUpdate subscription settings. URL, method, and headers are immutable after creation.
// Request body (all fields optional)
{
"name": "Updated Name",
"pollIntervalMinutes": 120,
"tags": ["updated-tag"],
"isActive": false
}/api/endpoints/:idAuth requiredUnsubscribe from an endpoint. If no other subscribers remain, the watched URL is also removed.
/api/endpoints/testAuth requiredTest an endpoint connection without saving. Supports both REST and MCP endpoint types.
// REST test
{
"url": "https://api.example.com/data",
"endpointType": "rest",
"method": "GET",
"headers": {}
}
// REST response
{
"success": true,
"statusCode": 200,
"responseTimeMs": 142,
"isJson": true,
"fieldCount": 12
}
// MCP test
{
"url": "https://mcp.example.com/mcp",
"endpointType": "mcp",
"headers": { "Authorization": "Bearer token" }
}
// MCP response
{
"success": true,
"endpointType": "mcp",
"responseTimeMs": 230,
"serverName": "my-mcp-server",
"protocolVersion": "2025-03-26",
"toolCount": 5,
"toolNames": ["search", "create", "update", "delete", "list"]
}/api/endpoints/:id/refreshAuth requiredManually re-poll the endpoint and update the baseline schema.
/api/endpoints/libraryAuth requiredBrowse the public endpoint library. Discover popular APIs already monitored by other users.
Query: ?q=search&limit=100&offset=0
Drift Events
For REST endpoints, drift events track JSON schema changes (added, removed, or type-changed fields). For MCP servers, drift events track tool catalog changes (tools added, removed, or modified).
/api/endpoints/:id/driftsAuth requiredGet drift event history for an endpoint.
Query: ?limit=50&severity=breaking|warning|info
// Response
{
"endpointId": "sub_abc123",
"endpointName": "Stripe Charges",
"events": [
{
"id": "drift_xyz",
"severity": "breaking",
"changes": [
{ "path": "data.currency", "type": "removed" },
{ "path": "data.amount", "type": "type_change",
"from": "number", "to": "string" }
],
"detectedAt": "2026-03-16T10:00:00Z"
}
],
"count": 1
}/api/endpoints/:id/drifts/:driftIdAuth requiredAcknowledge or resolve a drift event.
// Request body
{
"action": "acknowledge" // or "resolve"
}
// Response
{ "success": true, "action": "acknowledge", "driftId": "drift_xyz" }/api/endpoints/:id/mcp-errorsAuth requiredGet JSON-RPC error code breakdown for MCP endpoints. Shows error distribution and state transitions.
Query: ?range=24h|7d|30d (default: 7d). Only available for MCP endpoint types.
// Response
{
"range": "7d",
"totalPolls": 168,
"successCount": 162,
"failureCount": 6,
"errorCodeDistribution": { "-32601": 3, "-32603": 1 },
"connectionErrors": { "Timeout": 2 },
"transitions": [
{ "from": "success", "to": "-32601", "at": "2026-03-16T10:00:00Z" }
]
}/api/endpoints/:id/drift-alertsAuth requiredGet drift alert configuration for an endpoint (enabled status and minimum severity threshold).
/api/endpoints/:id/drift-alertsAuth requiredToggle drift alerts on/off and set the minimum severity that triggers a notification.
// Request body
{
"driftAlertsEnabled": true,
"driftAlertMinSeverity": "warning" // "info" | "warning" | "breaking"
}Poll History, Uptime & SSL
/api/endpoints/:id/historyAuth requiredGet poll history with response time stats for charting.
Query: ?range=24h|7d|30d (default: 7d)
// Response
{
"history": [
{ "polledAt": "2026-03-16T10:00:00Z",
"statusCode": 200, "responseTimeMs": 142, "success": true }
],
"stats": {
"min": 98, "max": 312, "avg": 156,
"p50": 142, "p95": 285, "p99": 310
},
"totalPolls": 168,
"successfulPolls": 167,
"failedPolls": 1
}/api/endpoints/:id/uptimeAuth requiredGet 30-day uptime percentage with daily breakdown.
// Response
{
"uptimePercent": 99.4,
"totalPolls": 720,
"successfulPolls": 716,
"failedPolls": 4,
"dailyBuckets": [
{ "date": "2026-03-16", "total": 24, "success": 24 }
]
}/api/endpoints/:id/sslAuth requiredGet SSL certificate status including issuer and expiry date.
// Response
{
"sslExpiresAt": "2026-09-15T00:00:00Z",
"sslIssuer": "Let's Encrypt Authority X3",
"sslCheckedAt": "2026-03-16T10:00:00Z"
}/api/endpoints/:id/status-codesAuth requiredGet status code distribution over time.
Query: ?range=24h|7d|30d (default: 7d)
Alert Destinations
Alert destinations control where notifications are sent. Configure email or webhook destinations globally or per endpoint. Use Metric Alert Rules to control what triggers a notification.
/api/alertsAuth requiredList alert destination configurations. Optionally filter by endpoint.
Query: ?endpointId=sub_abc123 (optional — returns endpoint-specific and global alerts separately)
/api/alertsAuth requiredCreate a new alert destination (email or webhook).
// Email alert
{
"type": "email",
"config": { "to": "you@example.com" },
"minSeverity": "warning", // optional: "info" | "warning" | "breaking"
"endpointId": "sub_abc123" // optional (global if omitted)
}
// Webhook alert
{
"type": "webhook",
"config": { "url": "https://your-webhook-endpoint.com/hook" }
}/api/alerts/:idAuth requiredUpdate alert config or toggle active/inactive.
/api/alerts/:idAuth requiredRemove an alert destination.
Metric Alert Rules
Metric alert rules trigger notifications based on performance thresholds — response time, status codes, SSL expiry, response size, or availability. Rules evaluate over consecutive poll intervals to avoid false positives.
/api/alert-rulesAuth requiredList metric alert rules for a watched URL.
Query: ?watchedUrlId=uuid (required), &metric=response_time (optional filter)
/api/alert-rulesAuth requiredCreate a metric alert rule.
// Request body
{
"watchedUrlId": "uuid-of-watched-url",
"metric": "response_time",
"operator": "gt",
"threshold": 2000,
"consecutiveIntervals": 3,
"notifyOnResolve": false
}
// Supported metrics: response_time, status_code, ssl_expiry,
// response_size, availability
// Supported operators: gt, lt, eq, neq/api/alert-rules/:idAuth requiredReplace an existing metric alert rule.
/api/alert-rules/:idAuth requiredDelete a metric alert rule.
/api/alert-rules/:id/stateAuth requiredGet the current state of a metric alert rule (status, streak, acknowledgement).
/api/alert-rules/:id/acknowledgeAuth requiredAcknowledge a fired alert. Silences repeat notifications until the condition heals and re-fires.
/api/alert-rules/:id/resolveAuth requiredManually resolve a metric alert. Resets the alert state entirely (streak, acknowledgement, and status).
Alert Events
/api/alert-eventsAuth requiredList alert event history for a watched URL. Shows fired, acknowledged, and resolved events.
Query: ?watchedUrlId=uuid (required), &limit=20&offset=0
// Response
{
"events": [
{
"id": "evt_abc",
"type": "fired",
"metric": "response_time",
"threshold": 2000,
"actualValue": 3200,
"supersededBy": null,
"createdAt": "2026-03-16T10:00:00Z"
}
],
"count": 1
}/api/endpoints/:id/active-alertsAuth requiredGet currently active (unresolved) alerts for an endpoint.
/api/alert-events/orgAuth requiredList all alert events across the current organization. Includes both drift and metric alert events with endpoint context.
Query: ?limit=30&offset=0&type=drift|metric&search=url-fragment
Status Pages
Organizations can enable public status pages showing real-time endpoint health, uptime, and SSL status. Access is controlled per-org: public pages require no authentication, while members-only pages require org membership.
/api/status/:slugGet status page data for an organization by its slug. Public if the org has enabled public status pages, otherwise requires org membership.
// Response
{
"org": { "name": "My Team", "slug": "my-team", "description": "..." },
"isPublic": true,
"overallStatus": "operational", // "operational" | "degraded" | "down" | "unknown"
"endpoints": [
{
"name": "Stripe API",
"currentStatus": "operational",
"uptimePercent": 99.4,
"avgResponseTimeMs": 156,
"lastCheckedAt": "2026-03-16T10:00:00Z",
"sslStatus": "valid", // "valid" | "warning" | "critical" | "expired" | null
"dailyBuckets": [
{ "date": "2026-03-16", "total": 24, "success": 24 }
]
}
],
"generatedAt": "2026-03-16T10:05:00Z"
}Organizations
Organizations enable team-based monitoring on Startup and Enterprise plans. Endpoints, alerts, and folders are scoped to the active organization.
/api/orgsAuth requiredList organizations you belong to.
/api/orgsAuth requiredCreate a new organization.
// Request body
{
"name": "My Team",
"slug": "my-team" // lowercase alphanumeric with hyphens
}/api/orgs/:orgIdAuth requiredUpdate organization name or slug.
/api/orgs/:orgId/membersAuth requiredList organization members and their roles.
/api/orgs/:orgId/membersAuth requiredInvite a member to the organization.
Folders
/api/foldersAuth requiredList folders for the active organization.
/api/foldersAuth requiredCreate a folder to organize endpoints.
// Request body
{
"name": "Production APIs",
"color": "#4CAF50" // optional
}/api/foldersAuth requiredUpdate a folder name or color.
// Request body
{ "id": "folder-uuid", "name": "Updated Name" }/api/foldersAuth requiredDelete a folder. Endpoints in the folder are unassigned, not deleted.
// Request body
{ "id": "folder-uuid" }Settings
/api/settings/api-keyAuth requiredCheck if you have an API key generated.
/api/settings/api-keyAuth requiredGenerate or regenerate your API key. Returns the raw key (store it securely — it cannot be retrieved later).
/api/settings/api-keyAuth requiredRevoke your current API key.
/api/settings/planAuth requiredGet your current plan, limits, and usage.
// Response
{
"plan": "starter",
"limits": {
"maxEndpoints": 25,
"minPollIntervalMinutes": 60
},
"usage": { "endpoints": 8 }
}Demo
/api/demoSee a pre-built schema drift example (Stripe-like charge object). No authentication required.
/api/demoCompare two JSON objects for schema differences. No authentication required.
// Request body
{
"before": { "id": 1, "name": "Alice", "active": true },
"after": { "id": "1", "name": "Alice", "role": "admin" }
}
// Response
{
"drift": {
"changes": [
{ "path": "id", "type": "type_change", "from": "number", "to": "string" },
{ "path": "active", "type": "removed" },
{ "path": "role", "type": "added" }
],
"summary": { "added": 1, "removed": 1, "typeChanges": 1 }
}
}/api/demo/unstableA demo endpoint that rotates its schema every 6 hours. Monitor this to see drift detection in action.
Errors
All errors return a JSON body with an error field.
| Status | Meaning |
|---|---|
| 400 | Invalid request body or parameters |
| 401 | Missing or invalid authentication |
| 403 | Plan limit reached (ENDPOINT_LIMIT, INTERVAL_LIMIT) or insufficient org role |
| 404 | Resource not found |
| 409 | Conflict (e.g., duplicate email) |
| 500 | Internal server error |
Rate Limits & Plans
| Plan | Endpoints | Min poll interval | Price |
|---|---|---|---|
| Free | 3 | 24 hours | $0 |
| Starter | 25 | 1 hour | $19/mo |
| Pro | 100 | 15 minutes | $49/mo |
| Startup (team) | 250 | 15 minutes | $199/mo |
| Enterprise (team) | 500 | 15 minutes | $499/mo |